{
  "statistics": {
    "processing": [
      {
        "name": "CAPE",
        "time": 1.965
      },
      {
        "name": "AnalysisInfo",
        "time": 0.009
      },
      {
        "name": "BehaviorAnalysis",
        "time": 0.152
      },
      {
        "name": "Debug",
        "time": 0.001
      },
      {
        "name": "NetworkAnalysis",
        "time": 0.025
      },
      {
        "name": "UrlAnalysis",
        "time": 0.0
      },
      {
        "name": "script_log_processing",
        "time": 0.0
      },
      {
        "name": "ProcessMemory",
        "time": 0.0
      }
    ],
    "signatures": [
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "stealth_network",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_blocklist",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_hvcidisallowedimages",
        "time": 0.0
      },
      {
        "name": "disable_hypervisor_protected_code_integrity",
        "time": 0.0
      },
      {
        "name": "pendingfilerenameoperations_Operations",
        "time": 0.0
      },
      {
        "name": "anomalous_deletefile",
        "time": 0.0
      },
      {
        "name": "antiav_360_libs",
        "time": 0.0
      },
      {
        "name": "antiav_ahnlab_libs",
        "time": 0.0
      },
      {
        "name": "antiav_avast_libs",
        "time": 0.0
      },
      {
        "name": "antiav_bitdefender_libs",
        "time": 0.0
      },
      {
        "name": "antiav_bullguard_libs",
        "time": 0.0
      },
      {
        "name": "antiav_emsisoft_libs",
        "time": 0.0
      },
      {
        "name": "antiav_qurb_libs",
        "time": 0.0
      },
      {
        "name": "antiav_servicestop",
        "time": 0.0
      },
      {
        "name": "antiav_apioverride_libs",
        "time": 0.0
      },
      {
        "name": "antidebug_guardpages",
        "time": 0.0
      },
      {
        "name": "antidebug_ntcreatethreadex",
        "time": 0.0
      },
      {
        "name": "antiav_nthookengine_libs",
        "time": 0.0
      },
      {
        "name": "antidebug_outputdebugstring",
        "time": 0.0
      },
      {
        "name": "antidebug_setunhandledexceptionfilter",
        "time": 0.0
      },
      {
        "name": "antidebug_windows",
        "time": 0.0
      },
      {
        "name": "antiemu_wine_func",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoocrash",
        "time": 0.0
      },
      {
        "name": "antisandbox_foregroundwindows",
        "time": 0.0
      },
      {
        "name": "mouse_movement_detect",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_libs",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_objects",
        "time": 0.0
      },
      {
        "name": "antisandbox_script_timer",
        "time": 0.0
      },
      {
        "name": "antisandbox_sleep",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_libs",
        "time": 0.0
      },
      {
        "name": "antisandbox_unhook",
        "time": 0.0
      },
      {
        "name": "hardware_id_profiling",
        "time": 0.0
      },
      {
        "name": "antivm_directory_objects",
        "time": 0.0
      },
      {
        "name": "antivm_display",
        "time": 0.0
      },
      {
        "name": "antivm_generic_disk",
        "time": 0.0
      },
      {
        "name": "antivm_generic_scsi",
        "time": 0.0
      },
      {
        "name": "antivm_generic_services",
        "time": 0.0
      },
      {
        "name": "antivm_generic_system",
        "time": 0.0
      },
      {
        "name": "antivm_checks_available_memory",
        "time": 0.0
      },
      {
        "name": "detect_virtualization_via_recent_files",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_libs",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_window",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_events",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_libs",
        "time": 0.0
      },
      {
        "name": "antivm_wmi",
        "time": 0.0
      },
      {
        "name": "api_spamming",
        "time": 0.0
      },
      {
        "name": "api_uuidfromstringa",
        "time": 0.0
      },
      {
        "name": "bcdedit_command",
        "time": 0.0
      },
      {
        "name": "bootkit",
        "time": 0.0
      },
      {
        "name": "direct_hdd_access",
        "time": 0.0
      },
      {
        "name": "physical_drive_access",
        "time": 0.0
      },
      {
        "name": "potential_overwrite_mbr",
        "time": 0.0
      },
      {
        "name": "read_file_raw_disk_access",
        "time": 0.0
      },
      {
        "name": "suspicious_iocontrol_codes",
        "time": 0.0
      },
      {
        "name": "browser_needed",
        "time": 0.0
      },
      {
        "name": "amsi_enumeration",
        "time": 0.0
      },
      {
        "name": "regsvr32_squiblydoo_dll_load",
        "time": 0.0
      },
      {
        "name": "suspicious_ntdll_disk_load",
        "time": 0.0
      },
      {
        "name": "direct_syscall_evasion",
        "time": 0.0
      },
      {
        "name": "unbacked_syscall_execution",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstp",
        "time": 0.0
      },
      {
        "name": "uac_bypass_eventvwr",
        "time": 0.0
      },
      {
        "name": "uac_bypass_windows_Backup",
        "time": 0.0
      },
      {
        "name": "privilege_elevation_check",
        "time": 0.0
      },
      {
        "name": "dotnet_code_compile",
        "time": 0.0
      },
      {
        "name": "queries_computer_name",
        "time": 0.0
      },
      {
        "name": "queries_user_name",
        "time": 0.0
      },
      {
        "name": "creates_largekey",
        "time": 0.0
      },
      {
        "name": "creates_nullvalue",
        "time": 0.0
      },
      {
        "name": "access_windows_passwords_vault",
        "time": 0.0
      },
      {
        "name": "dump_lsa_via_windows_error_reporting",
        "time": 0.0
      },
      {
        "name": "lsass_credential_dumping",
        "time": 0.0
      },
      {
        "name": "critical_process",
        "time": 0.0
      },
      {
        "name": "query_fips_reconnaissance",
        "time": 0.0
      },
      {
        "name": "cryptopool_domains",
        "time": 0.0
      },
      {
        "name": "dead_connect",
        "time": 0.0
      },
      {
        "name": "dead_link",
        "time": 0.0
      },
      {
        "name": "debugs_self",
        "time": 0.0
      },
      {
        "name": "decoy_document",
        "time": 0.0
      },
      {
        "name": "decoy_image",
        "time": 0.0
      },
      {
        "name": "deletes_consolehost_history",
        "time": 0.0
      },
      {
        "name": "deletes_shadow_copies",
        "time": 0.0
      },
      {
        "name": "deletes_system_state_backup",
        "time": 0.0
      },
      {
        "name": "dep_bypass",
        "time": 0.0
      },
      {
        "name": "dep_disable",
        "time": 0.0
      },
      {
        "name": "disables_mappeddrives_autodisconnect",
        "time": 0.0
      },
      {
        "name": "disables_wfp",
        "time": 0.0
      },
      {
        "name": "add_windows_defender_exclusions",
        "time": 0.0
      },
      {
        "name": "mountpoints_volume_discovery",
        "time": 0.0
      },
      {
        "name": "dll_load_uncommon_file_types",
        "time": 0.0
      },
      {
        "name": "dllload_suspicious_directory",
        "time": 0.0
      },
      {
        "name": "document_script_exe_drop",
        "time": 0.0
      },
      {
        "name": "driver_load",
        "time": 0.0
      },
      {
        "name": "install_kernel_driver_service",
        "time": 0.0
      },
      {
        "name": "malformed_dll_loading",
        "time": 0.0
      },
      {
        "name": "dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "encrypted_ioc",
        "time": 0.0
      },
      {
        "name": "registers_vectored_exception_handler",
        "time": 0.0
      },
      {
        "name": "exec_crash",
        "time": 0.0
      },
      {
        "name": "process_creation_suspicious_location",
        "time": 0.0
      },
      {
        "name": "exploit_getbasekerneladdress",
        "time": 0.0
      },
      {
        "name": "exploit_gethaldispatchtable",
        "time": 0.0
      },
      {
        "name": "exploit_heapspray",
        "time": 0.0
      },
      {
        "name": "downloads_from_filehosting",
        "time": 0.0
      },
      {
        "name": "generic_phish",
        "time": 0.0
      },
      {
        "name": "http_request",
        "time": 0.0
      },
      {
        "name": "infostealer_browser",
        "time": 0.0
      },
      {
        "name": "infostealer_browser_password",
        "time": 0.0
      },
      {
        "name": "infostealer_cookies",
        "time": 0.0
      },
      {
        "name": "captures_screenshot",
        "time": 0.0
      },
      {
        "name": "injection_createremotethread",
        "time": 0.0
      },
      {
        "name": "creates_suspended_process",
        "time": 0.0
      },
      {
        "name": "injection_explorer",
        "time": 0.0
      },
      {
        "name": "injection_module_stomping_probing",
        "time": 0.0
      },
      {
        "name": "injection_needextension",
        "time": 0.0
      },
      {
        "name": "injection_network_traffic",
        "time": 0.0
      },
      {
        "name": "injection_runpe",
        "time": 0.0
      },
      {
        "name": "injection_rwx",
        "time": 0.0
      },
      {
        "name": "section_mapping_injection",
        "time": 0.0
      },
      {
        "name": "injection_themeinitapihook",
        "time": 0.0
      },
      {
        "name": "apc_injection",
        "time": 0.0
      },
      {
        "name": "resumethread_remote_process",
        "time": 0.0
      },
      {
        "name": "injection_write_exe_process",
        "time": 0.0
      },
      {
        "name": "injection_write_process",
        "time": 0.0
      },
      {
        "name": "internet_dropper",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_mutex",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_named_pipe",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_shared_memory",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_named_pipe",
        "time": 0.0
      },
      {
        "name": "ipc_namedpipe",
        "time": 0.0
      },
      {
        "name": "js_phish",
        "time": 0.0
      },
      {
        "name": "js_suspicious_redirect",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_internet_explorer_exporter",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_run_exe_helper_utility",
        "time": 0.0
      },
      {
        "name": "execute_ps_via_syncappvpublishingserver",
        "time": 0.0
      },
      {
        "name": "malicious_dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "reads_memory_remote_process",
        "time": 0.0
      },
      {
        "name": "unbacked_exception_filter",
        "time": 0.0
      },
      {
        "name": "unbacked_process_mitigation_alteration",
        "time": 0.0
      },
      {
        "name": "thread_unbacked_memory",
        "time": 0.0
      },
      {
        "name": "unbacked_api_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_dotnet_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_library_load",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_apc_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_protection_alteration",
        "time": 0.0
      },
      {
        "name": "unbacked_mutex_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_process_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_veh_registration",
        "time": 0.0
      },
      {
        "name": "unbacked_com_instantiation",
        "time": 0.0
      },
      {
        "name": "unbacked_crypto_operations",
        "time": 0.0
      },
      {
        "name": "unbacked_delay_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_file_dropping",
        "time": 0.0
      },
      {
        "name": "unbacked_process_enumeration",
        "time": 0.0
      },
      {
        "name": "unbacked_registry_modification",
        "time": 0.0
      },
      {
        "name": "unbacked_service_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_token_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_wmi_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_bind_shell",
        "time": 0.0
      },
      {
        "name": "unbacked_dns_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_network_connection",
        "time": 0.0
      },
      {
        "name": "unbacked_named_pipe_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_useragent_retrieval",
        "time": 0.0
      },
      {
        "name": "mimics_filetime",
        "time": 0.0
      },
      {
        "name": "amsi_bypass_via_com_registry",
        "time": 0.0
      },
      {
        "name": "access_auto_logons_via_registry",
        "time": 0.0
      },
      {
        "name": "access_boot_key_via_registry",
        "time": 0.0
      },
      {
        "name": "create_suspicious_lnk_files",
        "time": 0.0
      },
      {
        "name": "credential_access_via_windows_credential_history",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_microsoft_exchange",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_waas_medic_svc_com_typelib",
        "time": 0.0
      },
      {
        "name": "execute_file_downloaded_via_openssh",
        "time": 0.0
      },
      {
        "name": "execute_safe_mode_from_suspicious_process",
        "time": 0.0
      },
      {
        "name": "execute_scripts_via_microsoft_management_console",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_processes_via_windows_mssql_service",
        "time": 0.0
      },
      {
        "name": "execution_from_self_extracting_archive",
        "time": 0.0
      },
      {
        "name": "ip_address_discovery_via_trusted_program",
        "time": 0.0
      },
      {
        "name": "load_dll_via_control_panel",
        "time": 0.0
      },
      {
        "name": "network_connection_via_suspicious_process",
        "time": 0.0
      },
      {
        "name": "potential_location_discovery_via_unusual_process",
        "time": 0.0
      },
      {
        "name": "store_executable_registry",
        "time": 0.0
      },
      {
        "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent",
        "time": 0.0
      },
      {
        "name": "suspicious_java_execution_via_win_scripts",
        "time": 0.0
      },
      {
        "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File",
        "time": 0.0
      },
      {
        "name": "uses_restart_manager_for_suspicious_activities",
        "time": 0.0
      },
      {
        "name": "modify_desktop_wallpaper",
        "time": 0.0
      },
      {
        "name": "modify_zoneid_ads",
        "time": 0.0
      },
      {
        "name": "move_file_on_reboot",
        "time": 0.0
      },
      {
        "name": "multiple_useragents",
        "time": 0.0
      },
      {
        "name": "network_anomaly",
        "time": 0.0
      },
      {
        "name": "network_bind",
        "time": 0.0
      },
      {
        "name": "etherhiding_smart_contract_call",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_archive",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_free_webhosting",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_generic",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_interactsh",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_opensource",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_pastesite",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_payload",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_serviceinterface",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_socialmedia",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_telegram",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_tempstorage",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_urlshortener",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_useragent",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_exfil",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_generic",
        "time": 0.0
      },
      {
        "name": "network_dns_idn",
        "time": 0.0
      },
      {
        "name": "network_dns_suspicious_querytype",
        "time": 0.0
      },
      {
        "name": "network_dns_tunneling_request",
        "time": 0.0
      },
      {
        "name": "network_document_http",
        "time": 0.0
      },
      {
        "name": "explorer_http",
        "time": 0.0
      },
      {
        "name": "network_fake_useragent",
        "time": 0.0
      },
      {
        "name": "legitimate_domain_abuse",
        "time": 0.0
      },
      {
        "name": "suspicious_communication_trusted_site",
        "time": 0.0
      },
      {
        "name": "network_tor",
        "time": 0.0
      },
      {
        "name": "office_com_load",
        "time": 0.0
      },
      {
        "name": "office_dotnet_load",
        "time": 0.0
      },
      {
        "name": "office_mshtml_load",
        "time": 0.0
      },
      {
        "name": "office_vb_load",
        "time": 0.0
      },
      {
        "name": "office_wmi_load",
        "time": 0.0
      },
      {
        "name": "office_cve2017_11882",
        "time": 0.0
      },
      {
        "name": "office_cve2017_11882_network",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444_m2",
        "time": 0.0
      },
      {
        "name": "office_flash_load",
        "time": 0.0
      },
      {
        "name": "office_postscript",
        "time": 0.0
      },
      {
        "name": "office_suspicious_processes",
        "time": 0.0
      },
      {
        "name": "office_write_exe",
        "time": 0.0
      },
      {
        "name": "decompress_exe",
        "time": 0.0
      },
      {
        "name": "persistence_via_autodial_dll_registry",
        "time": 0.0
      },
      {
        "name": "persistence_autorun",
        "time": 0.0
      },
      {
        "name": "persistence_autorun_tasks",
        "time": 0.0
      },
      {
        "name": "persistence_bootexecute",
        "time": 0.0
      },
      {
        "name": "persistence_registry_script",
        "time": 0.0
      },
      {
        "name": "powershell_network_connection",
        "time": 0.0
      },
      {
        "name": "powershell_download",
        "time": 0.0
      },
      {
        "name": "powershell_request",
        "time": 0.0
      },
      {
        "name": "createtoolhelp32snapshot_module_enumeration",
        "time": 0.0
      },
      {
        "name": "enumerates_running_processes",
        "time": 0.0
      },
      {
        "name": "process_interest",
        "time": 0.0
      },
      {
        "name": "process_needed",
        "time": 0.0
      },
      {
        "name": "ransomware_iocp_asynchronous_encryption",
        "time": 0.0
      },
      {
        "name": "kernel_crypto_driver_abuse",
        "time": 0.0
      },
      {
        "name": "mass_data_encryption",
        "time": 0.0
      },
      {
        "name": "ransomware_extension_hijack",
        "time": 0.0
      },
      {
        "name": "mass_file_modification_access",
        "time": 0.0
      },
      {
        "name": "ransomware_attribute_stripping",
        "time": 0.0
      },
      {
        "name": "ransomware_file_modifications",
        "time": 0.0
      },
      {
        "name": "mass_ransom_note_drop",
        "time": 0.0
      },
      {
        "name": "ransomware_message",
        "time": 0.0
      },
      {
        "name": "reads_self",
        "time": 0.0
      },
      {
        "name": "recon_beacon",
        "time": 0.0
      },
      {
        "name": "recon_programs",
        "time": 0.0
      },
      {
        "name": "recon_systeminfo",
        "time": 0.0
      },
      {
        "name": "accesses_recyclebin",
        "time": 0.0
      },
      {
        "name": "script_created_process",
        "time": 0.0
      },
      {
        "name": "script_network_activity",
        "time": 0.0
      },
      {
        "name": "suspicious_js_script",
        "time": 0.0
      },
      {
        "name": "javascript_timer",
        "time": 0.0
      },
      {
        "name": "secure_login_phishing",
        "time": 0.0
      },
      {
        "name": "securityxploded_modules",
        "time": 0.0
      },
      {
        "name": "get_clipboard_data",
        "time": 0.0
      },
      {
        "name": "sets_autoconfig_url",
        "time": 0.0
      },
      {
        "name": "spoofs_procname",
        "time": 0.0
      },
      {
        "name": "stack_pivot",
        "time": 0.0
      },
      {
        "name": "stack_pivot_file_created",
        "time": 0.0
      },
      {
        "name": "stack_pivot_process_create",
        "time": 0.0
      },
      {
        "name": "set_clipboard_data",
        "time": 0.0
      },
      {
        "name": "stealth_childproc",
        "time": 0.0
      },
      {
        "name": "stealth_file",
        "time": 0.0
      },
      {
        "name": "stealth_system_procname",
        "time": 0.0
      },
      {
        "name": "stealth_timeout",
        "time": 0.0
      },
      {
        "name": "stealth_window",
        "time": 0.0
      },
      {
        "name": "queries_keyboard_layout",
        "time": 0.0
      },
      {
        "name": "queries_locale_api",
        "time": 0.0
      },
      {
        "name": "terminates_remote_process",
        "time": 0.0
      },
      {
        "name": "uiautomationcore_load",
        "time": 0.0
      },
      {
        "name": "user_enum",
        "time": 0.0
      },
      {
        "name": "mmc_dll_script_load",
        "time": 0.0
      },
      {
        "name": "mmc_dotnet_load",
        "time": 0.0
      },
      {
        "name": "virus",
        "time": 0.0
      },
      {
        "name": "webmail_phish",
        "time": 0.0
      },
      {
        "name": "persists_dev_util",
        "time": 0.0
      },
      {
        "name": "spawns_dev_util",
        "time": 0.0
      },
      {
        "name": "alters_windows_utility",
        "time": 0.0
      },
      {
        "name": "overwrites_accessibility_utility",
        "time": 0.0
      },
      {
        "name": "Potential_Lateral_Movement_Via_SMBEXEC",
        "time": 0.0
      },
      {
        "name": "potential_WebShell_Via_ScreenConnectServer",
        "time": 0.0
      },
      {
        "name": "uses_Microsoft_HTML_Help_Executable",
        "time": 0.0
      },
      {
        "name": "wiper_zeroedbytes",
        "time": 0.0
      },
      {
        "name": "wmi_create_process",
        "time": 0.0
      },
      {
        "name": "wmi_script_process",
        "time": 0.0
      },
      {
        "name": "antianalysis_tls_section",
        "time": 0.0
      },
      {
        "name": "antivirus_clamav",
        "time": 0.0
      },
      {
        "name": "antivirus_virustotal",
        "time": 0.0
      },
      {
        "name": "bad_certs",
        "time": 0.0
      },
      {
        "name": "bad_ssl_certs",
        "time": 0.0
      },
      {
        "name": "banker_zeus_p2p",
        "time": 0.0
      },
      {
        "name": "banker_zeus_url",
        "time": 0.0
      },
      {
        "name": "binary_yara",
        "time": 0.0
      },
      {
        "name": "bot_athenahttp",
        "time": 0.0
      },
      {
        "name": "bot_dirtjumper",
        "time": 0.0
      },
      {
        "name": "bot_drive",
        "time": 0.0
      },
      {
        "name": "bot_drive2",
        "time": 0.0
      },
      {
        "name": "bot_madness",
        "time": 0.0
      },
      {
        "name": "byod_loldrivers_match",
        "time": 0.0
      },
      {
        "name": "byod_novel_driver",
        "time": 0.0
      },
      {
        "name": "byod_post_load_exploitation",
        "time": 0.0
      },
      {
        "name": "byod_driver_service_install",
        "time": 0.0
      },
      {
        "name": "com_spawned_process",
        "time": 0.0
      },
      {
        "name": "phishing_kit_detected",
        "time": 0.0
      },
      {
        "name": "family_proxyback",
        "time": 0.0
      },
      {
        "name": "flare_capa_antianalysis",
        "time": 0.0
      },
      {
        "name": "flare_capa_collection",
        "time": 0.0
      },
      {
        "name": "flare_capa_communication",
        "time": 0.0
      },
      {
        "name": "flare_capa_compiler",
        "time": 0.0
      },
      {
        "name": "flare_capa_datamanipulation",
        "time": 0.0
      },
      {
        "name": "flare_capa_executable",
        "time": 0.0
      },
      {
        "name": "flare_capa_hostinteraction",
        "time": 0.0
      },
      {
        "name": "flare_capa_impact",
        "time": 0.0
      },
      {
        "name": "flare_capa_lib",
        "time": 0.0
      },
      {
        "name": "flare_capa_linking",
        "time": 0.0
      },
      {
        "name": "flare_capa_loadcode",
        "time": 0.0
      },
      {
        "name": "flare_capa_malwarefamily",
        "time": 0.0
      },
      {
        "name": "flare_capa_nursery",
        "time": 0.0
      },
      {
        "name": "flare_capa_persistence",
        "time": 0.0
      },
      {
        "name": "flare_capa_runtime",
        "time": 0.0
      },
      {
        "name": "flare_capa_targeting",
        "time": 0.0
      },
      {
        "name": "threatfox",
        "time": 0.0
      },
      {
        "name": "log4shell",
        "time": 0.0
      },
      {
        "name": "mimics_extension",
        "time": 0.0
      },
      {
        "name": "network_country_distribution",
        "time": 0.0
      },
      {
        "name": "network_cnc_http",
        "time": 0.0
      },
      {
        "name": "network_ip_exe",
        "time": 0.0
      },
      {
        "name": "network_dga",
        "time": 0.0
      },
      {
        "name": "network_dga_fraunhofer",
        "time": 0.0
      },
      {
        "name": "network_dyndns",
        "time": 0.003
      },
      {
        "name": "network_excessive_udp",
        "time": 0.0
      },
      {
        "name": "network_http",
        "time": 0.0
      },
      {
        "name": "network_icmp",
        "time": 0.0
      },
      {
        "name": "network_irc",
        "time": 0.0
      },
      {
        "name": "network_open_proxy",
        "time": 0.0
      },
      {
        "name": "network_questionable_http_path",
        "time": 0.0
      },
      {
        "name": "network_questionable_https_path",
        "time": 0.0
      },
      {
        "name": "network_smtp",
        "time": 0.0
      },
      {
        "name": "network_torgateway",
        "time": 0.001
      },
      {
        "name": "origin_langid",
        "time": 0.0
      },
      {
        "name": "origin_resource_langid",
        "time": 0.0
      },
      {
        "name": "overlay",
        "time": 0.0
      },
      {
        "name": "pe_deep_entrypoint",
        "time": 0.0
      },
      {
        "name": "packer_unknown_pe_section_name",
        "time": 0.0
      },
      {
        "name": "packer_aspack",
        "time": 0.0
      },
      {
        "name": "packer_aspirecrypt",
        "time": 0.0
      },
      {
        "name": "packer_bedsprotector",
        "time": 0.0
      },
      {
        "name": "packer_confuser",
        "time": 0.0
      },
      {
        "name": "packer_enigma",
        "time": 0.0
      },
      {
        "name": "packer_entropy",
        "time": 0.0
      },
      {
        "name": "packer_mpress",
        "time": 0.0
      },
      {
        "name": "packer_nate",
        "time": 0.0
      },
      {
        "name": "packer_nspack",
        "time": 0.0
      },
      {
        "name": "packer_smartassembly",
        "time": 0.0
      },
      {
        "name": "packer_spices",
        "time": 0.0
      },
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "packer_titan",
        "time": 0.0
      },
      {
        "name": "packer_upx",
        "time": 0.0
      },
      {
        "name": "packer_vmprotect",
        "time": 0.0
      },
      {
        "name": "packer_yoda",
        "time": 0.0
      },
      {
        "name": "pdf_annot_urls_checker",
        "time": 0.0
      },
      {
        "name": "pe_cert_invalid_signature",
        "time": 0.0
      },
      {
        "name": "pe_cert_self_signed",
        "time": 0.0
      },
      {
        "name": "pe_cert_suspicious_issuer",
        "time": 0.0
      },
      {
        "name": "polymorphic",
        "time": 0.0
      },
      {
        "name": "punch_plus_plus_pcres",
        "time": 0.0
      },
      {
        "name": "procmem_yara",
        "time": 0.0
      },
      {
        "name": "recon_checkip",
        "time": 0.0
      },
      {
        "name": "sigma_events",
        "time": 0.0
      },
      {
        "name": "static_authenticode",
        "time": 0.0
      },
      {
        "name": "invalid_authenticode_signature",
        "time": 0.0
      },
      {
        "name": "static_dotnet_anomaly",
        "time": 0.0
      },
      {
        "name": "static_java",
        "time": 0.0
      },
      {
        "name": "static_pdf",
        "time": 0.0
      },
      {
        "name": "contains_pe_overlay",
        "time": 0.0
      },
      {
        "name": "static_pe_anomaly",
        "time": 0.0
      },
      {
        "name": "pe_compile_timestomping",
        "time": 0.0
      },
      {
        "name": "static_pe_pdbpath",
        "time": 0.0
      },
      {
        "name": "static_rat_config",
        "time": 0.0
      },
      {
        "name": "static_versioninfo_anomaly",
        "time": 0.0
      },
      {
        "name": "browser_credential_theft_headless",
        "time": 0.0
      },
      {
        "name": "suricata_alert",
        "time": 0.0
      },
      {
        "name": "suspicious_html_body",
        "time": 0.0
      },
      {
        "name": "suspicious_html_name",
        "time": 0.0
      },
      {
        "name": "suspicious_html_title",
        "time": 0.0
      },
      {
        "name": "volatility_devicetree_1",
        "time": 0.0
      },
      {
        "name": "volatility_handles_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_2",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_1",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_2",
        "time": 0.0
      },
      {
        "name": "volatility_modscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_2",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_3",
        "time": 0.0
      },
      {
        "name": "whois_create",
        "time": 0.0
      },
      {
        "name": "accesses_mailslot",
        "time": 0.0
      },
      {
        "name": "accesses_netlogon_regkey",
        "time": 0.0
      },
      {
        "name": "accesses_public_folder",
        "time": 0.0
      },
      {
        "name": "accesses_sysvol",
        "time": 0.0
      },
      {
        "name": "writes_sysvol",
        "time": 0.0
      },
      {
        "name": "adds_admin_user",
        "time": 0.0
      },
      {
        "name": "adds_user",
        "time": 0.0
      },
      {
        "name": "overwrites_admin_password",
        "time": 0.0
      },
      {
        "name": "antianalysis_detectfile",
        "time": 0.002
      },
      {
        "name": "antianalysis_detectreg",
        "time": 0.023
      },
      {
        "name": "modify_attachment_manager",
        "time": 0.0
      },
      {
        "name": "antiav_detectfile",
        "time": 0.004
      },
      {
        "name": "antiav_detectreg",
        "time": 0.108
      },
      {
        "name": "antiav_srp",
        "time": 0.0
      },
      {
        "name": "antiav_whitespace",
        "time": 0.0
      },
      {
        "name": "antidebug_devices",
        "time": 0.001
      },
      {
        "name": "antiemu_windefend",
        "time": 0.0
      },
      {
        "name": "antiemu_wine_reg",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoo_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_fortinet_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_joe_anubis_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_mutex",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_threattrack_files",
        "time": 0.0
      },
      {
        "name": "antivm_bochs_keys",
        "time": 0.002
      },
      {
        "name": "antivm_generic_bios",
        "time": 0.001
      },
      {
        "name": "antivm_generic_diskreg",
        "time": 0.004
      },
      {
        "name": "antivm_hyperv_keys",
        "time": 0.002
      },
      {
        "name": "antivm_parallels_keys",
        "time": 0.007
      },
      {
        "name": "antivm_recentdocs",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_files",
        "time": 0.001
      },
      {
        "name": "antivm_vbox_keys",
        "time": 0.012
      },
      {
        "name": "antivm_vmware_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_files",
        "time": 0.001
      },
      {
        "name": "antivm_vmware_keys",
        "time": 0.008
      },
      {
        "name": "antivm_vmware_mutexes",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_files",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_keys",
        "time": 0.004
      },
      {
        "name": "antivm_vpc_mutex",
        "time": 0.0
      },
      {
        "name": "antivm_xen_keys",
        "time": 0.006
      },
      {
        "name": "ketrican_regkeys",
        "time": 0.001
      },
      {
        "name": "bitcoin_opencl",
        "time": 0.0
      },
      {
        "name": "enumerates_physical_drives",
        "time": 0.0
      },
      {
        "name": "bot_russkill",
        "time": 0.0
      },
      {
        "name": "browser_addon",
        "time": 0.0
      },
      {
        "name": "chromium_browser_extension_directory",
        "time": 0.0
      },
      {
        "name": "browser_helper_object",
        "time": 0.0
      },
      {
        "name": "browser_security",
        "time": 0.001
      },
      {
        "name": "browser_startpage",
        "time": 0.0
      },
      {
        "name": "executes_headless_browser",
        "time": 0.0
      },
      {
        "name": "suspicious_browser_arguments",
        "time": 0.001
      },
      {
        "name": "ie_disables_process_tab",
        "time": 0.0
      },
      {
        "name": "odbcconf_bypass",
        "time": 0.0
      },
      {
        "name": "squiblydoo_bypass",
        "time": 0.0
      },
      {
        "name": "squiblytwo_bypass",
        "time": 0.0
      },
      {
        "name": "bypass_chromium_protection",
        "time": 0.0
      },
      {
        "name": "bypass_firewall",
        "time": 0.002
      },
      {
        "name": "checks_uac_status",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstpcom",
        "time": 0.0
      },
      {
        "name": "uac_bypass_delegateexecute_sdclt",
        "time": 0.0
      },
      {
        "name": "uac_bypass_fodhelper",
        "time": 0.0
      },
      {
        "name": "cape_extracted_content",
        "time": 0.0
      },
      {
        "name": "clears_logs",
        "time": 0.0
      },
      {
        "name": "cmdline_obfuscation",
        "time": 0.0
      },
      {
        "name": "cmdline_switches",
        "time": 0.0
      },
      {
        "name": "cmdline_terminate",
        "time": 0.0
      },
      {
        "name": "cmdline_forfiles_wildcard",
        "time": 0.0
      },
      {
        "name": "cmdline_http_link",
        "time": 0.0
      },
      {
        "name": "cmdline_long_string",
        "time": 0.0
      },
      {
        "name": "cmdline_reversed_http_link",
        "time": 0.0
      },
      {
        "name": "long_commandline",
        "time": 0.0
      },
      {
        "name": "powershell_renamed_commandline",
        "time": 0.0
      },
      {
        "name": "copies_self",
        "time": 0.0
      },
      {
        "name": "credwiz_credentialaccess",
        "time": 0.0
      },
      {
        "name": "enables_wdigest",
        "time": 0.0
      },
      {
        "name": "vaultcmd_credentialaccess",
        "time": 0.0
      },
      {
        "name": "file_credential_store_access",
        "time": 0.0
      },
      {
        "name": "file_credential_store_write",
        "time": 0.0
      },
      {
        "name": "kerberos_credential_access_via_rubeus",
        "time": 0.0
      },
      {
        "name": "registry_credential_dumping",
        "time": 0.0
      },
      {
        "name": "registry_credential_store_access",
        "time": 0.001
      },
      {
        "name": "registry_lsa_secrets_access",
        "time": 0.0
      },
      {
        "name": "comsvcs_credentialdump",
        "time": 0.0
      },
      {
        "name": "cryptomining_stratum_command",
        "time": 0.0
      },
      {
        "name": "deepfreeze_mutex",
        "time": 0.0
      },
      {
        "name": "deletes_executed_files",
        "time": 0.0
      },
      {
        "name": "disables_app_launch",
        "time": 0.0
      },
      {
        "name": "disables_auto_app_termination",
        "time": 0.0
      },
      {
        "name": "disables_appv_virtualization",
        "time": 0.0
      },
      {
        "name": "disables_backups",
        "time": 0.001
      },
      {
        "name": "disables_browser_warn",
        "time": 0.001
      },
      {
        "name": "disables_context_menus",
        "time": 0.0
      },
      {
        "name": "disables_cpl_disable",
        "time": 0.0
      },
      {
        "name": "disables_crashdumps",
        "time": 0.0
      },
      {
        "name": "disables_event_logging",
        "time": 0.0
      },
      {
        "name": "disables_folder_options",
        "time": 0.0
      },
      {
        "name": "disables_notificationcenter",
        "time": 0.0
      },
      {
        "name": "disables_power_options",
        "time": 0.001
      },
      {
        "name": "disables_restore_default_state",
        "time": 0.0
      },
      {
        "name": "disables_run_command",
        "time": 0.0
      },
      {
        "name": "disables_smartscreen",
        "time": 0.0
      },
      {
        "name": "disables_startmenu_search",
        "time": 0.0
      },
      {
        "name": "disables_system_restore",
        "time": 0.0
      },
      {
        "name": "disables_uac",
        "time": 0.0
      },
      {
        "name": "disables_wer",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender_logging",
        "time": 0.0
      },
      {
        "name": "removes_windows_defender_contextmenu",
        "time": 0.0
      },
      {
        "name": "removes_windows_defender_updates",
        "time": 0.0
      },
      {
        "name": "windows_defender_powershell",
        "time": 0.0
      },
      {
        "name": "disables_windows_file_protection",
        "time": 0.0
      },
      {
        "name": "disables_windowsupdate",
        "time": 0.0
      },
      {
        "name": "disables_winfirewall",
        "time": 0.0
      },
      {
        "name": "folder_enumeration",
        "time": 0.0
      },
      {
        "name": "discover_registry_mount_points",
        "time": 0.0
      },
      {
        "name": "adfind_domain_enumeration",
        "time": 0.0
      },
      {
        "name": "domain_enumeration_commands",
        "time": 0.0
      },
      {
        "name": "driver_filtermanager",
        "time": 0.0
      },
      {
        "name": "dropper",
        "time": 0.0
      },
      {
        "name": "dll_archive_execution",
        "time": 0.0
      },
      {
        "name": "lnk_archive_execution",
        "time": 0.0
      },
      {
        "name": "script_archive_execution",
        "time": 0.0
      },
      {
        "name": "excel4_macro_urls",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_ntlm_relay",
        "time": 0.0
      },
      {
        "name": "spooler_access",
        "time": 0.0
      },
      {
        "name": "spooler_svc_start",
        "time": 0.0
      },
      {
        "name": "mapped_drives_uac",
        "time": 0.0
      },
      {
        "name": "hides_recycle_bin_icon",
        "time": 0.0
      },
      {
        "name": "infostealer_bitcoin",
        "time": 0.002
      },
      {
        "name": "infostealer_ftp",
        "time": 0.037
      },
      {
        "name": "infostealer_im",
        "time": 0.021
      },
      {
        "name": "infostealer_mail",
        "time": 0.007
      },
      {
        "name": "Evade_Execution_Via_ASPNet_Compiler",
        "time": 0.0
      },
      {
        "name": "Evade_Execute_Via_DeviceCredentialDeployment",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Filter_Manager_Control",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_appvlp",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_OpenSSH",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_PesterPSModule",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_ScriptRunner",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_ttdinject",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_VisualStudioLiveShare",
        "time": 0.0
      },
      {
        "name": "Execute_Msiexec_Via_Explorer",
        "time": 0.0
      },
      {
        "name": "execute_remote_msi",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_runscripthelper",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_sqlps",
        "time": 0.0
      },
      {
        "name": "Indirect_Command_Execution_Via_ConsoleWindowHost",
        "time": 0.0
      },
      {
        "name": "Perform_Malicious_Activities_Via_Headless_Browser",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_CertOC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_MSIEXEC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_Odbcconf",
        "time": 0.0
      },
      {
        "name": "Scriptlet_Proxy_Execution_Via_Pubprn",
        "time": 0.0
      },
      {
        "name": "ie_martian_children",
        "time": 0.0
      },
      {
        "name": "office_martian_children",
        "time": 0.0
      },
      {
        "name": "mimics_icon",
        "time": 0.0
      },
      {
        "name": "masquerade_process_name",
        "time": 0.002
      },
      {
        "name": "mimikatz_modules",
        "time": 0.0
      },
      {
        "name": "ms_office_cmd_rce",
        "time": 0.0
      },
      {
        "name": "mount_copy_to_webdav_share",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_legit_utilities",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_qemu",
        "time": 0.0
      },
      {
        "name": "suspicious_execution_via_dotnet_remoting",
        "time": 0.0
      },
      {
        "name": "modify_certs",
        "time": 0.0
      },
      {
        "name": "dotnet_clr_usagelog_regkeys",
        "time": 0.0
      },
      {
        "name": "modify_hostfile",
        "time": 0.0
      },
      {
        "name": "modify_oem_information",
        "time": 0.0
      },
      {
        "name": "modify_security_center_warnings",
        "time": 0.0
      },
      {
        "name": "modify_uac_prompt",
        "time": 0.0
      },
      {
        "name": "network_dns_blockchain",
        "time": 0.0
      },
      {
        "name": "network_dns_opennic",
        "time": 0.001
      },
      {
        "name": "network_dns_paste_site",
        "time": 0.001
      },
      {
        "name": "network_dns_reverse_proxy",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_file_storage",
        "time": 0.001
      },
      {
        "name": "network_dns_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_dns_url_shortener",
        "time": 0.006
      },
      {
        "name": "network_dns_doh_tls",
        "time": 0.0
      },
      {
        "name": "suspicious_tld",
        "time": 0.004
      },
      {
        "name": "network_tor_service",
        "time": 0.0
      },
      {
        "name": "office_code_page",
        "time": 0.0
      },
      {
        "name": "office_addinloading",
        "time": 0.0
      },
      {
        "name": "office_perfkey",
        "time": 0.0
      },
      {
        "name": "office_macro",
        "time": 0.0
      },
      {
        "name": "changes_trust_center_settings",
        "time": 0.0
      },
      {
        "name": "disables_vba_trust_access",
        "time": 0.0
      },
      {
        "name": "office_macro_autoexecution",
        "time": 0.0
      },
      {
        "name": "office_macro_ioc",
        "time": 0.0
      },
      {
        "name": "office_macro_malicious_prediction",
        "time": 0.0
      },
      {
        "name": "office_macro_suspicious",
        "time": 0.0
      },
      {
        "name": "rtf_aslr_bypass",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_characterset",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_version",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_content",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_office_file",
        "time": 0.0
      },
      {
        "name": "rtf_exploit_static",
        "time": 0.0
      },
      {
        "name": "office_security",
        "time": 0.0
      },
      {
        "name": "accesses_office_username",
        "time": 0.0
      },
      {
        "name": "office_anomalous_feature",
        "time": 0.0
      },
      {
        "name": "office_dde_command",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_mutex",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_regkey",
        "time": 0.0
      },
      {
        "name": "persistence_ads",
        "time": 0.0
      },
      {
        "name": "persistence_safeboot",
        "time": 0.0
      },
      {
        "name": "persistence_ifeo",
        "time": 0.0
      },
      {
        "name": "persistence_silent_process_exit",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_registry",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_shadowing",
        "time": 0.0
      },
      {
        "name": "persistence_service",
        "time": 0.0
      },
      {
        "name": "persistence_shim_database",
        "time": 0.0
      },
      {
        "name": "powershell_scriptblock_logging",
        "time": 0.0
      },
      {
        "name": "powershell_command_suspicious",
        "time": 0.0
      },
      {
        "name": "powershell_history_save_mod",
        "time": 0.0
      },
      {
        "name": "powershell_renamed",
        "time": 0.0
      },
      {
        "name": "powershell_reversed",
        "time": 0.0
      },
      {
        "name": "powershell_variable_obfuscation",
        "time": 0.0
      },
      {
        "name": "prevents_safeboot",
        "time": 0.0
      },
      {
        "name": "cmdline_process_discovery",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_generic",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_known",
        "time": 0.004
      },
      {
        "name": "ransomware_files",
        "time": 0.006
      },
      {
        "name": "ransomware_recyclebin",
        "time": 0.0
      },
      {
        "name": "ransomware_revil_regkey",
        "time": 0.0
      },
      {
        "name": "reads_password_database",
        "time": 0.0
      },
      {
        "name": "recon_fingerprint",
        "time": 0.001
      },
      {
        "name": "rdptcp_key",
        "time": 0.0
      },
      {
        "name": "uses_rdp_clip",
        "time": 0.0
      },
      {
        "name": "uses_remote_desktop_session",
        "time": 0.0
      },
      {
        "name": "removes_networking_icon",
        "time": 0.0
      },
      {
        "name": "removes_pinned_programs",
        "time": 0.0
      },
      {
        "name": "removes_security_maintenance_icon",
        "time": 0.0
      },
      {
        "name": "removes_startmenu_defaults",
        "time": 0.0
      },
      {
        "name": "removes_username_startmenu",
        "time": 0.0
      },
      {
        "name": "sniffer_winpcap",
        "time": 0.0
      },
      {
        "name": "spreading_autoruninf",
        "time": 0.0
      },
      {
        "name": "stealth_hidden_extension",
        "time": 0.0
      },
      {
        "name": "stealth_hiddenreg",
        "time": 0.0
      },
      {
        "name": "stealth_hide_notifications",
        "time": 0.0
      },
      {
        "name": "stealth_webhistory",
        "time": 0.0
      },
      {
        "name": "sysinternals_psexec",
        "time": 0.0
      },
      {
        "name": "sysinternals_tools",
        "time": 0.0
      },
      {
        "name": "language_check_registry",
        "time": 0.0
      },
      {
        "name": "tampers_etw",
        "time": 0.0
      },
      {
        "name": "lsa_tampering",
        "time": 0.0
      },
      {
        "name": "tampers_powershell_logging",
        "time": 0.0
      },
      {
        "name": "territorial_disputes_sigs",
        "time": 0.037
      },
      {
        "name": "uses_adfind",
        "time": 0.0
      },
      {
        "name": "uses_ms_protocol",
        "time": 0.0
      },
      {
        "name": "owa_web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_processes",
        "time": 0.0
      },
      {
        "name": "dotnet_csc_build",
        "time": 0.0
      },
      {
        "name": "mavinject_lolbin",
        "time": 0.0
      },
      {
        "name": "multiple_explorer_instances",
        "time": 0.0
      },
      {
        "name": "script_tool_executed",
        "time": 0.0
      },
      {
        "name": "suspicious_certutil_use",
        "time": 0.0
      },
      {
        "name": "suspicious_command_tools",
        "time": 0.004
      },
      {
        "name": "suspicious_mpcmdrun_use",
        "time": 0.0
      },
      {
        "name": "suspicious_ping_use",
        "time": 0.0
      },
      {
        "name": "uses_powershell_copyitem",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities",
        "time": 0.004
      },
      {
        "name": "uses_windows_utilities_appcmd",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_csvde_ldifde",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_cipher",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_clickonce",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_curl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_dsquery",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_esentutl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_finger",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_mode",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_ntdsutil",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_nltest",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_setx",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_xcopy",
        "time": 0.0
      },
      {
        "name": "wmic_command_suspicious",
        "time": 0.0
      },
      {
        "name": "scrcons_wmi_script_consumer",
        "time": 0.0
      }
    ],
    "reporting": [
      {
        "name": "BinGraph",
        "time": 0.0
      }
    ]
  },
  "target": {
    "category": "file",
    "file": {
      "name": "rufus.ini",
      "path": "/opt/CAPEv2/storage/binaries/eb5be587219b06d6b089f104095b98c119c73495a3e09c584b10d29defb112bd",
      "guest_paths": "",
      "size": 107,
      "crc32": "324E6668",
      "md5": "8a78a90f6c9c3b0da292006dd16b4cd1",
      "sha1": "82c2a11d4ccba12662a05e3f60741338eba051a3",
      "sha256": "eb5be587219b06d6b089f104095b98c119c73495a3e09c584b10d29defb112bd",
      "sha512": "8ebdf9bf61c75d704c2265d1db93da155128bb0b51518215d670112f178e6e61564fcd6b8f2d0be3c171048fdaf9a54df50e8c906f3b414035da6aa6b885cad6",
      "rh_hash": null,
      "ssdeep": "3:5HQAFoSzWx1jXDJiFIvJmyFMu67MKii8p6cv:5BlzWx1jlm8myF967MKEp6e",
      "type": "ASCII text, with CRLF line terminators",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1F4B012183F062CB736F7121C7D4208813DEE8D274B0BA421A6CAAC82010EC07C35A904",
      "sha3_384": "b618a4c8b3a2dc0e9a983ff4171e854ce27f17a95e5409fb73874cb28eabcca7304d2feb1cf36e3c61f2253474e0830d",
      "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce",
      "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e",
      "data": "Locale = en-US\r\nCommCheck64 = 7277031\r\nUpdateCheckInterval = -1\r\nWindowsUserExperienceOptions = 385810517\r\n",
      "strings": [],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": ""
    }
  },
  "procdump": [
    {
      "name": "f4dd0d951a26f0fe9d8ea0afcbfb650ce05b3e9e3d31cfdc394da2f1fe8dc80d",
      "path": "/opt/CAPEv2/storage/analyses/103/procdump/f4dd0d951a26f0fe9d8ea0afcbfb650ce05b3e9e3d31cfdc394da2f1fe8dc80d",
      "guest_paths": "1;?C:\\Windows\\System32\\cmd.exe;?C:\\Windows\\System32\\cmd.exe;?",
      "size": 401920,
      "crc32": "525BDD25",
      "md5": "b2caef2a04202887067615f3b898d9f0",
      "sha1": "cd6ca5c7ca87109dda4684b04acc7622ba210524",
      "sha256": "f4dd0d951a26f0fe9d8ea0afcbfb650ce05b3e9e3d31cfdc394da2f1fe8dc80d",
      "sha512": "9b6e23fb503ed1d2a5ec62581db3a1938b9c2d8b3c4ccb24eafc80c5c18937c9212e5761d5aafd21624a5c99de61a98ec2bf6c8fb89706867405c256307614e6",
      "rh_hash": null,
      "ssdeep": "6144:d4WA1B7BxDfQWKORSqY4zOcmpdlc3MJdmt7l4m:U1BvkWvSqY4zvmjO8JIA",
      "type": "PE32+ executable (console) x86-64, for MS Windows",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T155843A1D239818A5E523817DD903C276C6B27D346321A6EF22D0CD7B7F63AE97638B05",
      "sha3_384": "e467d68ef37a6387f3e38684cd372a776b66e88dffff83655409e248915d2a59d4cc23c28b89dcf32d8c8059fdbaf4ce",
      "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce",
      "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e",
      "pe": {
        "guest_signers": {
          "aux_sha1": null,
          "aux_timestamp": null,
          "aux_valid": false,
          "aux_error": true,
          "aux_error_desc": "File not found: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\103\\rufus.ini",
          "aux_signers": []
        },
        "digital_signers": [],
        "imagebase": "0x7ff79a450000",
        "entrypoint": "0x00018f50",
        "ep_bytes": "4883ec28e82b0600004883c428e91efe",
        "peid_signatures": null,
        "reported_checksum": "0x0004d4af",
        "actual_checksum": "0x00070a42",
        "osversion": "10.0",
        "machine_type": "IMAGE_FILE_MACHINE_AMD64",
        "pdbpath": "cmd.pdb",
        "imports": {
          "msvcrt": {
            "dll": "msvcrt.dll",
            "imports": [
              {
                "address": "0x7ff79a483af8",
                "name": "_setmode"
              },
              {
                "address": "0x7ff79a483b00",
                "name": "exit"
              },
              {
                "address": "0x7ff79a483b08",
                "name": "iswxdigit"
              },
              {
                "address": "0x7ff79a483b10",
                "name": "time"
              },
              {
                "address": "0x7ff79a483b18",
                "name": "srand"
              },
              {
                "address": "0x7ff79a483b20",
                "name": "_wtol"
              },
              {
                "address": "0x7ff79a483b28",
                "name": "fflush"
              },
              {
                "address": "0x7ff79a483b30",
                "name": "wcsstr"
              },
              {
                "address": "0x7ff79a483b38",
                "name": "iswalpha"
              },
              {
                "address": "0x7ff79a483b40",
                "name": "wcstoul"
              },
              {
                "address": "0x7ff79a483b48",
                "name": "_errno"
              },
              {
                "address": "0x7ff79a483b50",
                "name": "printf"
              },
              {
                "address": "0x7ff79a483b58",
                "name": "rand"
              },
              {
                "address": "0x7ff79a483b60",
                "name": "fprintf"
              },
              {
                "address": "0x7ff79a483b68",
                "name": "wcsncmp"
              },
              {
                "address": "0x7ff79a483b70",
                "name": "_pipe"
              },
              {
                "address": "0x7ff79a483b78",
                "name": "_commode"
              },
              {
                "address": "0x7ff79a483b80",
                "name": "_lock"
              },
              {
                "address": "0x7ff79a483b88",
                "name": "wcsrchr"
              },
              {
                "address": "0x7ff79a483b90",
                "name": "realloc"
              },
              {
                "address": "0x7ff79a483b98",
                "name": "towlower"
              },
              {
                "address": "0x7ff79a483ba0",
                "name": "_initterm"
              },
              {
                "address": "0x7ff79a483ba8",
                "name": "__setusermatherr"
              },
              {
                "address": "0x7ff79a483bb0",
                "name": "setlocale"
              },
              {
                "address": "0x7ff79a483bb8",
                "name": "_wcsupr"
              },
              {
                "address": "0x7ff79a483bc0",
                "name": "iswdigit"
              },
              {
                "address": "0x7ff79a483bc8",
                "name": "_ultoa"
              },
              {
                "address": "0x7ff79a483bd0",
                "name": "_cexit"
              },
              {
                "address": "0x7ff79a483bd8",
                "name": "_unlock"
              },
              {
                "address": "0x7ff79a483be0",
                "name": "_exit"
              },
              {
                "address": "0x7ff79a483be8",
                "name": "__dllonexit"
              },
              {
                "address": "0x7ff79a483bf0",
                "name": "_wcsicmp"
              },
              {
                "address": "0x7ff79a483bf8",
                "name": "iswspace"
              },
              {
                "address": "0x7ff79a483c00",
                "name": "wcschr"
              },
              {
                "address": "0x7ff79a483c08",
                "name": "fgets"
              },
              {
                "address": "0x7ff79a483c10",
                "name": "??_V@YAXPEAX@Z"
              },
              {
                "address": "0x7ff79a483c18",
                "name": "_pclose"
              },
              {
                "address": "0x7ff79a483c20",
                "name": "ferror"
              },
              {
                "address": "0x7ff79a483c28",
                "name": "_onexit"
              },
              {
                "address": "0x7ff79a483c30",
                "name": "__CxxFrameHandler3"
              },
              {
                "address": "0x7ff79a483c38",
                "name": "_open_osfhandle"
              },
              {
                "address": "0x7ff79a483c40",
                "name": "_close"
              },
              {
                "address": "0x7ff79a483c48",
                "name": "feof"
              },
              {
                "address": "0x7ff79a483c50",
                "name": "_dup"
              },
              {
                "address": "0x7ff79a483c58",
                "name": "_wpopen"
              },
              {
                "address": "0x7ff79a483c60",
                "name": "_wcsnicmp"
              },
              {
                "address": "0x7ff79a483c68",
                "name": "?terminate@@YAXXZ"
              },
              {
                "address": "0x7ff79a483c70",
                "name": "memset"
              },
              {
                "address": "0x7ff79a483c78",
                "name": "wcstol"
              },
              {
                "address": "0x7ff79a483c80",
                "name": "_get_osfhandle"
              },
              {
                "address": "0x7ff79a483c88",
                "name": "_dup2"
              },
              {
                "address": "0x7ff79a483c90",
                "name": "_getch"
              },
              {
                "address": "0x7ff79a483c98",
                "name": "towupper"
              },
              {
                "address": "0x7ff79a483ca0",
                "name": "memcmp"
              },
              {
                "address": "0x7ff79a483ca8",
                "name": "_setjmp"
              },
              {
                "address": "0x7ff79a483cb0",
                "name": "wcsspn"
              },
              {
                "address": "0x7ff79a483cb8",
                "name": "_fmode"
              },
              {
                "address": "0x7ff79a483cc0",
                "name": "qsort"
              },
              {
                "address": "0x7ff79a483cc8",
                "name": "__set_app_type"
              },
              {
                "address": "0x7ff79a483cd0",
                "name": "_tell"
              },
              {
                "address": "0x7ff79a483cd8",
                "name": "_wcslwr"
              },
              {
                "address": "0x7ff79a483ce0",
                "name": "longjmp"
              },
              {
                "address": "0x7ff79a483ce8",
                "name": "_local_unwind"
              },
              {
                "address": "0x7ff79a483cf0",
                "name": "_purecall"
              },
              {
                "address": "0x7ff79a483cf8",
                "name": "__C_specific_handler"
              },
              {
                "address": "0x7ff79a483d00",
                "name": "??3@YAXPEAX@Z"
              },
              {
                "address": "0x7ff79a483d08",
                "name": "memcpy_s"
              },
              {
                "address": "0x7ff79a483d10",
                "name": "free"
              },
              {
                "address": "0x7ff79a483d18",
                "name": "calloc"
              },
              {
                "address": "0x7ff79a483d20",
                "name": "__getmainargs"
              },
              {
                "address": "0x7ff79a483d28",
                "name": "_XcptFilter"
              },
              {
                "address": "0x7ff79a483d30",
                "name": "_amsg_exit"
              },
              {
                "address": "0x7ff79a483d38",
                "name": "??1type_info@@UEAA@XZ"
              },
              {
                "address": "0x7ff79a483d40",
                "name": "memmove"
              },
              {
                "address": "0x7ff79a483d48",
                "name": "memcpy"
              },
              {
                "address": "0x7ff79a483d50",
                "name": "_CxxThrowException"
              },
              {
                "address": "0x7ff79a483d58",
                "name": "_vsnwprintf"
              },
              {
                "address": "0x7ff79a483d60",
                "name": "swscanf"
              },
              {
                "address": "0x7ff79a483d68",
                "name": "__iob_func"
              },
              {
                "address": "0x7ff79a483d70",
                "name": "malloc"
              },
              {
                "address": "0x7ff79a483d78",
                "name": "_callnewh"
              },
              {
                "address": "0x7ff79a483d80",
                "name": "??0exception@@QEAA@AEBQEBD@Z"
              },
              {
                "address": "0x7ff79a483d88",
                "name": "??0exception@@QEAA@AEBQEBDH@Z"
              },
              {
                "address": "0x7ff79a483d90",
                "name": "??0exception@@QEAA@AEBV0@@Z"
              },
              {
                "address": "0x7ff79a483d98",
                "name": "??1exception@@UEAA@XZ"
              },
              {
                "address": "0x7ff79a483da0",
                "name": "?what@exception@@UEBAPEBDXZ"
              },
              {
                "address": "0x7ff79a483da8",
                "name": "wcscmp"
              }
            ]
          },
          "ntdll": {
            "dll": "ntdll.dll",
            "imports": [
              {
                "address": "0x7ff79a483db8",
                "name": "RtlLookupFunctionEntry"
              },
              {
                "address": "0x7ff79a483dc0",
                "name": "RtlCaptureContext"
              },
              {
                "address": "0x7ff79a483dc8",
                "name": "NtOpenProcessToken"
              },
              {
                "address": "0x7ff79a483dd0",
                "name": "NtQueryInformationToken"
              },
              {
                "address": "0x7ff79a483dd8",
                "name": "NtClose"
              },
              {
                "address": "0x7ff79a483de0",
                "name": "NtOpenThreadToken"
              },
              {
                "address": "0x7ff79a483de8",
                "name": "RtlFreeHeap"
              },
              {
                "address": "0x7ff79a483df0",
                "name": "NtFsControlFile"
              },
              {
                "address": "0x7ff79a483df8",
                "name": "RtlDosPathNameToNtPathName_U"
              },
              {
                "address": "0x7ff79a483e00",
                "name": "RtlVirtualUnwind"
              },
              {
                "address": "0x7ff79a483e08",
                "name": "RtlFreeUnicodeString"
              },
              {
                "address": "0x7ff79a483e10",
                "name": "RtlReleaseRelativeName"
              },
              {
                "address": "0x7ff79a483e18",
                "name": "NtOpenFile"
              },
              {
                "address": "0x7ff79a483e20",
                "name": "RtlDosPathNameToRelativeNtPathName_U_WithStatus"
              },
              {
                "address": "0x7ff79a483e28",
                "name": "NtSetInformationFile"
              },
              {
                "address": "0x7ff79a483e30",
                "name": "NtQueryVolumeInformationFile"
              },
              {
                "address": "0x7ff79a483e38",
                "name": "NtSetInformationProcess"
              },
              {
                "address": "0x7ff79a483e40",
                "name": "NtQueryInformationProcess"
              },
              {
                "address": "0x7ff79a483e48",
                "name": "RtlNtStatusToDosError"
              },
              {
                "address": "0x7ff79a483e50",
                "name": "NtCancelSynchronousIoFile"
              },
              {
                "address": "0x7ff79a483e58",
                "name": "RtlCreateUnicodeStringFromAsciiz"
              },
              {
                "address": "0x7ff79a483e60",
                "name": "RtlFindLeastSignificantBit"
              }
            ]
          },
          "api-ms-win-core-kernel32-legacy-l1-1-0": {
            "dll": "api-ms-win-core-kernel32-legacy-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483788",
                "name": "CopyFileW"
              },
              {
                "address": "0x7ff79a483790",
                "name": "GetConsoleWindow"
              }
            ]
          },
          "api-ms-win-core-libraryloader-l1-2-0": {
            "dll": "api-ms-win-core-libraryloader-l1-2-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4837a0",
                "name": "GetModuleHandleW"
              },
              {
                "address": "0x7ff79a4837a8",
                "name": "GetModuleFileNameA"
              },
              {
                "address": "0x7ff79a4837b0",
                "name": "LoadLibraryExW"
              },
              {
                "address": "0x7ff79a4837b8",
                "name": "GetProcAddress"
              },
              {
                "address": "0x7ff79a4837c0",
                "name": "GetModuleFileNameW"
              },
              {
                "address": "0x7ff79a4837c8",
                "name": "GetModuleHandleExW"
              }
            ]
          },
          "api-ms-win-core-synch-l1-1-0": {
            "dll": "api-ms-win-core-synch-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4839c8",
                "name": "CreateSemaphoreExW"
              },
              {
                "address": "0x7ff79a4839d0",
                "name": "InitializeCriticalSection"
              },
              {
                "address": "0x7ff79a4839d8",
                "name": "WaitForSingleObject"
              },
              {
                "address": "0x7ff79a4839e0",
                "name": "ReleaseSemaphore"
              },
              {
                "address": "0x7ff79a4839e8",
                "name": "TryAcquireSRWLockExclusive"
              },
              {
                "address": "0x7ff79a4839f0",
                "name": "WaitForSingleObjectEx"
              },
              {
                "address": "0x7ff79a4839f8",
                "name": "ReleaseMutex"
              },
              {
                "address": "0x7ff79a483a00",
                "name": "ReleaseSRWLockShared"
              },
              {
                "address": "0x7ff79a483a08",
                "name": "AcquireSRWLockShared"
              },
              {
                "address": "0x7ff79a483a10",
                "name": "LeaveCriticalSection"
              },
              {
                "address": "0x7ff79a483a18",
                "name": "CreateMutexExW"
              },
              {
                "address": "0x7ff79a483a20",
                "name": "EnterCriticalSection"
              },
              {
                "address": "0x7ff79a483a28",
                "name": "ReleaseSRWLockExclusive"
              },
              {
                "address": "0x7ff79a483a30",
                "name": "OpenSemaphoreW"
              }
            ]
          },
          "api-ms-win-core-heap-l1-1-0": {
            "dll": "api-ms-win-core-heap-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483720",
                "name": "HeapFree"
              },
              {
                "address": "0x7ff79a483728",
                "name": "HeapAlloc"
              },
              {
                "address": "0x7ff79a483730",
                "name": "GetProcessHeap"
              },
              {
                "address": "0x7ff79a483738",
                "name": "HeapSetInformation"
              },
              {
                "address": "0x7ff79a483740",
                "name": "HeapReAlloc"
              },
              {
                "address": "0x7ff79a483748",
                "name": "HeapSize"
              }
            ]
          },
          "api-ms-win-core-errorhandling-l1-1-0": {
            "dll": "api-ms-win-core-errorhandling-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4835c8",
                "name": "SetLastError"
              },
              {
                "address": "0x7ff79a4835d0",
                "name": "UnhandledExceptionFilter"
              },
              {
                "address": "0x7ff79a4835d8",
                "name": "GetLastError"
              },
              {
                "address": "0x7ff79a4835e0",
                "name": "SetErrorMode"
              },
              {
                "address": "0x7ff79a4835e8",
                "name": "SetUnhandledExceptionFilter"
              }
            ]
          },
          "api-ms-win-core-processthreads-l1-1-0": {
            "dll": "api-ms-win-core-processthreads-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4838b0",
                "name": "InitializeProcThreadAttributeList"
              },
              {
                "address": "0x7ff79a4838b8",
                "name": "GetCurrentThreadId"
              },
              {
                "address": "0x7ff79a4838c0",
                "name": "UpdateProcThreadAttribute"
              },
              {
                "address": "0x7ff79a4838c8",
                "name": "DeleteProcThreadAttributeList"
              },
              {
                "address": "0x7ff79a4838d0",
                "name": "GetStartupInfoW"
              },
              {
                "address": "0x7ff79a4838d8",
                "name": "CreateProcessAsUserW"
              },
              {
                "address": "0x7ff79a4838e0",
                "name": "OpenThread"
              },
              {
                "address": "0x7ff79a4838e8",
                "name": "CreateProcessW"
              },
              {
                "address": "0x7ff79a4838f0",
                "name": "ResumeThread"
              },
              {
                "address": "0x7ff79a4838f8",
                "name": "TerminateProcess"
              },
              {
                "address": "0x7ff79a483900",
                "name": "GetExitCodeProcess"
              },
              {
                "address": "0x7ff79a483908",
                "name": "GetCurrentProcess"
              },
              {
                "address": "0x7ff79a483910",
                "name": "GetCurrentProcessId"
              }
            ]
          },
          "api-ms-win-core-localization-l1-2-0": {
            "dll": "api-ms-win-core-localization-l1-2-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4837d8",
                "name": "GetThreadLocale"
              },
              {
                "address": "0x7ff79a4837e0",
                "name": "SetThreadLocale"
              },
              {
                "address": "0x7ff79a4837e8",
                "name": "FormatMessageW"
              },
              {
                "address": "0x7ff79a4837f0",
                "name": "GetLocaleInfoW"
              },
              {
                "address": "0x7ff79a4837f8",
                "name": "GetCPInfo"
              },
              {
                "address": "0x7ff79a483800",
                "name": "GetACP"
              },
              {
                "address": "0x7ff79a483808",
                "name": "GetUserDefaultLCID"
              }
            ]
          },
          "api-ms-win-core-debug-l1-1-0": {
            "dll": "api-ms-win-core-debug-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483588",
                "name": "OutputDebugStringW"
              },
              {
                "address": "0x7ff79a483590",
                "name": "DebugBreak"
              },
              {
                "address": "0x7ff79a483598",
                "name": "IsDebuggerPresent"
              }
            ]
          },
          "api-ms-win-core-handle-l1-1-0": {
            "dll": "api-ms-win-core-handle-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483708",
                "name": "DuplicateHandle"
              },
              {
                "address": "0x7ff79a483710",
                "name": "CloseHandle"
              }
            ]
          },
          "api-ms-win-core-memory-l1-1-0": {
            "dll": "api-ms-win-core-memory-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483818",
                "name": "VirtualAlloc"
              },
              {
                "address": "0x7ff79a483820",
                "name": "VirtualQuery"
              },
              {
                "address": "0x7ff79a483828",
                "name": "VirtualFree"
              },
              {
                "address": "0x7ff79a483830",
                "name": "ReadProcessMemory"
              }
            ]
          },
          "api-ms-win-core-console-l1-1-0": {
            "dll": "api-ms-win-core-console-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4834e0",
                "name": "ReadConsoleW"
              },
              {
                "address": "0x7ff79a4834e8",
                "name": "SetConsoleCtrlHandler"
              },
              {
                "address": "0x7ff79a4834f0",
                "name": "SetConsoleMode"
              },
              {
                "address": "0x7ff79a4834f8",
                "name": "WriteConsoleW"
              },
              {
                "address": "0x7ff79a483500",
                "name": "GetConsoleMode"
              },
              {
                "address": "0x7ff79a483508",
                "name": "GetConsoleOutputCP"
              }
            ]
          },
          "api-ms-win-core-file-l1-1-0": {
            "dll": "api-ms-win-core-file-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4835f8",
                "name": "CreateFileW"
              },
              {
                "address": "0x7ff79a483600",
                "name": "FlushFileBuffers"
              },
              {
                "address": "0x7ff79a483608",
                "name": "GetFileAttributesExW"
              },
              {
                "address": "0x7ff79a483610",
                "name": "GetDriveTypeW"
              },
              {
                "address": "0x7ff79a483618",
                "name": "FindClose"
              },
              {
                "address": "0x7ff79a483620",
                "name": "FindNextFileW"
              },
              {
                "address": "0x7ff79a483628",
                "name": "CreateDirectoryW"
              },
              {
                "address": "0x7ff79a483630",
                "name": "GetVolumeInformationW"
              },
              {
                "address": "0x7ff79a483638",
                "name": "SetFileAttributesW"
              },
              {
                "address": "0x7ff79a483640",
                "name": "SetEndOfFile"
              },
              {
                "address": "0x7ff79a483648",
                "name": "SetFilePointerEx"
              },
              {
                "address": "0x7ff79a483650",
                "name": "WriteFile"
              },
              {
                "address": "0x7ff79a483658",
                "name": "DeleteFileW"
              },
              {
                "address": "0x7ff79a483660",
                "name": "SetFileTime"
              },
              {
                "address": "0x7ff79a483668",
                "name": "GetVolumePathNameW"
              },
              {
                "address": "0x7ff79a483670",
                "name": "SetFilePointer"
              },
              {
                "address": "0x7ff79a483678",
                "name": "ReadFile"
              },
              {
                "address": "0x7ff79a483680",
                "name": "GetFileAttributesW"
              },
              {
                "address": "0x7ff79a483688",
                "name": "GetFileType"
              },
              {
                "address": "0x7ff79a483690",
                "name": "RemoveDirectoryW"
              },
              {
                "address": "0x7ff79a483698",
                "name": "FindFirstFileExW"
              },
              {
                "address": "0x7ff79a4836a0",
                "name": "CompareFileTime"
              },
              {
                "address": "0x7ff79a4836a8",
                "name": "GetFullPathNameW"
              },
              {
                "address": "0x7ff79a4836b0",
                "name": "GetDiskFreeSpaceExW"
              },
              {
                "address": "0x7ff79a4836b8",
                "name": "FileTimeToLocalFileTime"
              },
              {
                "address": "0x7ff79a4836c0",
                "name": "GetFileSize"
              },
              {
                "address": "0x7ff79a4836c8",
                "name": "FindFirstFileW"
              }
            ]
          },
          "api-ms-win-core-string-l1-1-0": {
            "dll": "api-ms-win-core-string-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483998",
                "name": "WideCharToMultiByte"
              },
              {
                "address": "0x7ff79a4839a0",
                "name": "MultiByteToWideChar"
              }
            ]
          },
          "api-ms-win-core-processenvironment-l1-1-0": {
            "dll": "api-ms-win-core-processenvironment-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483840",
                "name": "GetCommandLineW"
              },
              {
                "address": "0x7ff79a483848",
                "name": "GetEnvironmentStringsW"
              },
              {
                "address": "0x7ff79a483850",
                "name": "ExpandEnvironmentStringsW"
              },
              {
                "address": "0x7ff79a483858",
                "name": "FreeEnvironmentStringsW"
              },
              {
                "address": "0x7ff79a483860",
                "name": "SetEnvironmentVariableW"
              },
              {
                "address": "0x7ff79a483868",
                "name": "SearchPathW"
              },
              {
                "address": "0x7ff79a483870",
                "name": "SetCurrentDirectoryW"
              },
              {
                "address": "0x7ff79a483878",
                "name": "GetCurrentDirectoryW"
              },
              {
                "address": "0x7ff79a483880",
                "name": "GetEnvironmentVariableW"
              },
              {
                "address": "0x7ff79a483888",
                "name": "SetEnvironmentStringsW"
              },
              {
                "address": "0x7ff79a483890",
                "name": "GetStdHandle"
              }
            ]
          },
          "api-ms-win-core-console-l2-1-0": {
            "dll": "api-ms-win-core-console-l2-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483518",
                "name": "SetConsoleCursorPosition"
              },
              {
                "address": "0x7ff79a483520",
                "name": "GetConsoleScreenBufferInfo"
              },
              {
                "address": "0x7ff79a483528",
                "name": "ScrollConsoleScreenBufferW"
              },
              {
                "address": "0x7ff79a483530",
                "name": "FillConsoleOutputAttribute"
              },
              {
                "address": "0x7ff79a483538",
                "name": "FillConsoleOutputCharacterW"
              },
              {
                "address": "0x7ff79a483540",
                "name": "FlushConsoleInputBuffer"
              },
              {
                "address": "0x7ff79a483548",
                "name": "SetConsoleTextAttribute"
              }
            ]
          },
          "api-ms-win-security-base-l1-1-0": {
            "dll": "api-ms-win-security-base-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483ad8",
                "name": "GetFileSecurityW"
              },
              {
                "address": "0x7ff79a483ae0",
                "name": "RevertToSelf"
              },
              {
                "address": "0x7ff79a483ae8",
                "name": "GetSecurityDescriptorOwner"
              }
            ]
          },
          "api-ms-win-core-sysinfo-l1-1-0": {
            "dll": "api-ms-win-core-sysinfo-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483a50",
                "name": "GetSystemTime"
              },
              {
                "address": "0x7ff79a483a58",
                "name": "SetLocalTime"
              },
              {
                "address": "0x7ff79a483a60",
                "name": "GetSystemTimeAsFileTime"
              },
              {
                "address": "0x7ff79a483a68",
                "name": "GetTickCount"
              },
              {
                "address": "0x7ff79a483a70",
                "name": "GetWindowsDirectoryW"
              },
              {
                "address": "0x7ff79a483a78",
                "name": "GetLocalTime"
              },
              {
                "address": "0x7ff79a483a80",
                "name": "GetVersion"
              }
            ]
          },
          "api-ms-win-core-timezone-l1-1-0": {
            "dll": "api-ms-win-core-timezone-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483aa8",
                "name": "SystemTimeToFileTime"
              },
              {
                "address": "0x7ff79a483ab0",
                "name": "FileTimeToSystemTime"
              }
            ]
          },
          "api-ms-win-core-datetime-l1-1-0": {
            "dll": "api-ms-win-core-datetime-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483570",
                "name": "GetDateFormatW"
              },
              {
                "address": "0x7ff79a483578",
                "name": "GetTimeFormatW"
              }
            ]
          },
          "api-ms-win-core-systemtopology-l1-1-0": {
            "dll": "api-ms-win-core-systemtopology-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483a90",
                "name": "GetNumaNodeProcessorMaskEx"
              },
              {
                "address": "0x7ff79a483a98",
                "name": "GetNumaHighestNodeNumber"
              }
            ]
          },
          "api-ms-win-core-console-l2-2-0": {
            "dll": "api-ms-win-core-console-l2-2-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483558",
                "name": "SetConsoleTitleW"
              },
              {
                "address": "0x7ff79a483560",
                "name": "GetConsoleTitleW"
              }
            ]
          },
          "api-ms-win-core-processenvironment-l1-2-0": {
            "dll": "api-ms-win-core-processenvironment-l1-2-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4838a0",
                "name": "NeedCurrentDirectoryForExePathW"
              }
            ]
          },
          "api-ms-win-core-registry-l1-1-0": {
            "dll": "api-ms-win-core-registry-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483950",
                "name": "RegCloseKey"
              },
              {
                "address": "0x7ff79a483958",
                "name": "RegSetValueExW"
              },
              {
                "address": "0x7ff79a483960",
                "name": "RegOpenKeyExW"
              },
              {
                "address": "0x7ff79a483968",
                "name": "RegCreateKeyExW"
              },
              {
                "address": "0x7ff79a483970",
                "name": "RegEnumKeyExW"
              },
              {
                "address": "0x7ff79a483978",
                "name": "RegDeleteKeyExW"
              },
              {
                "address": "0x7ff79a483980",
                "name": "RegDeleteValueW"
              },
              {
                "address": "0x7ff79a483988",
                "name": "RegQueryValueExW"
              }
            ]
          },
          "api-ms-win-core-file-l2-1-0": {
            "dll": "api-ms-win-core-file-l2-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4836d8",
                "name": "MoveFileExW"
              },
              {
                "address": "0x7ff79a4836e0",
                "name": "CreateSymbolicLinkW"
              },
              {
                "address": "0x7ff79a4836e8",
                "name": "CreateHardLinkW"
              },
              {
                "address": "0x7ff79a4836f0",
                "name": "MoveFileWithProgressW"
              },
              {
                "address": "0x7ff79a4836f8",
                "name": "GetFileInformationByHandleEx"
              }
            ]
          },
          "api-ms-win-core-heap-l2-1-0": {
            "dll": "api-ms-win-core-heap-l2-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483758",
                "name": "GlobalAlloc"
              },
              {
                "address": "0x7ff79a483760",
                "name": "GlobalFree"
              },
              {
                "address": "0x7ff79a483768",
                "name": "LocalFree"
              }
            ]
          },
          "api-ms-win-core-io-l1-1-0": {
            "dll": "api-ms-win-core-io-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483778",
                "name": "DeviceIoControl"
              }
            ]
          },
          "api-ms-win-core-winrt-l1-1-0": {
            "dll": "api-ms-win-core-winrt-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483ac0",
                "name": "RoInitialize"
              },
              {
                "address": "0x7ff79a483ac8",
                "name": "RoUninitialize"
              }
            ]
          },
          "api-ms-win-core-processtopology-l1-1-0": {
            "dll": "api-ms-win-core-processtopology-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483920",
                "name": "GetThreadGroupAffinity"
              }
            ]
          },
          "api-ms-win-core-synch-l1-2-0": {
            "dll": "api-ms-win-core-synch-l1-2-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483a40",
                "name": "Sleep"
              }
            ]
          },
          "api-ms-win-core-profile-l1-1-0": {
            "dll": "api-ms-win-core-profile-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483940",
                "name": "QueryPerformanceCounter"
              }
            ]
          },
          "api-ms-win-core-string-obsolete-l1-1-0": {
            "dll": "api-ms-win-core-string-obsolete-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4839b0",
                "name": "lstrcmpW"
              },
              {
                "address": "0x7ff79a4839b8",
                "name": "lstrcmpiW"
              }
            ]
          },
          "api-ms-win-core-processtopology-obsolete-l1-1-0": {
            "dll": "api-ms-win-core-processtopology-obsolete-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a483930",
                "name": "SetProcessAffinityMask"
              }
            ]
          },
          "api-ms-win-core-apiquery-l1-1-0": {
            "dll": "api-ms-win-core-apiquery-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4834d0",
                "name": "ApiSetQueryApiSetPresence"
              }
            ]
          },
          "api-ms-win-core-delayload-l1-1-1": {
            "dll": "api-ms-win-core-delayload-l1-1-1.dll",
            "imports": [
              {
                "address": "0x7ff79a4835b8",
                "name": "ResolveDelayLoadedAPI"
              }
            ]
          },
          "api-ms-win-core-delayload-l1-1-0": {
            "dll": "api-ms-win-core-delayload-l1-1-0.dll",
            "imports": [
              {
                "address": "0x7ff79a4835a8",
                "name": "DelayLoadFailureHook"
              }
            ]
          }
        },
        "exported_dll_name": null,
        "exports": [],
        "dirents": [
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
            "virtual_address": "0x0003a028",
            "size": "0x000002f8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
            "virtual_address": "0x0005d000",
            "size": "0x000084f8"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
            "virtual_address": "0x00059000",
            "size": "0x00002334"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
            "virtual_address": "0x00066000",
            "size": "0x0000030c"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
            "virtual_address": "0x00035a60",
            "size": "0x00000054"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_TLS",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
            "virtual_address": "0x00032c10",
            "size": "0x00000118"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_IAT",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
            "virtual_address": "0x00039d20",
            "size": "0x00000080"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          },
          {
            "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
            "virtual_address": "0x00000000",
            "size": "0x00000000"
          }
        ],
        "sections": [
          {
            "name": ".text",
            "raw_address": "0x00000400",
            "virtual_address": "0x00001000",
            "virtual_size": "0x00031000",
            "size_of_data": "0x00031000",
            "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x60000020",
            "entropy": "6.31"
          },
          {
            "name": ".rdata",
            "raw_address": "0x00031400",
            "virtual_address": "0x00032000",
            "virtual_size": "0x0000b000",
            "size_of_data": "0x0000a600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "5.18"
          },
          {
            "name": ".data",
            "raw_address": "0x0003ba00",
            "virtual_address": "0x0003d000",
            "virtual_size": "0x0001c000",
            "size_of_data": "0x0001b800",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "0.13"
          },
          {
            "name": ".pdata",
            "raw_address": "0x00057200",
            "virtual_address": "0x00059000",
            "virtual_size": "0x00003000",
            "size_of_data": "0x00002400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "5.49"
          },
          {
            "name": ".didat",
            "raw_address": "0x00059600",
            "virtual_address": "0x0005c000",
            "virtual_size": "0x00001000",
            "size_of_data": "0x00000200",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
            "characteristics_raw": "0xc0000040",
            "entropy": "1.32"
          },
          {
            "name": ".rsrc",
            "raw_address": "0x00059800",
            "virtual_address": "0x0005d000",
            "virtual_size": "0x00009000",
            "size_of_data": "0x00008600",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x40000040",
            "entropy": "4.36"
          },
          {
            "name": ".reloc",
            "raw_address": "0x00061e00",
            "virtual_address": "0x00066000",
            "virtual_size": "0x00001000",
            "size_of_data": "0x00000400",
            "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
            "characteristics_raw": "0x42000040",
            "entropy": "4.68"
          }
        ],
        "overlay": null,
        "resources": [
          {
            "name": "MUI",
            "offset": "0x00065420",
            "size": "0x000000d8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.68"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0005d778",
            "size": "0x00000668",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.65"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0005dde0",
            "size": "0x000002e8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.44"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0005e0c8",
            "size": "0x00000128",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.17"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0005e1f0",
            "size": "0x00000ea8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.06"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0005f098",
            "size": "0x000008a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.07"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0005f940",
            "size": "0x00000568",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "0.71"
          },
          {
            "name": "RT_ICON",
            "offset": "0x0005fea8",
            "size": "0x0000169e",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "7.85"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00061548",
            "size": "0x000025a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.88"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00063af0",
            "size": "0x000010a8",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.97"
          },
          {
            "name": "RT_ICON",
            "offset": "0x00064b98",
            "size": "0x00000468",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.17"
          },
          {
            "name": "RT_GROUP_ICON",
            "offset": "0x00065000",
            "size": "0x00000092",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "2.90"
          },
          {
            "name": "RT_VERSION",
            "offset": "0x00065098",
            "size": "0x00000388",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "3.50"
          },
          {
            "name": "RT_MANIFEST",
            "offset": "0x0005d350",
            "size": "0x00000428",
            "filetype": null,
            "language": "LANG_ENGLISH",
            "sublanguage": "SUBLANG_ENGLISH_US",
            "entropy": "5.00"
          }
        ],
        "versioninfo": [
          {
            "name": "CompanyName",
            "value": "Microsoft Corporation"
          },
          {
            "name": "FileDescription",
            "value": "Windows Command Processor"
          },
          {
            "name": "FileVersion",
            "value": "10.0.19041.746 (WinBuild.160101.0800)"
          },
          {
            "name": "InternalName",
            "value": "cmd"
          },
          {
            "name": "LegalCopyright",
            "value": "© Microsoft Corporation. All rights reserved."
          },
          {
            "name": "OriginalFilename",
            "value": "Cmd.Exe"
          },
          {
            "name": "ProductName",
            "value": "Microsoft® Windows® Operating System"
          },
          {
            "name": "ProductVersion",
            "value": "10.0.19041.746"
          },
          {
            "name": "Translation",
            "value": "0x0409 0x04b0"
          }
        ],
        "imphash": "272245e2988e1e430500b852c4fb5e18",
        "timestamp": "2090-01-16 09:26:43",
        "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAACp0lEQVR4nO2ZPW/TQByHH8cpUyWQ2NjKd+AjNK1U1ZGQkBjZYWNhQAIEUmFgKuwsSEhISElV0TeoVFUsnSLUgS6J2nRJA0mTpknss8OQ2thN3Z7Tl5ORH+lyf/sud7+fz3e+OJCQkBBrNIDnL2ceaZo2q1qMDJ1O+/HMqxfvAAvopQE0TZu9e+++MlHvP+QAePgge+bxl8+f3gIfgRpgpq9a7Em4QmWPgetAC78BPZWiUS2f2Vkv+BG5/Hidftav2/PlbvJz89ZtN0wDKTfon0nrzLx+868TXwMnxbLJcZyB2M2FENi2jRACy7K83DRN2u02nU4Hy7I8TT9/lQYuRir0MsUEz8Dx4YoLp45APp8nn8+Hli8sLFy4oKiEGsjlchiGgWEYzM3Neefn5+cD9RYXFy9PnQRSc2B6etqLp6amvHhychKApaWlC5Ylz7kn8cTEBADLy8vnFjMMUgZOu4UAMpkMACsrKxckSx7vOXB8Ecpms94EDruF/IyPjwdGYXV1NbTT0dFRAG/Nd9F1HV3XA88LaQPVWmOg0DCMMxsAME2TWq3G2NgYzWaTRqOBpmlS3/Vj2za2bYeWV37vD5wbei/UbDapVCrs7e1Rr9eHbebcRDIghGBnZ4dSqcTh4eFlaYqElIGDgwOKxSK7u7sIIS5bUyRONSCEYGtri2KxKDWhVOBbhYLLULlcZnNzk263e+WiojAwAo7jUCgU2N7eVqEnMgEDpmmysbFBtVpVpScyngHH6bG2tkar1VKpJzLeVkLYduzEw//0iyyuJAZUkxhQTWJANYkB1cTeQGA3+u1HQZWOoUkD7NfrmfXvX9W9XovAs6dP7gBdQMDRf2TACHDjKI2oEBaBLvAHaAC2a0CjPxrXAF2RMFkEfRPhL5ASEhLiw1+s5V9Z8HnusgAAAABJRU5ErkJggg==",
        "icon_hash": "00d152c1523e56c619d25f6c96c21a41",
        "icon_fuzzy": "e55641fba39eaff4ee89e5fc0af8f337",
        "icon_dhash": "a2ae7a370101a3c0",
        "imported_dll_count": 37
      },
      "data": null,
      "strings": [
        "l$PLcv$I",
        "fD9$Cu",
        "t$0L+",
        "fG94lu",
        "lext-ms-win-cmd-util-l1-1-0",
        "fD9,0",
        "DISABLEEXTENSIONS",
        "NtQueryInformationProcess",
        "@8=D!",
        "D9t$<",
        "_ultoa",
        "A_A^A]A\\_",
        "GetFullPathNameW",
        "COLOR",
        "interrupted",
        " %x %c",
        "HcD$x",
        "t$0uKE3",
        " &()[]{}^=;!%'+,`~",
        "\\$dD9L$T",
        ".bss$00",
        "fD9l$ ",
        "L$8f99u`+",
        "f9|$Vt\"",
        "message size",
        "no_buffer_space",
        "api-ms-win-core-synch-l1-1-0.dll",
        "memcpy",
        "api-ms-win-core-file-l1-1-0.dll",
        "usebackq",
        "l$HE3",
        "GetModuleFileNameA",
        "WATAUAVAWH",
        "GetCurrentProcessId",
        ".CRT$XCU",
        "t$ WH",
        "api-ms-win-core-synch-l1-2-0.dll",
        "t$HD9=",
        "connection_refused",
        "CMD Internal Error %s",
        "t4f93t/H",
        "\"t5fA",
        "MKLINK",
        "permission_denied",
        "fD9$xu",
        "ASSOC",
        "CloseHandle",
        "Redir: ",
        "LegalCopyright",
        "GetCommandLineW",
        "ext-ms-win-branding-winbrand-l1-1-1",
        "Hct$ ",
        "\\XCOPY.EXE",
        ".CRT$XIZ",
        "            <requestedExecutionLevel",
        "fD9+t",
        "Sleep",
        ".text$yd",
        "MessageBeepStub",
        "|$ 9=",
        "HeapFree",
        "invalid string position",
        ".xdata$x",
        "FlushConsoleInputBuffer",
        "fD9,Vu",
        "D9|$0",
        "GetCurrentThreadId",
        "AcquireSRWLockShared",
        "fD9 tuH",
        "fB9<{u",
        "CMDEXTVERSION",
        "%hs(%u)\\%hs!%p: ",
        "L$4uFA",
        "HH:mm:ss t",
        "NtFsControlFile",
        "no such device or address",
        "u4D95N",
        "8*uUH",
        "SetUnhandledExceptionFilter",
        "L$0H3",
        "ScrollConsoleScreenBufferW",
        "L$XH3",
        "E$uwM",
        "A^A\\]",
        "_wcsnicmp",
        "L$@E3",
        "SUWATAUAVAWH",
        "fF9$pu",
        "D9t$DtND",
        "destination_address_required",
        "api-ms-win-core-timezone-l1-1-0.dll",
        "WaitForSingleObject",
        "fD94Bu",
        "rmdir ",
        "fD94Cu",
        "D95lB",
        "eY_wK",
        "f9<Au",
        "A_A^A\\_^",
        ">/~sA",
        "D9t$0",
        "HeapSetInformation",
        "f94Ju",
        "ext-ms-win-shell-shell32-l1-2-3",
        "GetWindowsDirectoryW",
        "BrandingFormatString",
        "fD9$Hu",
        "f9,Xu",
        "GetFileInformationByHandleEx",
        "iH4-N",
        "A_A^A]A\\_^][",
        "SetLocalTime",
        "f9,Cu",
        "fD9tG",
        "*t|fA;",
        "api-ms-win-core-heap-l1-1-0.dll",
        "ATAVAWH",
        "@SVWH",
        "Null environment",
        "    <windowsSettings xmlns:ws2=\"http://schemas.microsoft.com/SMI/2016/WindowsSettings\">",
        "??1exception@@UEAA@XZ",
        ".didat$3",
        "D8L$\\",
        "L$ SWH",
        "ResumeThread",
        "u+fD9o",
        "f94Zu",
        "VirtualAlloc",
        "t\"D9%",
        "BELOWNORMAL",
        "read only file system",
        "api-ms-win-security-base-l1-1-0.dll",
        ">3t#A",
        "fF9<fu",
        "no_protocol_option",
        "not_connected",
        "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>",
        "                uiAccess=\"false\"",
        "no link",
        "fD9 tK",
        "d$0E3",
        ".text$mn",
        "|$z:t0A",
        "#D$D;",
        ".xdata",
        "Se%ae`",
        "iswxdigit",
        "D$0H;",
        "ABOVENORMAL",
        "|$@PE",
        "api-ms-win-core-console-l2-2-0.dll",
        "iswspace",
        "MKDIR",
        "L$PE3",
        "tlfD9>tfI",
        "f;D$`",
        "protocol_not_supported",
        "t!fD9l$ ",
        "??_V@YAXPEAX@Z",
        "connection reset",
        "K9\\$<t",
        "tbfA9",
        "operation not supported",
        " H3E H3E",
        "D9t$x",
        "H!|$`I",
        "host unreachable",
        "FormatMessageW",
        "NDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD",
        "f9,Bu",
        "AfD9!u",
        "u0D9d$ ",
        "GetVersion",
        "KERNEL32.DLL",
        "f9|$<tMI;",
        ".data$00",
        "fD94Gu",
        "ferror",
        "p AWH",
        "oL$0f",
        "api-ms-win-core-processtopology-obsolete-l1-1-0.dll",
        "                level=\"asInvoker\"",
        "no lock available",
        " A_A^A\\^]",
        "DebugBreak",
        "@SUVWH",
        "D$ I;",
        "D8L$h",
        "fA9<@u",
        "\\CMD.EXE",
        "A_A^A]A\\_^[",
        "result out of range",
        "RMDIR",
        "CreateProcessW",
        "cCBR_p",
        "A_A^A\\_]",
        "COPYCMD",
        ".text",
        "TryAcquireSRWLockExclusive",
        "f9<Hu",
        "wrong_protocol_type",
        "<GfD9#",
        "D9%PC",
        "XXX8Pvh8v",
        "SetFilePointer",
        "NEWWINDOW",
        "HcA<H",
        "SetErrorMode",
        "l$ VWATAVAWH",
        "api-ms-win-core-registry-l1-1-0.dll",
        "api-ms-win-core-handle-l1-1-0.dll",
        "pushd ",
        "t$HM+",
        "fprintf",
        "NTDLL.DLL",
        "fD9,ou",
        "D9%KA",
        "ReadFile",
        "api-ms-win-core-profile-l1-1-0.dll",
        "fD9$yu",
        ".CRT$XIY",
        "too many files open",
        "SetConsoleCursorPosition",
        "L$8H3",
        "SetCurrentDirectoryW",
        "tRfD9",
        "t~fA;",
        "t\"D8=",
        "|$ AVH",
        "_lock",
        "t$ WAVAWH",
        "x UAVAWH",
        "yy/MM/dd",
        "UWAUAVAWH",
        "l$ E3",
        "T$ H+",
        "L9%@^",
        "fE9$Gu",
        "(%s) %s ",
        "[%hs]",
        "@SVAUH",
        "fD9|]",
        "CMD.EXE",
        "api-ms-win-core-systemtopology-l1-1-0.dll",
        "PUSHD",
        "x ATAVAWH",
        "fD9d$P",
        "pA_A^_^]",
        "f9H\\u",
        "connection_aborted",
        "_wcsicmp",
        "    /D /c\"",
        "s AWH",
        "LoadLibraryExW",
        "SetFilePointerEx",
        "_exit",
        "WGeToken: (%x) '%s'",
        "is a directory",
        "SUVWATAVAWH",
        "connection_already_in_progress",
        "RegDeleteValueW",
        "A_A^A\\_^[]",
        "RtlDosPathNameToRelativeNtPathName_U_WithStatus",
        "fD9$Gu",
        "D9d$x",
        "fD9$pu",
        "EnableExtensions",
        "_errno",
        "H9t$Xt eH",
        "D$<E3",
        " Microsoft Corporation. All rights reserved.",
        "APerformUnaryOperation: '%c'",
        "pqacG%%apppppppaB",
        ".?AVbad_alloc@std@@",
        "start /wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\"",
        "api-ms-win-core-delayload-l1-1-0.dll",
        "_pclose",
        "\\$0E3",
        "SetFileTime",
        "D;S$r",
        "wwwwwwww",
        "VirtualQuery",
        "fD9<qu",
        "CMDCMDLINE",
        "TerminateProcess",
        "DelayLoadFailureHook",
        "file too large",
        "dd/MM/yy",
        "<application  xmlns=\"urn:schemas-microsoft-com:asm.v3\">",
        ".rsrc$02",
        "wwwwwwwwp",
        "AutoRun",
        "t$49\\$Ht&9",
        "GetStdHandle",
        "D$PE3",
        "SHARED",
        "PAUSE",
        "%s %s ",
        "owner dead",
        "se%%%%% R",
        "%02d%s%02d%s%02d",
        "HeapSize",
        "fF9l}",
        "ERASE",
        "D9y$vb",
        "wcstol",
        "NtQueryInformationToken",
        "</assembly>",
        "fD90H",
        "t$ WATAVH",
        "GetSystemTime",
        ".data$zz",
        ".bss$zz",
        "GetLocalTime",
        "GetConsoleTitleW",
        "argument out of domain",
        "UATAVH",
        ">0tdA",
        ";l$0u",
        "??0exception@@QEAA@AEBQEBD@Z",
        "ENDLOCAL",
        "f9<Fu",
        "D$XfD",
        "H!\\$ L",
        "inappropriate io control operation",
        "wcsrchr",
        ".CRT$XIAA",
        "L$095",
        "9\"tFH",
        "filename too long",
        "connection aborted",
        "SUVWATAUAVAWH",
        "SetProcessAffinityMask",
        "WNetAddConnection2WStub",
        "GetTickCount",
        "fD94{u",
        "fA9<wu",
        "GetDiskFreeSpaceExW",
        ".idata$3",
        "<t:-,",
        "D$DE3",
        "connection already in progress",
        "printf",
        "no buffer space",
        "L$ H+",
        "D$HE3",
        "t$HE3",
        "tBD9t$pu;H",
        " [..]",
        "t$0E;",
        "Application",
        "address_not_available",
        "LcA<E3",
        "*** Unknown type: %x",
        "L$pfD",
        "__set_app_type",
        "\\$$E3",
        "m;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\System32\\OpenSSH\\;C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314\\Scripts\\;C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314\\;C:\\Users\\Rajesh\\AppData\\Local\\Microsoft\\WindowsApps",
        "HcT$8H",
        "GetVolumePathNameW",
        "QueryPerformanceCounter",
        "ext-ms-win-cmd-util-l1-1-0.dll",
        "CreateSymbolicLinkW",
        "timed_out",
        "D$8E3",
        "identifier removed",
        "NtSetInformationProcess",
        "%d.%d.%05d.%d",
        "io error",
        "tUD9%",
        " A^A]A\\",
        "executable format error",
        ".didat$6",
        "f94yu",
        "H9L$@r",
        "_callnewh",
        "_commode",
        "Windows Command Processor",
        "fD94yu",
        "no such file or directory",
        "qsort",
        ".CRT$XCAA",
        "CallContext:[%hs] ",
        "api-ms-win-core-string-obsolete-l1-1-0.dll",
        "VarFileInfo",
        "9|$Ht",
        ";|$Xt",
        "WaitForSingleObjectEx",
        "H9D$x",
        ".rdata$brc",
        "wcsstr",
        "??0exception@@QEAA@AEBV0@@Z",
        "MultiByteToWideChar",
        "api-ms-win-core-libraryloader-l1-2-0.dll",
        "fE9,Fu",
        "_tell",
        ".text$np",
        "0A^_^][",
        "ProductVersion",
        "ENABLEEXTENSIONS",
        "\\$ E3",
        "UVATAVAWH",
        "RoInitialize",
        "FTYPE",
        "d$x@8=",
        "L9%<`",
        "fD9,Cu",
        "Gxf9(u,3",
        "CreateSemaphoreExW",
        "</application>",
        "T$0E3",
        "__dllonexit",
        "f9,xu",
        "D8L$iL",
        "device or resource busy",
        "not_a_socket",
        "Msg:[%ws] ",
        "OutputDebugStringW",
        "PATHEXT",
        "L$0H=",
        "0A_A^^",
        "fD9$Ku",
        "DeleteProcThreadAttributeList",
        "GetSecurityDescriptorOwner",
        "stream timeout",
        "network reset",
        ".rdata$00",
        "FillConsoleOutputCharacterW",
        "L$PH3",
        "SetLastError",
        "f94Au",
        "api-ms-win-core-console-l2-1-0.dll",
        "fE94Wu",
        "wcstoul",
        "SHIFT",
        "network_down",
        "9\\$<t",
        "x UATAUAVAWH",
        "FillConsoleOutputAttribute",
        "tsHcL$8L",
        "_setjmp",
        "WriteFile",
        "oT$@f",
        "            />",
        "PU,//",
        "delims=",
        "Local\\SM0:%d:%d:%hs",
        "COMSPEC",
        "M0H9M`t",
        "=,;+/[] ",
        "FlushFileBuffers",
        "T$8A;",
        "system",
        "FindNextFileW",
        "ext-ms-win-branding-winbrand-l1-2-0",
        "%s=%s",
        "cG?CCRRRRP`R",
        "10.0.19041.746",
        "ProductName",
        ".?AVexception@@",
        "D8=-u",
        "tlD8%",
        ".text$mn$00",
        "UAVAWH",
        "USVWATAUAVAWH",
        "VirtualFree",
        "L$HE3",
        "t$`I+",
        "L$@fA",
        ".idata$2",
        "WAVAWH",
        "$DHcD$PM",
        "x AUAVAWH",
        "FailFast",
        "fE9,Wu",
        "not supported",
        "UVWATAUAVAWH",
        "|$`E3",
        "_onexit",
        "A_A^A]",
        "t%fA;",
        "fD9DC",
        ";:u8A",
        "A_A^A]_]",
        "FtFfD9",
        "ext-ms-win-branding-winbrand-l1-1-0.dll",
        "!This program cannot be run in DOS mode.",
        ".00cfg",
        "|$8D9{",
        ".bss$pr00",
        "HcD$ ",
        "network down",
        "t$@E3",
        ";:u.A",
        "@A_A^A]A\\_^[",
        "fA94Ru",
        "SetConsoleInputExeNameW",
        "ext-ms-win-shell-shell32-l1-3-0",
        "L$8E3",
        "FindFirstFileW",
        "DEFINED",
        "malloc",
        "cross device link",
        "fD9t$\"",
        "FindNextStreamWStub",
        "L$pH3",
        "n(D9-c",
        "fF9$Cu",
        ".text$zy",
        "GetCurrentDirectoryW",
        "__iob_func",
        "RtlFindLeastSignificantBit",
        "fD9,Gu",
        "UpdateProcThreadAttribute",
        "L$Xf91t",
        "bad_file_descriptor",
        "DuplicateHandle",
        "D$@H9t$@",
        "0A_A^_",
        "f9,Gu",
        "@A_A^]",
        "    </security>",
        "GetThreadGroupAffinity",
        "DeleteFileW",
        "8A^_^[",
        ")t$@H",
        "f9/t+",
        "api-ms-win-core-localization-l1-2-0.dll",
        "L9{@u",
        "FindClose",
        "not a directory",
        "((((&&(&&&(&(&&&&&&(((#&&###",
        "BREAK",
        "C:\\Users\\Rajesh\\AppData\\Local\\Temp",
        "DelayedExpansion",
        "fD94~u",
        "no stream resources",
        "wcscmp",
        "START",
        "uE9\\$<uE",
        "PathCompletionChar",
        "A_A^A]A\\_^]",
        "NtSetInformationFile",
        "Copyright (c) Microsoft Corporation. All rights reserved.",
        "@USVWATAVAWH",
        "D$89|$P",
        "9|$Pt!H",
        "too many links",
        "L9L$x",
        "FOR/?",
        "NORMAL",
        "UVWAVAWH",
        "T$PE3",
        "`A_A^A\\_^][",
        "kernelbase.dll",
        "fD94Su",
        "InitializeProcThreadAttributeList",
        "fA9<\\u",
        "Cd$@H",
        "GetFileSecurityW",
        "CHcD$pH",
        "D8L$ ",
        "MoveFileWithProgressW",
        "H!|$ L",
        "RtlReleaseRelativeName",
        "DIRCMD",
        "x AVH",
        "DefaultColor",
        "|$pI+",
        "L$(H3",
        ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC",
        " /K %s",
        "GetConsoleMode",
        "ENABLEDELAYEDEXPANSION",
        "t$@H9",
        "GetUserDefaultLCID",
        "VAVAWH",
        "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h",
        "fD9,Ku",
        "fE9LE",
        "|$ ut",
        "api-ms-win-core-file-l2-1-0.dll",
        "!KD4)#",
        "TITLE",
        ".?AVlogic_error@std@@",
        "D$`f9",
        "<assemblyIdentity",
        "t,fD92t&I",
        "UWATAVAWH",
        "f9(u%H",
        "o\\$PH",
        "FileVersion",
        "fD9$nu",
        "bad message",
        "no such device",
        ".text$zz",
        "__setusermatherr",
        "fD9,Ou",
        "api-ms-win-core-debug-l1-1-0.dll",
        "D9|$0u$E3",
        "L$ USWH",
        ".idata$4",
        " [...]",
        "PROMPT",
        "f94{u",
        "UWAWH",
        "RtlLookupFunctionEntry",
        "WriteConsoleW",
        "WNetCancelConnection2WStub",
        "@SUVWAVH",
        "Fxf9(u-3",
        "DisableCMD",
        "APerformArithmeticOperation: '%c'",
        "RENAME",
        "8\\utH",
        ".data",
        "A_A^A]A\\_^[]",
        "address_family_not_supported",
        "    processorArchitecture=\"amd64\"",
        "    </windowsSettings>",
        "eIDATx",
        "_getch",
        ".rsrc",
        "_CxxThrowException",
        "CompletionChar",
        " Operating System",
        "REM /?",
        ".rdata$00$brc",
        "D$Pf9",
        "NtQueryVolumeInformationFile",
        ".data$r$brc",
        "Translation",
        "already_connected",
        "GlobalAlloc",
        "f9<^u",
        "L$ UVWATAUAVAWH",
        "function not supported",
        "VWAVH",
        "lstrcmpW",
        "A_A^A\\",
        "fD94Ou",
        "wrong protocol type",
        ".didat$2",
        "GetLastError",
        "HeapReAlloc",
        "fE9$Ou",
        " A_A^_",
        "fD9$Au",
        "onecore\\base\\cmd\\maxpathawarestring.cpp",
        "L95NW",
        "InternalName",
        "SetConsoleMode",
        "<!-- Copyright (c) Microsoft Corporation -->",
        "_close",
        ".didat$4",
        "useback",
        "\\Shell\\Open\\Command",
        "/w&tV",
        "fF9,gu",
        "srand",
        "f94Cu",
        "L$0H;",
        "GetExitCodeProcess",
        "api-ms-win-core-processenvironment-l1-1-0.dll",
        "L$XH+",
        "fflush",
        "tSL9?",
        "fA9,Pu",
        "^fD9+",
        "GetDriveTypeW",
        "fD9tC",
        "040904B0",
        "no message",
        "already connected",
        "GetSystemTimeAsFileTime",
        "FileTimeToSystemTime",
        ">;u\\D",
        "0A_A^A]A\\_^]",
        "fD9TH,u",
        "SetConsoleTitleW",
        "fD9$hu",
        ".gljmp",
        "[%hs(%hs)]",
        "bad_address",
        "ShellExecuteWorker",
        "|$0E3",
        "    version=\"5.1.0.0\"",
        ".pdata",
        "fE9$vu",
        "fD9,xu",
        "api-ms-win-core-apiquery-l1-1-0.dll",
        "f9tQ,u",
        "WAUAVH",
        "f;0u>H",
        "cmd.pdb",
        "|$ ATAVAWH",
        "f9<Cu",
        "D$l;E",
        "address not available",
        "|$ Hc",
        "en-US",
        "fD9$su",
        "D$PfA",
        "LeaveCriticalSection",
        "realloc",
        "A_A^A]A\\]",
        "u\"f90u&H",
        "D$8H!t$8H",
        "ntdll.dll",
        "ReleaseSRWLockShared",
        "protocol not supported",
        "D9%`9",
        "u HcA<H",
        ".gfids",
        "D$0fD98t",
        "no message available",
        "iostream",
        "D3blc",
        "%s (%s) %s",
        "memset",
        "fD9dG",
        ".rsrc$01",
        "connection_reset",
        "\\$ UVWAVAWH",
        "_cexit",
        "REALTIME",
        "fD98t",
        "D$ I+",
        "fD9|F0u",
        "{ ATAVAWH",
        "fE9$wu",
        "fD9<Xu",
        "<description>Windows Command Processor</description>",
        "fF9Dj0u",
        "LogHr",
        "D8=is",
        "GetFileAttributesExW",
        "ext-ms-win-shell-shell32-l1-2-0",
        "7fD90",
        "VS_VERSION_INFO",
        "A_A^]",
        "|$ E3",
        "Software\\Classes",
        "L$xE3",
        "FindFirstStreamWStub",
        "n<DSbb",
        "GetModuleFileNameW",
        "D$\"fD",
        "RANDOM",
        "UnhandledExceptionFilter",
        "network unreachable",
        "D$pE3",
        "\\$PE3",
        "CHDIR",
        "t$(E3",
        "EXIST",
        "directory not empty",
        "argument list too long",
        "f90t7",
        "(fD97",
        "fE9DE",
        "too many symbolic link levels",
        "@A^_^",
        "DPATH",
        "D$@E3",
        "\\$ UH",
        "??1type_info@@UEAA@XZ",
        "SVWATAUAVAWH",
        ".idata$5",
        "_wcsupr",
        ".CRT$XCA",
        "_vsnwprintf",
        "api-ms-win-core-delayload-l1-1-1.dll",
        "HcT$ L",
        "??3@YAXPEAX@Z",
        ".CRT$XCZ",
        "GetModuleHandleW",
        "\\$ UVWATAUAVAWH",
        "api-ms-win-core-kernel32-legacy-l1-1-0.dll",
        "Software\\Policies\\Microsoft\\Windows\\System",
        ".data$pr00",
        "Ungetting: '%s'",
        "D9-P8",
        "],//cuu",
        "bad allocation",
        "fD9$Zu",
        ".text$lp01cmd.exe!20_pri7",
        "f94Ku",
        "SetEnvironmentVariableW",
        "GetProcessHeap",
        "System",
        "D$8L+",
        "protocol error",
        ".data$brc",
        "_initterm",
        "Microsoft Corporation",
        "D9l$d",
        "@USVWATAUAVAWH",
        "fD9 t&f",
        "H9{Hs>H",
        "t$0E3",
        "t$0fB",
        ".didat$5",
        "GetFileSize",
        "RtlVirtualUnwind",
        "CreateMutexExW",
        "H+|$@H",
        "ReadConsoleW",
        "fD94Hu",
        "IDI_APPICON",
        "tRHcL$xI",
        "KxfD91",
        "operation canceled",
        "fE9,xu",
        "@.didat",
        "QueryFullProcessImageNameWStub",
        ";C$sD",
        "tokens=",
        "ext-ms-win-shell-shell32-l1-2-0.dll",
        "calloc",
        "bad file descriptor",
        "G0HcW",
        "CreateDirectoryW",
        "8/t@H",
        "GetVDMCurrentDirectoriesStub",
        "    name=\"Microsoft.Windows.FileSystem.CMD\"",
        "fB9<iu",
        "fA98u",
        "GetConsoleScreenBufferInfo",
        "D9-4m",
        "SearchPathW",
        "api-ms-win-core-heap-l2-1-0.dll",
        "<noalias>",
        "RegOpenKeyExW",
        ".?AVout_of_range@std@@",
        "fC9\\e",
        "4FHcD$`H",
        "D$ L+",
        "fD9$_u",
        "L$ E3",
        "fD9$Su",
        "RegSetValueExW",
        "D9d$P",
        "__CxxFrameHandler3",
        "fA94Du",
        "ext-ms-win-branding-winbrand-l1-1-2",
        "NtClose",
        "not a stream",
        "()|&=,;\"",
        "REM/?",
        "fD9,^u",
        "CompareFileTime",
        "t$ E3",
        "D$0L;",
        "9T$0u0",
        "fE9$Fu",
        "api-ms-win-core-console-l1-1-0.dll",
        "@WAVH",
        "fE9<nu",
        ";:u&A",
        "L$xHc",
        "SetConsoleCtrlHandler",
        "api-ms-win-core-processenvironment-l1-2-0.dll",
        "state not recoverable",
        "file exists",
        "f9|$Xvx",
        "H9D$`",
        "Software\\Microsoft\\Command Processor",
        "ReleaseSemaphore",
        "network_unreachable",
        "CopyFileExW",
        "api-ms-win-core-winrt-l1-1-0.dll",
        "fA9<Fu",
        "D9t$p",
        "skip=",
        "SEPARATE",
        "f9,su",
        "api-ms-win-core-sysinfo-l1-1-0.dll",
        "fA9<Vu",
        "fD9,8",
        " A_A^_H",
        "%2d%s%02d%s%02d%s%02d",
        "Exception",
        ";8uWH",
        "fD9<Hu",
        "invalid_argument",
        "wwwwwwwwwwwwwwwwwwwww",
        "memcmp",
        "GetTimeFormatW",
        "T$8E3",
        "tGD95",
        "(caller: %p) ",
        "tbD9t$Pu[H",
        "|$ UATAUAVAWH",
        "GetLocaleInfoW",
        "L$(E3",
        "F fD9",
        "NeedCurrentDirectoryForExePathW",
        ".didat$7",
        ".?AVlength_error@std@@",
        "w5tlA",
        "8=unH",
        "resource unavailable try again",
        "RtlCreateUnicodeStringFromAsciiz",
        "D$pf9",
        "CreateProcessAsUserW",
        "@A_A^A]",
        " A_A^A]A\\_",
        "fE9,Gu",
        "cmd.exe",
        "fF9$xu",
        "4qaCCRCCCB",
        "address in use",
        "L$TE3",
        "fD9 u",
        "DeviceIoControl",
        "??0exception@@QEAA@AEBQEBDH@Z",
        "GetCPInfo",
        "CmdBatNotificationStub",
        "FileTimeToLocalFileTime",
        "_amsg_exit",
        "t$pE3",
        "lstrcmpiW",
        "towlower",
        "fgets",
        "t$@D8=",
        "    <windowsSettings>",
        "D$(E3",
        "StringFileInfo",
        "|$XMc",
        "wcschr",
        "A_A^_^]",
        "NtOpenProcessToken",
        "L$0E3",
        "%hs!%p: ",
        "L9{0t#H",
        ".CRT$XIA",
        "w{H9{",
        "_setmode",
        "string too long",
        "D$D9E",
        "mkdir ",
        "fD9#u",
        ".rdata$zz",
        "filename_too_long",
        "l$ VWAVH",
        ".bss$dk00",
        "D8-BP",
        "@A_A^A\\",
        "SVWAVH",
        "GetModuleHandleExW",
        "u3fD;",
        "0123456789",
        "__getmainargs",
        "MM/dd/yy",
        "address family not supported",
        "onecore\\base\\cmd\\StartShellExecServiceProvider.h",
        "t$pL+",
        "value too large",
        "t$(9|$8t1",
        "_get_osfhandle",
        "CreateFileW",
        "InitializeCriticalSection",
        "not connected",
        "GetEnvironmentStringsW",
        "SetThreadLocale",
        "GetACP",
        "unknown error",
        "` AUAVAWH",
        ".giats",
        "f9,Hu",
        "fD9dM",
        "fD9$Fu",
        "\\$ UVWH",
        "(t$@L",
        "SETLOCAL",
        "oD$ f",
        "HIGHESTNUMANODENUMBER",
        "RaiseFailFastException",
        "HcD$pH",
        "9:uGH9-n",
        "api-ms-win-core-processtopology-l1-1-0.dll",
        "RegCloseKey",
        "ApiSetQueryApiSetPresence",
        "timed out",
        "CCCC@40`P@ ",
        "chdir ",
        "L$ fD",
        "fD9/u",
        "_local_unwind",
        "A^_^][",
        "????????.???",
        "fA9<Du",
        "FindFirstFileExW",
        "wwwwwwwwwwwwwww",
        "LocalFree",
        "RegDeleteKeyExW",
        "HcL$ HcD$$H",
        "operation not permitted",
        ".data$dk00$brc",
        "memmove",
        "fD9$Wu",
        "_wcslwr",
        "wcsncmp",
        "operation in progress",
        "_open_osfhandle",
        "api-ms-win-core-io-l1-1-0.dll",
        " A_A^A\\",
        ".rdata$zzzdbg",
        "fD9,Ju",
        "fD94xu",
        "@SUVWATAUAVAWH",
        "RtlFreeHeap",
        "VERIFY",
        "L$`H3",
        "%s %s%s ",
        "ResolveDelayLoadedAPI",
        "D$ fD",
        "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\">",
        "f90u&H",
        "        <ws2:longPathAware>true</ws2:longPathAware>",
        "_pipe",
        "SetEndOfFile",
        "'Px0&D",
        "H+L$xH",
        "UWAVH",
        "fdpnxsatz",
        "HcD$PM",
        "Sh(PO",
        "fD9,Wu",
        "FileDescription",
        "GetThreadLocale",
        "x ATAUAVH",
        "fD94Wu",
        "resource deadlock would occur",
        "D$0E3",
        "permission denied",
        "fD9,Au",
        "fE9d~",
        ".text$di",
        "message_size",
        "t$ WATAUAVAWH",
        "Cmd: %s  Type: %x ",
        "A_A^_",
        "fD9|G0u",
        "GetProcAddress",
        "SetFileAttributesW",
        "no such process",
        "RtlDllShutdownInProgress",
        "DisableUNCCheck",
        "%04X-%04X",
        "GetEnvironmentVariableW",
        "too_many_files_open",
        "fE9<^u",
        "RtlCaptureContext",
        "ShellExecuteExW",
        "GetConsoleWindow",
        "towupper",
        "f9,{u",
        "@A_A^_^]",
        "f9,Su",
        "ReleaseSRWLockExclusive",
        "fF9<Au",
        "iostream stream error",
        "_purecall",
        "GetDateFormatW",
        "A^A]_",
        "AFFINITY",
        "bad address",
        "OriginalFilename",
        "fD99t~D9=<u",
        "fB9<su",
        "10.0.19041.746 (WinBuild.160101.0800)",
        "RegQueryValueExW",
        "GetCurrentProcess",
        "T$0fD",
        "L;d$x",
        "generic",
        "FreeEnvironmentStringsW",
        "|$TfD",
        "GetFileAttributesW",
        "@SAWH",
        "D$`fD98t",
        "FOR /?",
        "fD9<{u",
        "RegEnumKeyExW",
        "too many files open in system",
        "$DHcD$`H",
        "L+D$ H+",
        "fD90t",
        "memcpy_s",
        "ext-ms-win-shell-shell32-l1-2-1",
        "tGHcT$0M",
        "DoSHChangeNotify",
        "fF9$Iu",
        "ext-ms-win-shell-shell32-l1-2-2",
        "RegCreateKeyExW",
        "HcD$`H",
        "%WINDOWS_COPYRIGHT%",
        "fD9#t",
        "D9f$t",
        "Cmd.Exe",
        "t<fA9(t6I",
        "d$Ht*E",
        "        <dpiAware  xmlns=\"http://schemas.microsoft.com/SMI/2005/WindowsSettings\">true</dpiAware>",
        "api-ms-win-core-string-l1-1-0.dll",
        "destination address required",
        "fD94Au",
        "RemoveDirectoryW",
        ".text$lp00cmd.exe!20_pri7",
        "CreateHardLinkW",
        "x UATAVH",
        "u*9Q<|%",
        "_wpopen",
        "HeapAlloc",
        "address_in_use",
        "f9,Ou",
        "%02d%s%02d%s",
        "no child process",
        "fE9dw",
        "SetConsoleTextAttribute",
        "api-ms-win-core-errorhandling-l1-1-0.dll",
        "RevertToSelf",
        "WideCharToMultiByte",
        "OpenThread",
        "1H9wx",
        "IsDebuggerPresent",
        "operation_not_supported",
        "td@8=",
        "NtOpenThreadToken",
        "|$P.uEH",
        "D9L$l",
        "SystemTimeToFileTime",
        "RtlDisownModuleHeapAllocation",
        "\\uc@8=",
        ";;u;H",
        "OpenSemaphoreW",
        "f99ujH",
        "_unlock",
        "@Qm6t",
        "<>+-*/%()|^&=,",
        "connection refused",
        "f9<Qu",
        "ReturnHr",
        "L9N@A",
        ">1tUA",
        "D9%/?",
        "longjmp",
        ".rdata",
        ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
        "=ExitCodeAscii",
        "MoveFileExW",
        "D$(@P",
        "WNetGetConnectionWStub",
        "</trustInfo>",
        "*)))))))))))))))))))))",
        "!wct&",
        "_dup2",
        "NtOpenFile",
        "LookupAccountSidWStub",
        "operation_in_progress",
        "x AWH",
        "operation would block",
        "    <security>",
        "Software\\Microsoft\\Windows NT\\CurrentVersion",
        "CopyFileW",
        "L$ht'A",
        "%hs(%d) tid(%x) %08X %ws",
        "f9<Ku",
        "@A_A^A]A\\_^]",
        "EnterCriticalSection",
        "host_unreachable",
        "fD94wu",
        "D8L$ t",
        "RtlDosPathNameToNtPathName_U",
        "fD9<Gu",
        "Args: `%s' ",
        "invalid seek",
        "_wtol",
        "text file busy",
        "        </requestedPrivileges>",
        "no space on device",
        "GetNumaNodeProcessorMaskEx",
        "9D$0u",
        " A^A\\_",
        "D$@fD9'",
        "T$XD;{",
        "T$8H;",
        "@A_A^A]A\\_][",
        "RtlNtStatusToDosError",
        "GetFileType",
        "fD9<Bu",
        "=ExitCode",
        "illegal byte sequence",
        "|$[fD9?",
        "ExpandEnvironmentStringsW",
        "`A_A^A]A\\_^]",
        "iswalpha",
        "ReadProcessMemory",
        "fD93u6H;",
        "CSVFS",
        "f90t13",
        "wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\"",
        "D9|$Pt",
        "t|D9t$xuuH",
        " Windows",
        "GetVolumeInformationW",
        " A_A^A]A\\_^]",
        "Microsoft",
        "r?fA;",
        "    type=\"win32\"",
        "fD9<Cu",
        "D$ fA;",
        "wcsspn",
        "prRRRPa",
        "fE9$@u",
        "\\$(E3",
        "iswdigit",
        "CompanyName",
        "RRRRP%",
        "|T0 s",
        "?what@exception@@UEBAPEBDXZ",
        "fD9:u",
        "|$4fE99",
        "__C_specific_handler",
        "broken pipe",
        "operation_would_block",
        "f9<Bu",
        "D;d$@D",
        "api-ms-win-core-datetime-l1-1-0.dll",
        "WilError_03",
        "        <requestedPrivileges>",
        "@.reloc",
        "setlocale",
        "G8f9C",
        "ReleaseMutex",
        "C0D9s$",
        "E[fD9",
        "DISABLEDELAYEDEXPANSION",
        "fD9,_u",
        "u#D8g!u",
        "ERRORLEVEL",
        "fD9,Fu",
        ">2tFA",
        "SetEnvironmentStringsW",
        "not enough memory",
        "NtCancelSynchronousIoFile",
        "t$xE3",
        "ext-ms-win-branding-winbrand-l1-1-0",
        "?terminate@@YAXXZ",
        "fE9,Ft",
        "GetNumaHighestNodeNumber",
        "DD$`H",
        "`.rdata",
        "D$ E3",
        "IF /?",
        "D$xE3",
        "invalid argument",
        "_fmode",
        "b$j-0",
        "fD9/t",
        "no protocol option",
        "%6Ru'",
        "fA94Hu",
        "GetStartupInfoW",
        "u%6RRRRRPp",
        "Unknown",
        " \"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"",
        "api-ms-win-core-memory-l1-1-0.dll",
        ".text$x",
        "D9l$ ",
        ".idata$6",
        "msvcrt.dll",
        "|$pA;",
        "fE9&tdA",
        "swscanf",
        "L$XE3",
        "_XcptFilter",
        "3t)E3",
        "RoUninitialize",
        "L$Pf9",
        "D8L$P",
        "api-ms-win-core-processthreads-l1-1-0.dll",
        "<trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">",
        "f98tDA",
        "SetThreadUILanguage",
        "network_reset",
        "RtlFreeUnicodeString",
        "t$ UWATAVAWH",
        ".gehcont",
        " A^_^",
        "not a socket",
        "GlobalFree",
        "SaferWorker",
        "GetConsoleOutputCP",
        "fD9,Su",
        " v;f98",
        "fD9lC",
        "D$xH#E"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 1,
      "cape_type": "",
      "process_path": "C:\\Windows\\System32\\cmd.exe",
      "process_name": "cmd.exe",
      "module_path": "C:\\Windows\\System32\\cmd.exe",
      "pid": 3792
    }
  ],
  "CAPE": {
    "payloads": [],
    "configs": []
  },
  "info": {
    "version": "2.5",
    "started": "2026-06-29 19:35:56",
    "ended": "2026-06-29 19:36:45",
    "duration": 49,
    "id": 103,
    "category": "file",
    "custom": "",
    "machine": {
      "id": 103,
      "status": "stopping",
      "name": "win10",
      "label": "win10",
      "platform": "windows",
      "manager": "KVM",
      "started_on": "2026-06-29 19:35:56",
      "shutdown_on": "2026-06-29 19:36:44"
    },
    "package": "generic",
    "timeout": true,
    "tlp": null,
    "parent_sample": null,
    "options": {
      "vnc_port": "5900"
    },
    "source_url": null,
    "route": "internet",
    "user_id": 0,
    "CAPE_current_commit": "394455c2cd85889fb0782bfcf1f8c5c2f7f77b46"
  },
  "behavior": {
    "processes": [
      {
        "process_id": 3792,
        "process_name": "cmd.exe",
        "parent_id": 2892,
        "module_path": "C:\\Windows\\System32\\cmd.exe",
        "first_seen": "2026-06-30 02:36:13,323",
        "calls": [
          {
            "timestamp": "2026-06-30 02:36:13,573",
            "thread_id": "2248",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-06-30 02:36:13,573",
            "thread_id": "2248",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff79a468f50"
              },
              {
                "name": "Parameter",
                "value": "0xf0988c6000"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-06-30 02:36:13,573",
            "thread_id": "4284",
            "caller": "0x7ff9aaa4ea52",
            "parentcaller": "0x7ff9aaa077c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 3,
            "id": 2
          },
          {
            "timestamp": "2026-06-30 02:36:13,573",
            "thread_id": "4512",
            "caller": "0x7ff9a8441751",
            "parentcaller": "0x7ff9a8441420",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc00700bb",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xf2\\x0f\\x99\\xf0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xf2\\x0f\\x99\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-06-30 02:36:13,573",
            "thread_id": "4512",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-06-30 02:36:13,573",
            "thread_id": "4512",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2f10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "4284",
            "caller": "0x7ff9a8441751",
            "parentcaller": "0x7ff9a8441420",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc00700bb",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xeb\\xff\\x98\\xf0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xeb\\xff\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "4284",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "4284",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c3070"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "1944",
            "caller": "0x7ff9a8441751",
            "parentcaller": "0x7ff9a8441420",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc00700bb",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00`\\xf0\\xef\\x98\\xf0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xf0\\xef\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "1944",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "1944",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2e50"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "2784",
            "caller": "0x7ff9a8441751",
            "parentcaller": "0x7ff9a8441420",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc00700bb",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xf2\\xdf\\x98\\xf0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xf2\\xdf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "2784",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-06-30 02:36:13,589",
            "thread_id": "2784",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2a40"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4693c1",
            "parentcaller": "0x7ff79a468e29",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff79a469370"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a463828",
            "parentcaller": "0x7ff79a468ecd",
            "category": "threading",
            "api": "NtOpenThread",
            "status": false,
            "return": "0xffffffffc0000022",
            "pretty_return": "ACCESS_DENIED",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000009"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001fffff",
                "pretty_value": "THREAD_ALL_ACCESS"
              },
              {
                "name": "ProcessId",
                "value": "0"
              },
              {
                "name": "ThreadId",
                "value": "18446744071976254824"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a46052c",
            "parentcaller": "0x7ff79a463839",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a46055b",
            "parentcaller": "0x7ff79a463839",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "SetThreadUILanguage"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3ec610"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a463839",
            "parentcaller": "0x7ff79a468ecd",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xf9\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\x88\\xf9\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a46387c",
            "parentcaller": "0x7ff79a468ecd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\System"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4638c6",
            "parentcaller": "0x7ff79a468ecd",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00@\\xfc\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00H\\xfc\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a464de7",
            "parentcaller": "0x7ff79a463931",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "T\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x90\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a464e0b",
            "parentcaller": "0x7ff79a463931",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "P\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x90\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4605a5",
            "parentcaller": "0x7ff79a464e15",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "T\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfc\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xfc\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4605cc",
            "parentcaller": "0x7ff79a464e15",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "T\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x9d\\xb1\\x00\\x00`\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x9e\\x93\\x00\\x00h\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4606a0",
            "parentcaller": "0x7ff79a464e15",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "T\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfc\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xfc\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a46060c",
            "parentcaller": "0x7ff79a464e15",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "P\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x9d\\xb1\\x00\\x00`\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x9e\\x93\\x00\\x00h\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a46064e",
            "parentcaller": "0x7ff79a464e15",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "P\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfc\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xfc\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4655e1",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Command Processor"
              },
              {
                "name": "Handle",
                "value": "0x00000218"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a46562a",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              },
              {
                "name": "ValueName",
                "value": "DisableUNCCheck"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DisableUNCCheck"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a46566e",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              },
              {
                "name": "ValueName",
                "value": "EnableExtensions"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\EnableExtensions"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4656c5",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              },
              {
                "name": "ValueName",
                "value": "DelayedExpansion"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DelayedExpansion"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a465709",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              },
              {
                "name": "ValueName",
                "value": "DefaultColor"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DefaultColor"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a465760",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              },
              {
                "name": "ValueName",
                "value": "CompletionChar"
              },
              {
                "name": "Data",
                "value": "9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\CompletionChar"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4657d6",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              },
              {
                "name": "ValueName",
                "value": "PathCompletionChar"
              },
              {
                "name": "Data",
                "value": "9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\PathCompletionChar"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a465869",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              },
              {
                "name": "ValueName",
                "value": "AutoRun"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\AutoRun"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a465882",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4655e1",
            "parentcaller": "0x7ff79a464e35",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Command Processor"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a46589d",
            "parentcaller": "0x7ff79a464e35",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a4658ac",
            "parentcaller": "0x7ff79a464e35",
            "category": "misc",
            "api": "srand",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "seed",
                "value": "0x6a432b9d"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a464e3c",
            "parentcaller": "0x7ff79a463931",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x284594022b0",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\cmd.exe\" /c start /wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\""
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459367000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a464e88",
            "parentcaller": "0x7ff79a463931",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x284594022b0",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\cmd.exe\" /c start /wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\""
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d040000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d040000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d051000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d061000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a463e85",
            "parentcaller": "0x7ff79a4624ca",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a31",
            "parentcaller": "0x7ff79a463ec7",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x28459423460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x3a6eea36"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5acdd"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a4e",
            "parentcaller": "0x7ff79a463ec7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a31",
            "parentcaller": "0x7ff79a463ec7",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x284594237c0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xeedf2ef8"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dd0776"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a4e",
            "parentcaller": "0x7ff79a463ec7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a31",
            "parentcaller": "0x7ff79a463ec7",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x284594236a0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xeee3f58c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dd0776"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a4e",
            "parentcaller": "0x7ff79a463ec7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a31",
            "parentcaller": "0x7ff79a463ec7",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x28459423460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xeee655e5"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dd0776"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a4e",
            "parentcaller": "0x7ff79a463ec7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a31",
            "parentcaller": "0x7ff79a463ec7",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x284594239a0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xeee655e5"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dd0776"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a462a4e",
            "parentcaller": "0x7ff79a463ec7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-06-30 02:36:13,604",
            "thread_id": "2248",
            "caller": "0x7ff79a463ef0",
            "parentcaller": "0x7ff79a4624ca",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45cdc4",
            "parentcaller": "0x7ff79a45aa92",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459430000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a464f9c",
            "parentcaller": "0x7ff79a463931",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x84\\x02\\x00\\x00\\x90\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a465513",
            "parentcaller": "0x7ff79a46521e",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000409",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 62
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a4654c4",
            "parentcaller": "0x7ff79a464fc1",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d051000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a4654c4",
            "parentcaller": "0x7ff79a464fc1",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845936b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a4654c4",
            "parentcaller": "0x7ff79a464fc1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845936b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a464fff",
            "parentcaller": "0x7ff79a463931",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x84\\x02\\x00\\x00\\xe0\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf7\\xb6\\x00\\x00\\xe8\\xfb\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x00\\x00\\x00\\x00@^BY\\x84\\x02\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a4650f9",
            "parentcaller": "0x7ff79a463931",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a465116",
            "parentcaller": "0x7ff79a463931",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "CopyFileExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3f06c0"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a465137",
            "parentcaller": "0x7ff79a463931",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "IsDebuggerPresent"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3f01b0"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a465151",
            "parentcaller": "0x7ff79a463931",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "SetConsoleInputExeNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a8499ae0"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a46517c",
            "parentcaller": "0x7ff79a463931",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459366000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a46517c",
            "parentcaller": "0x7ff79a463931",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845936c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45bea1",
            "parentcaller": "0x7ff79a4639f4",
            "category": "system",
            "api": "FindFixAndRun",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Command",
                "value": "start"
              },
              {
                "name": "Arguments",
                "value": " /wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\""
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45c665",
            "parentcaller": "0x7ff79a45bea1",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xf7\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00h\\xf7\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\x84\\x02\\x00\\x00p\\xfa\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d051000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459366000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d071000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d076000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d07b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d080000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d085000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a469a8c",
            "parentcaller": "0x7ff79a469342",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d08a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45cdc4",
            "parentcaller": "0x7ff79a460c97",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459435000"
              },
              {
                "name": "RegionSize",
                "value": "0x00020000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a468287",
            "parentcaller": "0x7ff79a462f56",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x28459423460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x7d1ecff6"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dd0812"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a463a5d",
            "parentcaller": "0x7ff79a462fe0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a461170",
            "parentcaller": "0x7ff79a455ea6",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d089000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a456019",
            "parentcaller": "0x7ff79a45c862",
            "category": "process",
            "api": "UpdateProcThreadAttribute",
            "status": false,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Attribute",
                "value": "393217"
              },
              {
                "name": "Value",
                "value": "309237645313"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45608f",
            "parentcaller": "0x7ff79a45c862",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": false,
            "return": "0xffffffffc000012f",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000000"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\" "
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45608f",
            "parentcaller": "0x7ff79a45c862",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\" "
              },
              {
                "name": "CreationFlags",
                "value": "0x00080410",
                "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "0"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000000"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 89
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845942f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00025000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "42"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "2248"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-06-30 02:36:13,620",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000210"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000020c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6030000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a603f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a6030000"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6030000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a6033f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000228"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000228"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8700000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00083000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000228"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a8700000"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000230"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000230"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000230"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000230"
              },
              {
                "name": "ValueName",
                "value": "Enabled"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000020c"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000230"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000020c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "&wE\\x8c\\x96\\x1bw\\x08\\x7f5j\\x00\\xd8\\xbaA(\\x86\\x00&\\x7f\\x86U$\\xd2,\"D\\x96\\xea\\xaaf$\\xeaTi\\x8fm'\\xba\\xe8\\x88\\x860<:\\x99\\xd0("
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8700000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a8738cc0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9d12000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9d12000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-06-30 02:36:13,636",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a5b50000"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-06-30 02:36:13,651",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5b50000"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-06-30 02:36:13,651",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a5b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\uxtheme.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-06-30 02:36:13,651",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "uxtheme.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a5b50000"
              },
              {
                "name": "FunctionName",
                "value": "ThemeInitApiHook"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a5b57ce0"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-06-30 02:36:13,651",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xe3\\xaf\\x98\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000234"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000234"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000238"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000234"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000238"
              },
              {
                "name": "ValueName",
                "value": "AppsUseLightTheme"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000238"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a45662e",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a456649",
            "parentcaller": "0x7ff79a4564ba",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf0\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x18\\xf0\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a465aa5",
            "parentcaller": "0x7ff79a456686",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "T\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xf0\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xf0\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a456686",
            "parentcaller": "0x7ff79a4564ba",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "P\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x84\\x02\\x00\\x00P\\xf0\\xaf\\x98\\xf0\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00X\\xf0\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a4566b7",
            "parentcaller": "0x7ff79a4564ba",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\x10\\xf0\\xaf\\x98\\xf0\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xf0\\xaf\\x98\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a468b32",
            "parentcaller": "0x7ff79a4699d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff79a4ac000"
              },
              {
                "name": "ModuleName",
                "value": "cmd.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a468b32",
            "parentcaller": "0x7ff79a4699d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff79a4ac000"
              },
              {
                "name": "ModuleName",
                "value": "cmd.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-06-30 02:36:13,667",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\\comctl32"
              },
              {
                "name": "DllBase",
                "value": "0x7ff994050000"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-06-30 02:36:13,682",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff994050000"
              }
            ],
            "repeated": 1,
            "id": 161
          },
          {
            "timestamp": "2026-06-30 02:36:13,682",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SHCORE"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a9d30000"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-06-30 02:36:13,682",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-06-30 02:36:13,682",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a7a90000"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-06-30 02:36:13,682",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.storage"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a6230000"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-06-30 02:36:13,682",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a2720000"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-06-30 02:36:13,682",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3d0000"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-06-30 02:36:13,714",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-06-30 02:36:13,714",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a9600000"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-06-30 02:36:13,729",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a2720000"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-06-30 02:36:13,729",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-06-30 02:36:13,729",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 8,
            "id": 172
          },
          {
            "timestamp": "2026-06-30 02:36:13,745",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a8050000"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-06-30 02:36:13,776",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 10,
            "id": 174
          },
          {
            "timestamp": "2026-06-30 02:36:13,807",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.Storage.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6230000"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-06-30 02:36:13,807",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-06-30 02:36:13,807",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-06-30 02:36:13,807",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-06-30 02:36:13,807",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-06-30 02:36:13,823",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windows.storage.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6230000"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-06-30 02:36:13,839",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-06-30 02:36:13,901",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 13,
            "id": 182
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9a8441751",
            "parentcaller": "0x7ff9a8441420",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc00700bb",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\\x1f\\x99\\xf0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xeb\\x1f\\x99\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9aaa42ad0"
              },
              {
                "name": "Parameter",
                "value": "0x28459400b50"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaaae327",
            "parentcaller": "0x7ff9aaa0faf7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa05157",
            "parentcaller": "0x7ff9aaa043ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000384"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CFGMGR32.dll"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa04d42",
            "parentcaller": "0x7ff9aaa04aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000384"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8110000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0004e000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aa9ffee4",
            "parentcaller": "0x7ff9aa9ffad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a815b000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aa9fffb5",
            "parentcaller": "0x7ff9aa9ffad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8149000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aa9fffed",
            "parentcaller": "0x7ff9aa9ffad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8149000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa00068",
            "parentcaller": "0x7ff9aa9ffad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8149000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa0009c",
            "parentcaller": "0x7ff9aa9ffad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8149000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa05082",
            "parentcaller": "0x7ff9aaa079d2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8148000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa04485",
            "parentcaller": "0x7ff9aaa5b1dd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000384"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa37b9c",
            "parentcaller": "0x7ff9aaa2288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8148000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa37b9c",
            "parentcaller": "0x7ff9aaa2288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CFGMGR32"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a8110000"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 3,
            "id": 198
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9a8114cdf",
            "parentcaller": "0x7ff9a8123b0d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000384"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\DeviceApi\\CMApi"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9a8114cdf",
            "parentcaller": "0x7ff9a8123b0d",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\cfgmgr32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8110000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a8123280"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa37820",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a699a000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aaa37871",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a699a000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aa3e5611",
            "parentcaller": "0x7ff9a811f8f8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000384"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470807"
              },
              {
                "name": "InBuffer",
                "value": "(\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xae\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9aa3e5611",
            "parentcaller": "0x7ff9a811ec21",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000384"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470807"
              },
              {
                "name": "InBuffer",
                "value": "(\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a638acb2",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000378"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000038c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a638acfc",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a638acfc",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "Milliseconds",
                "value": "1000"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "2396",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845946b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 209
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "2396",
            "caller": "0x7ff9a8441751",
            "parentcaller": "0x7ff9a8441420",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc00700bb",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xee/\\x99\\xf0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xee/\\x99\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "2396",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "2396",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9aaa42ad0"
              },
              {
                "name": "Parameter",
                "value": "0x28459400b50"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "2396",
            "caller": "0x7ff9a63ca6d1",
            "parentcaller": "0x7ff9a63b12d5",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\?\\STORAGE#Volume#{1c192ddb-7371-11f1-9cd4-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{e1e1ae7a-0000-0000-0000-100000000000}\\"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-06-30 02:36:13,917",
            "thread_id": "960",
            "caller": "0x7ff9a63acca6",
            "parentcaller": "0x7ff9a63a8fe3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a901f",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000378"
              },
              {
                "name": "SubKey",
                "value": "{e1e1ae7a-0000-0000-0000-100000000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a9047",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a9d4bdab",
            "parentcaller": "0x7ff9a9d4bc22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "Data"
              },
              {
                "name": "Data",
                "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\xc4\\xd8c\\xf2\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a908b",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63acca6",
            "parentcaller": "0x7ff9a63a8fe3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a901f",
            "parentcaller": "0x7ff9a638a72d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000037c"
              },
              {
                "name": "SubKey",
                "value": "{e1e1ae7a-0000-0000-0000-100000000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a9047",
            "parentcaller": "0x7ff9a638a72d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a9d4bdab",
            "parentcaller": "0x7ff9a9d4bc22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a908b",
            "parentcaller": "0x7ff9a638a72d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a638acb2",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000378"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000037c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a638acfc",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a638acfc",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "Milliseconds",
                "value": "1000"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "2396",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a63b139f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "2396",
            "caller": "0x7ff9a63ca6d1",
            "parentcaller": "0x7ff9a63b12d5",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\?\\STORAGE#Volume#{1c192ddb-7371-11f1-9cd4-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{e1e1ae7a-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63acca6",
            "parentcaller": "0x7ff9a63a8fe3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a901f",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000378"
              },
              {
                "name": "SubKey",
                "value": "{e1e1ae7a-0000-0000-0000-300300000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x0000038c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a9047",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 233
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a9d4bdab",
            "parentcaller": "0x7ff9a9d4bc22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              },
              {
                "name": "ValueName",
                "value": "Data"
              },
              {
                "name": "Data",
                "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00o\\xb6d\\x1c\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a908b",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63acca6",
            "parentcaller": "0x7ff9a63a8fe3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x0000038c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a901f",
            "parentcaller": "0x7ff9a638a72d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000038c"
              },
              {
                "name": "SubKey",
                "value": "{e1e1ae7a-0000-0000-0000-300300000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a9047",
            "parentcaller": "0x7ff9a638a72d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\edputil"
              },
              {
                "name": "DllBase",
                "value": "0x7ff993730000"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a9d4bdab",
            "parentcaller": "0x7ff9a9d4bc22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "2396",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a63b139f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a638acb2",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000378"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000038c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a638acfc",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a638acfc",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "Milliseconds",
                "value": "1000"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "2396",
            "caller": "0x7ff9a63ca6d1",
            "parentcaller": "0x7ff9a63b12d5",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\?\\STORAGE#Volume#{1c192ddb-7371-11f1-9cd4-806e6f6e6963}#00000008E0100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{e1e1ae7a-0000-0000-0000-10e008000000}\\"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a638ad1a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a63b139f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63acca6",
            "parentcaller": "0x7ff9a63a8fe3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x0000038c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a901f",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000038c"
              },
              {
                "name": "SubKey",
                "value": "{e1e1ae7a-0000-0000-0000-10e008000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a9047",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a9d4bdab",
            "parentcaller": "0x7ff9a9d4bc22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "ValueName",
                "value": "Data"
              },
              {
                "name": "Data",
                "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\xd9T\\x98P\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x008\\x00E\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a908b",
            "parentcaller": "0x7ff9a638a6ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63acca6",
            "parentcaller": "0x7ff9a63a8fe3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a901f",
            "parentcaller": "0x7ff9a638a72d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000378"
              },
              {
                "name": "SubKey",
                "value": "{e1e1ae7a-0000-0000-0000-10e008000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x0000038c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a9047",
            "parentcaller": "0x7ff9a638a72d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a9d4bdab",
            "parentcaller": "0x7ff9a9d4bc22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a63a908b",
            "parentcaller": "0x7ff9a638a72d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a030",
            "parentcaller": "0x7ff9a8459d56",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8474dfe",
            "parentcaller": "0x7ff9a638af0d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000038c"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x001\\x00e\\x001\\x00a\\x00e\\x007\\x00a\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a8474e0e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a030",
            "parentcaller": "0x7ff9a8459d56",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8474dfe",
            "parentcaller": "0x7ff9a638af6d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000038c"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x001\\x00e\\x001\\x00a\\x00e\\x007\\x00a\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a8474e0e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a030",
            "parentcaller": "0x7ff9a8459d56",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8474dfe",
            "parentcaller": "0x7ff9a638af0d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000038c"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x001\\x00e\\x001\\x00a\\x00e\\x007\\x00a\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8474f8d",
            "parentcaller": "0x7ff9a638af0d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000038c"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x001\\x00e\\x001\\x00a\\x00e\\x007\\x00a\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a8474e0e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a030",
            "parentcaller": "0x7ff9a8459d56",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8474dfe",
            "parentcaller": "0x7ff9a638af6d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000038c"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x001\\x00e\\x001\\x00a\\x00e\\x007\\x00a\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8474f8d",
            "parentcaller": "0x7ff9a638af6d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000038c"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x001\\x00e\\x001\\x00a\\x00e\\x007\\x00a\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a8474e0e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a846b0fb",
            "parentcaller": "0x7ff9a6361f1d",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a6362e6f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\xd0FY\\x84\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a030",
            "parentcaller": "0x7ff9a8459d56",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a8474dfe",
            "parentcaller": "0x7ff9a638af0d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000038c"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x001\\x00e\\x001\\x00a\\x00e\\x007\\x00a\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x00e\\x000\\x000\\x008\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-06-30 02:36:13,932",
            "thread_id": "960",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a8474e0e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "960",
            "caller": "0x7ff9a845a030",
            "parentcaller": "0x7ff9a8459d56",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "960",
            "caller": "0x7ff9a8474dfe",
            "parentcaller": "0x7ff9a638af6d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000038c"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x001\\x00e\\x001\\x00a\\x00e\\x007\\x00a\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x00e\\x000\\x000\\x008\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "960",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a8474e0e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000003b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff9a977adb0"
              },
              {
                "name": "Parameter",
                "value": "0x28459461330"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "2328"
              },
              {
                "name": "ProcessId",
                "value": "3792"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "2328",
            "caller": "0x7ff9a8441751",
            "parentcaller": "0x7ff9a8441420",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc00700bb",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xee?\\x99\\xf0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xee?\\x99\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "2328",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "2328",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9a977adb0"
              },
              {
                "name": "Parameter",
                "value": "0x28459461330"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "960",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a9c24a33",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000003b8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "960",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459475000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "960",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459477000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000003d8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff9a9d45960"
              },
              {
                "name": "Parameter",
                "value": "0x2845936ce90"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "3812"
              },
              {
                "name": "ProcessId",
                "value": "3792"
              },
              {
                "name": "Module",
                "value": "SHCORE.dll"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a8441751",
            "parentcaller": "0x7ff9a8441420",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": false,
            "return": "0xffffffffc00700bb",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000044"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\ConDrv"
              },
              {
                "name": "IoControlCode",
                "value": "0x00500016"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xedO\\x99\\xf0\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xedO\\x99\\xf0\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9a9d45960"
              },
              {
                "name": "Parameter",
                "value": "0x2845936ce90"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459479000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a8498cfe",
            "parentcaller": "0x7ff9a9d79042",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8d\\x98\\xf0\\x00\\x00\\x00\\xd0\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "3812"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37820",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a280f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37871",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a280f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37820",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a280f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37871",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a280f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a9777d31",
            "parentcaller": "0x7ff9a972de55",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a972ddb2",
            "parentcaller": "0x7ff9a972d0f2",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003ec"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ActivatableClassId"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a97708cd",
            "parentcaller": "0x7ff9a972dd38",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003f0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.StateRepository.FileTypeAssociation"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a9770927",
            "parentcaller": "0x7ff9a972dd38",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003f4"
              },
              {
                "name": "KeyInformation",
                "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00h\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00F\\x00i\\x00l\\x00e\\x00T\\x00y\\x00p\\x00e\\x00A\\x00s\\x00s\\x00o\\x00c\\x00i\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x19\\x01\\x02\\x00\\xff84\\x02\\x00\\x003\\x04\\xffaf\\xffb2\\xff9d\\xffb1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00\\xfff8\\xffeaO\\xff99\\xfff0\\x00\\x00\\x00\\xffa3\\x07\\xffaf\\xffb2\\xff9d\\xffb1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000&FY\\xff84\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\xff80\\xffbeFY\\xff84\\x02\\x00\\x00@\\xffebO\\xff99\\xfff0\\x00\\x00\\x00\\xffa4L\\x18\\xff87\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffec\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffcd$;\\xff87\\xfff9\\x7f\\x00\\x00\\xffe8#;\\xff87\\xfff9\\x7f\\x00\\x00\\xff80\\xffbeFY\\xff84\\x02\\x00\\x00\\xffc8\\xffd5:\\xff87\\xfff9\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\xff84\\x02\\x00\\x00\\xff98$;\\xff87\\xfff9\\x7f\\x00\\x00\\xffec\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xff80$;\\xff87\\xfff9\\x7f\\x00\\x000\\xffebO\\xff99\\xfff0\\x00\\x00\\x00h\\xffd9:\\xff87\\xfff9\\x7f\\x00\\x00@\\xffebO\\xff99\\xfff0\\x00\\x00\\x00\\xff80\\xffbdFY\\xff84\\x02\\x00\\x00\\xffc0\\xffddr\\xffa9\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xff84\\x02\\x00\\x00\\xffc0\\xffecO\\xff99\\xfff0\\x00\\x00\\x00\\xff80\\xffbeFY\\xff84\\x02\\x00\\x000&FY\\xff84\\x02\\x00\\x00\\x10\\xffceEY\\xff84\\x02\\x00\\x00\\xffd76p\\xffa9\\xfff9\\x7f\\x00\\x00$\\x00&\\x00\\x00\\x00\\x00\\x00\\xff9c\\xffbdFY\\xff84\\x02\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffec\\x03\\x00\\x00\\x00\\x00\\x00\\x000\\xffebO\\xff99\\xfff0\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x1bFY\\xff84\\x02\\x00\\x00\\xfff2\\xffd0r\\xffa9\\xfff9\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "Data",
                "value": "StateRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97807bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-06-30 02:36:13,948",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a97356ac",
            "parentcaller": "0x7ff9a979b1b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003f4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9774022",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a975e0c4",
            "parentcaller": "0x7ff9aaa338b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a972ddb2",
            "parentcaller": "0x7ff9a972d0f2",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003ec"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Server"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a97708cd",
            "parentcaller": "0x7ff9a972dd38",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003f8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "StateRepository"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a9770927",
            "parentcaller": "0x7ff9a972dd38",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003fc"
              },
              {
                "name": "KeyInformation",
                "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x00\\x00\\xffb4\\xffd4\\xfffeZ\\xff84\\x02\\x00\\x000\\x19F\\xff87\\xfff9\\x7f\\x00\\x00\\xffb2\\xffddr\\xffa9\\xfff9\\x7f\\x00\\x00\\xffe9N\\x16\\xff87\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd9\\xffe6O\\xff99\\xfff0\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff84\\x02\\x00\\x00 \\x13\\x1bY\\xff84\\x02\\x00\\x00\\xffc3\\x00\\xffaf\\xffb2\\xff9d\\xffb1\\x00\\x00\\x00\\x00\\x1bY\\xff84\\x02\\x00\\x00\\xff87\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00H\\xffe7O\\xff99\\xfff0\\x00\\x00\\x00s\\x02\\xffaf\\xffb2\\xff9d\\xffb1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\xffbfFY\\xff84\\x02\\x00\\x00\\xffd8\\xff9dCY\\xff84\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffc4FY\\xff84\\x02\\x00\\x00\\xff90\\xffe7O\\xff99\\xfff0\\x00\\x00\\x00\\xffa4L\\x18\\xff87\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffec\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffcd$;\\xff87\\xfff9\\x7f\\x00\\x00\\xffe8#;\\xff87\\xfff9\\x7f\\x00\\x00\\xffc0\\xffc4FY\\xff84\\x02\\x00\\x00\\xffc8\\xffd5:\\xff87\\xfff9\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\xff84\\x02\\x00\\x00\\xff98$;\\xff87\\xfff9\\x7f\\x00\\x00\\xffec\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xff80$;\\xff87\\xfff9\\x7f\\x00\\x00\\xff80\\xffe7O\\xff99\\xfff0\\x00\\x00\\x00h\\xffd9:\\xff87\\xfff9\\x7f\\x00\\x00\\xff90\\xffe7O\\xff99\\xfff0\\x00\\x00\\x000\\x1cFY\\xff84\\x02\\x00\\x00\\xffc0\\xffddr\\xffa9\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xff84\\x02\\x00\\x00\\xff90\\xffe9O\\xff99\\xfff0\\x00\\x00\\x00\\xffc0\\xffc4FY\\xff84\\x02\\x00\\x00\\xffb0\\xffbfFY\\xff84\\x02\\x00\\x000\\x1cFY\\xff84\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x00\\x00\\x00\\x0c\\x00\\x0e\\x00\\x00\\x00\\x00\\x00L\\x1cFY\\xff84\\x02\\x00\\x000\\x00\\x00\\x00\\xff84\\x02\\x00\\x00\\xffec\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffe7O\\xff99\\xfff0\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x1fFY\\xff84\\x02\\x00\\x00\\xfff2\\xffd0r\\xffa9\\xfff9\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97807bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "ExePath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97807bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "CommandLine"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "IdentityType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9774022",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x000000ea",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Type",
                "value": "0x7ff900000003"
              },
              {
                "name": "DataLength",
                "value": "184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9774022",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Data",
                "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a9789d40",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "ActivatableClasses"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "ServerType"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "AppId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "Identity"
              },
              {
                "name": "Data",
                "value": "nt authority\\system"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "ServiceName"
              },
              {
                "name": "Data",
                "value": "StateRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              },
              {
                "name": "ValueName",
                "value": "ExplicitPsmActivationType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a97356ac",
            "parentcaller": "0x7ff9a979b1b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003fc"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a976ab76",
            "parentcaller": "0x7ff9a976f113",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003fc"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a976ab76",
            "parentcaller": "0x7ff9a976f113",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845947a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a9c24a33",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000003d4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845947c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a9c32140",
            "parentcaller": "0x7ff9a9c31ddd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a8462d8a",
            "parentcaller": "0x7ff9a96cfb64",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a96cfb82",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoGetMarshalSizeMax"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a9760fc0"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a96cfb9f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a96e8d00"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a96cfbbc",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a96e67a0"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a96cfbd9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a970b8c0"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845947e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-06-30 02:36:13,964",
            "thread_id": "3812",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a96d879f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000404"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a84a518d",
            "parentcaller": "0x7ff9a84646e4",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d1f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8462338",
            "parentcaller": "0x7ff9a84a9215",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000408"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8464b01",
            "parentcaller": "0x7ff9a84642d1",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 346
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a8464cf6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000408"
              },
              {
                "name": "Milliseconds",
                "value": "4000"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a84a518d",
            "parentcaller": "0x7ff9a8464c2a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2845d200000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8464cad",
            "parentcaller": "0x7ff9a8464c5d",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000408"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a978516f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a96e8d00"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a9785199",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a96e67a0"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a97851c3",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "StringFromIID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a9747c50"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a97851ed",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemAlloc"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a9768bb0"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a9785217",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemFree"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a9767040"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a9785241",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateInstance"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a96dc030"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a978526b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a970b8c0"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a978507f",
            "parentcaller": "0x7ff9aaa338b0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"
              },
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9768313",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000040e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a976834e",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9768377",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9768388",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a97295e4",
            "parentcaller": "0x7ff9a96eae14",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002be"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              },
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\xbaO\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x0e\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\x90\\xbbO\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000040e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a97740e1",
            "parentcaller": "0x7ff9a972968d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9729c65",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9729ef5",
            "parentcaller": "0x7ff9a9729d0e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000040e"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972ac16",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9729fcf",
            "parentcaller": "0x7ff9a9729d0e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xb9O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x0e\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00 \\xbaO\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000040e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xb9O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x0e\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00 \\xbaO\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000040e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9729a80",
            "parentcaller": "0x7ff9a96eae14",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a97295e4",
            "parentcaller": "0x7ff9a96eae14",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002be"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              },
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "P\\xb7O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x0e\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00P\\xb8O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000040e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a97740e1",
            "parentcaller": "0x7ff9a972968d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9729c65",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9729ef5",
            "parentcaller": "0x7ff9a9729d0e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000040e"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972ac16",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9729fcf",
            "parentcaller": "0x7ff9a9729d0e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\xb5O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x0e\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\xe0\\xb6O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000040e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\xb5O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x0e\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\xe0\\xb6O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000040e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a972ae1c",
            "parentcaller": "0x7ff9a9728039",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000040e"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9728085",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xb5O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x0e\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00 \\xb6O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000040e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a972b02a",
            "parentcaller": "0x7ff9a9729e28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002be"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              },
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a972b061",
            "parentcaller": "0x7ff9a9729e28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000412"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a972b0c5",
            "parentcaller": "0x7ff9a9729e28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9729a80",
            "parentcaller": "0x7ff9a96eae14",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              },
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a970953c",
            "parentcaller": "0x7ff9a970806b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000040e"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a9708090",
            "parentcaller": "0x7ff9a96dace7",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-06-30 02:36:13,979",
            "thread_id": "3812",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a1300000"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a1300000"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a1300000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d3d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.StateRepositoryPS.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a1300000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a1307340"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d3f0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.StateRepositoryPS.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a1300000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d410",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.StateRepositoryPS.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a1300000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a1307380"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}"
              },
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a9768313",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000040e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a976834e",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a9768377",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000412"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a9768388",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x28459480000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a96de87e",
            "parentcaller": "0x7ff9a96de27f",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26798",
            "parentcaller": "0x7ff9a84952e6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9aaa267b9",
            "parentcaller": "0x7ff9a84952e6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a9c32140",
            "parentcaller": "0x7ff9a9c31ddd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9aaa33f6a",
            "parentcaller": "0x7ff9a9bff557",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-06-30 02:36:13,995",
            "thread_id": "3812",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}"
              },
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9a9768313",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000040e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000416"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9a976834e",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000416"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9a9768377",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000416"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9a9768388",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9a8498cfe",
            "parentcaller": "0x7ff9a9d476bf",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8d\\x98\\xf0\\x00\\x00\\x00\\xd0\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "3812"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37820",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "SHCORE.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37871",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "SHCORE.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.UI.AppDefaults"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9903b0000"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.UI.AppDefaults.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9903b0000"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-06-30 02:36:14,011",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff994050000"
              }
            ],
            "repeated": 1,
            "id": 471
          },
          {
            "timestamp": "2026-06-30 02:36:14,026",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 4,
            "id": 472
          },
          {
            "timestamp": "2026-06-30 02:36:14,089",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\iertutil"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99f680000"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-06-30 02:36:14,089",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\srvcli"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99f650000"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-06-30 02:36:14,089",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a75f0000"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-06-30 02:36:14,089",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\urlmon"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99f930000"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-06-30 02:36:14,089",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 5,
            "id": 477
          },
          {
            "timestamp": "2026-06-30 02:36:14,089",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-06-30 02:36:14,104",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a7200000"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-06-30 02:36:14,104",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a35e0000"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-06-30 02:36:14,120",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\urlmon.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f930000"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-06-30 02:36:14,120",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-06-30 02:36:14,120",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-WIN-CORE-URL-L1-1-0.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8430000"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-06-30 02:36:14,120",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 484
          },
          {
            "timestamp": "2026-06-30 02:36:14,136",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CDC82860-468D-4D4E-B7E7-C298FF23AB2C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "5632B1A4-E38A-400A-928A-D4CD63230295"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-06-30 02:36:14,136",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 486
          },
          {
            "timestamp": "2026-06-30 02:36:14,136",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a4dc0000"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-06-30 02:36:14,151",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a4dc0000"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-06-30 02:36:14,151",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F1C46D71-B791-4110-8D5C-7108F22C1010"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8A43ED9F-F4E6-4421-ACF9-1DAB2986820C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-06-30 02:36:14,151",
            "thread_id": "2248",
            "caller": "0x7ff79a457989",
            "parentcaller": "0x7ff79a4566e5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a4dc0000"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-06-30 02:36:14,151",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Bcp47Langs"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99e080000"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-06-30 02:36:14,167",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\sppc"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a6c60000"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-06-30 02:36:14,167",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SLC"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a6c90000"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-06-30 02:36:14,167",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a7f80000"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-06-30 02:36:14,167",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\appresolver"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9971f0000"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-06-30 02:36:14,167",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\appresolver.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9971f0000"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-06-30 02:36:14,167",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-06-30 02:36:14,167",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "21CBC515-2DDE-4D66-8292-BA34BD25094A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-06-30 02:36:14,167",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37820",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "SHCORE.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37871",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "SHCORE.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a8498cfe",
            "parentcaller": "0x7ff9a9d79042",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8d\\x98\\xf0\\x00\\x00\\x00\\xd0\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "3812"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99d480000"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99d480000"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a6408272",
            "parentcaller": "0x7ff9a6408b42",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a9c32140",
            "parentcaller": "0x7ff9a9c31ddd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37820",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9d12000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9aaa37871",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9d12000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a9bf56f3",
            "parentcaller": "0x7ff9a9c320bb",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9aaa33f6a",
            "parentcaller": "0x7ff9a9bff557",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}"
              },
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a9768313",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000496"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a976834e",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a9768377",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a9768388",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-06-30 02:36:14,182",
            "thread_id": "3812",
            "caller": "0x7ff9a97295e4",
            "parentcaller": "0x7ff9a96eae14",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002be"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xc3O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\xb0\\xc4O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000496"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a97740e1",
            "parentcaller": "0x7ff9a972968d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9729c65",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a9729ef5",
            "parentcaller": "0x7ff9a9729d0e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000496"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972ac16",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a9729fcf",
            "parentcaller": "0x7ff9a9729d0e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xc2O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00@\\xc3O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000496"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xc2O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00@\\xc3O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000496"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a9729a80",
            "parentcaller": "0x7ff9a96eae14",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a97295e4",
            "parentcaller": "0x7ff9a96eae14",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002be"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc0O\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00p\\xc1O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000496"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a97740e1",
            "parentcaller": "0x7ff9a972968d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9729c65",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a9729ef5",
            "parentcaller": "0x7ff9a9729d0e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000496"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a17d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972a22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a972ac16",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a9729fcf",
            "parentcaller": "0x7ff9a9729d0e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xbfO\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\x00\\xc0O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000496"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xbfO\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00\\x00\\xc0O\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000496"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a972ae1c",
            "parentcaller": "0x7ff9a9728039",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000496"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9728085",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8460827",
            "parentcaller": "0x7ff9a845fb22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d754",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9aaa26c8b",
            "parentcaller": "0x7ff9a845d7e0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xbeO\\x99\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\x00\\x00\\x00@\\xbfO\\x99\\xf0\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845d8e8",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845da04",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000496"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845da22",
            "parentcaller": "0x7ff9a845fb59",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000496"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a972b02a",
            "parentcaller": "0x7ff9a9729e28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002be"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "Handle",
                "value": "0x00000492"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a972b061",
            "parentcaller": "0x7ff9a9729e28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000492"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a972b0c5",
            "parentcaller": "0x7ff9a9729e28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000492"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a9729a80",
            "parentcaller": "0x7ff9a96eae14",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "Handle",
                "value": "0x00000496"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a970953c",
            "parentcaller": "0x7ff9a970806b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000496"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a9708090",
            "parentcaller": "0x7ff9a96dace7",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000496"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-06-30 02:36:14,198",
            "thread_id": "3812",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99eea0000"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99eea0000"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff99eea0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d3d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff99eea0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff99eeb5da0"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d3f0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff99eea0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d410",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff99eea0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff99eeb5e50"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a97708cd",
            "parentcaller": "0x7ff9a972dd38",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003f0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Storage.Streams.DataWriter"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a9770927",
            "parentcaller": "0x7ff9a972dd38",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004d8"
              },
              {
                "name": "KeyInformation",
                "value": "?\t(\\xffce}\\x07\\xffdd\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00W\\x00r\\x00i\\x00t\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c\\x1bY\\xff84\\x02\\x00\\x008\\xffe9O\\xff99\\xfff0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x17\\x00\\x0f\\x00\\x00\\x00\\x00\\x005\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0LDY\\xff84\\x02\\x00\\x00\\xffc9\\xffe5O\\xff99\\xfff0\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xff84\\x02\\x00\\x00 \\x13\\x1bY\\xff84\\x02\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1bY\\xff84\\x02\\x00\\x00\\xffc4\\x02\\x1bY\\xff84\\x02\\x00\\x00\\x00\\x00\\x1bY\\xff84\\x02\\x00\\x00XU\\xff9b\\xffa9\\xfff9\\x7f\\x00\\x00()FY\\xff84\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffe6O\\xff99\\xfff0\\x00\\x00\\x00\\xff98kp\\xffa9\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xff84\\x02\\x00\\x00\\xff80\\x10HY\\xff84\\x02\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x00)FY\\xff84\\x02\\x00\\x00\\xff80\\x10HY\\xff84\\x02\\x00\\x00\\xfff05IY\\xff84\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\x00\\x00pVBY\\x02\\x00\\x00\\x00\\xffa6Ap\\xffa9\\xfff9\\x7f\\x00\\x00 \\xff87IY\\xff84\\x02\\x00\\x00\\xfff05IY\\xff84\\x02\\x00\\x00\\xfff0\\x10HY\\xff84\\x02\\x00\\x00\\xfff0\\x10HY\\xff84\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x10HY\\xff84\\x02\\x00\\x00\\xfff0\\x10HY\\xff84\\x02\\x00\\x00\\xffd76p\\xffa9\\xfff9\\x7f\\x00\\x00`-IY\\xff84\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00O\\xff99\\xfff0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`-IY\\xff84\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\x00\\x00\\x00\\xff90\\xffe7O\\xff99\\xfff0\\x00\\x00\\x00\\xffa1Ep\\xffa9\\xfff9\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97807bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a97356ac",
            "parentcaller": "0x7ff9a979b1b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004d8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9774022",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-06-30 02:36:14,214",
            "thread_id": "3812",
            "caller": "0x7ff9a976ab76",
            "parentcaller": "0x7ff9a976f113",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-06-30 02:36:16,354",
            "thread_id": "3812",
            "caller": "0x7ff9a4de1f18",
            "parentcaller": "0x7ff9a4de2681",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-06-30 02:36:16,354",
            "thread_id": "3812",
            "caller": "0x7ff9a96de87e",
            "parentcaller": "0x7ff9a970ced5",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 5,
            "id": 617
          },
          {
            "timestamp": "2026-06-30 02:36:16,354",
            "thread_id": "3812",
            "caller": "0x7ff9a8498cfe",
            "parentcaller": "0x7ff9a9d476bf",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x8d\\x98\\xf0\\x00\\x00\\x00\\xd0\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\xe4\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "3812"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-06-30 02:36:16,354",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000494"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000004d8"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\NOTEPAD.EXE"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "5060"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-06-30 02:36:16,354",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 620
          },
          {
            "timestamp": "2026-06-30 02:36:16,386",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-06-30 02:36:16,401",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\NOTEPAD.EXE"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "CreationFlags",
                "value": "0x04080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT|CREATE_DEFAULT_ERROR_MODE"
              },
              {
                "name": "ProcessId",
                "value": "5060"
              },
              {
                "name": "ThreadId",
                "value": "3940"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000494"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000004d8"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-06-30 02:36:16,401",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\MPR"
              },
              {
                "name": "DllBase",
                "value": "0x7ff998030000"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-06-30 02:36:16,401",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 624
          },
          {
            "timestamp": "2026-06-30 02:36:16,401",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\pcacli"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a31d0000"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-06-30 02:36:16,417",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-06-30 02:36:16,417",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-06-30 02:36:16,417",
            "thread_id": "2248",
            "caller": "0x7ff79a4566e5",
            "parentcaller": "0x7ff79a4564ba",
            "category": "process",
            "api": "ShellExecuteExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "FilePath",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "Parameters",
                "value": ""
              },
              {
                "name": "Show",
                "value": "1",
                "pretty_value": "SW_SHOWNORMAL"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-06-30 02:36:16,417",
            "thread_id": "2248",
            "caller": "0x7ff79a456713",
            "parentcaller": "0x7ff79a4564ba",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-06-30 02:36:16,417",
            "thread_id": "2248",
            "caller": "0x7ff79a456713",
            "parentcaller": "0x7ff79a4564ba",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a9530000"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-06-30 02:36:16,417",
            "thread_id": "2248",
            "caller": "0x7ff79a465cd2",
            "parentcaller": "0x7ff79a4740a5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000500"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 631
          }
        ],
        "threads": [
          "2248",
          "4284",
          "4512",
          "1944",
          "2784",
          "960",
          "2396",
          "2328",
          "3812"
        ],
        "environ": {
          "UserName": "Rajesh",
          "ComputerName": "DESKTOP-P54VDBR",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Windows\\system32\\cmd.exe\" /c start /wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\"",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "1c64-b66f",
          "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff79a450000",
          "MainExeSize": "0x00067000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 756,
        "process_name": "svchost.exe",
        "parent_id": 632,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "first_seen": "2026-06-30 02:36:14,255",
        "calls": [
          {
            "timestamp": "2026-06-30 02:36:17,083",
            "thread_id": "3624",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a84632e1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rsaenh.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a7170000"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-06-30 02:36:23,723",
            "thread_id": "3624",
            "caller": "0x7ff9a845a030",
            "parentcaller": "0x7ff9a8459d56",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000071c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-06-30 02:36:27,989",
            "thread_id": "1176",
            "caller": "0x7ff9a845a030",
            "parentcaller": "0x7ff9a8459d56",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000aac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-06-30 02:36:27,989",
            "thread_id": "1176",
            "caller": "0x7ff9a8494796",
            "parentcaller": "0x7ff9a849466e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000054c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x22e54240000"
              },
              {
                "name": "SectionOffset",
                "value": "0x36ac2fce30"
              },
              {
                "name": "ViewSize",
                "value": "0x0007a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-06-30 02:36:27,989",
            "thread_id": "1176",
            "caller": "0x7ff9a8438e73",
            "parentcaller": "0x7ff9a84363c3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x0000054c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000dcc"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140707423586076"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-06-30 02:36:29,536",
            "thread_id": "1176",
            "caller": "0x7ff9a84363c3",
            "parentcaller": "0x7ff9aa3edb20",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000010",
                "pretty_value": "CREATE_NEW_CONSOLE"
              },
              {
                "name": "ProcessId",
                "value": "1820"
              },
              {
                "name": "ThreadId",
                "value": "3596"
              },
              {
                "name": "ProcessHandle",
                "value": "0x0000054c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000dcc"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5
          }
        ],
        "threads": [
          "3624",
          "1176"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "DESKTOP-P54VDBR",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "1c64-b66f",
          "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff69d480000",
          "MainExeSize": "0x00011000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 5060,
        "process_name": "notepad.exe",
        "parent_id": 3792,
        "module_path": "C:\\Windows\\System32\\notepad.exe",
        "first_seen": "2026-06-30 02:36:16,441",
        "calls": [
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e48d9",
            "parentcaller": "0x7ff9aa3e3b55",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000021c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e4a50",
            "parentcaller": "0x7ff9aa3e3b55",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000220"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004",
                "pretty_value": "SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000021c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e49bd",
            "parentcaller": "0x7ff9aa3e3b55",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000220"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0890000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3de7a0",
            "parentcaller": "0x7ff9aa3e4cfd",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000224"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3de7f0",
            "parentcaller": "0x7ff9aa3e4cfd",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000224"
              },
              {
                "name": "ValueName",
                "value": "PreferExternalManifest"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3de818",
            "parentcaller": "0x7ff9aa3e4cfd",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000224"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e51b2",
            "parentcaller": "0x7ff9aa3e4dcf",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000021c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e4c33",
            "parentcaller": "0x7ff9aa3e462e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000021c"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e4c3a",
            "parentcaller": "0x7ff9aa3e462e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000220"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e462e",
            "parentcaller": "0x7ff9aa3e3b55",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0890000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e2a0e",
            "parentcaller": "0x7ff9940b3a63",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "ThemePropScrollBarCtl"
              },
              {
                "name": "Atom",
                "value": "0x0000c01b"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aa3e2a0e",
            "parentcaller": "0x7ff9940b3a7d",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MicrosoftTabletPenServiceProperty"
              },
              {
                "name": "Atom",
                "value": "0x0000c01c"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9940b3bbc",
            "parentcaller": "0x7ff9940b3aed",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001022"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9a8462d8a",
            "parentcaller": "0x7ff9940b3afb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "LPK"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9a8462d8a",
            "parentcaller": "0x7ff9940b3b13",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "GDI32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9940b3b2e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "LpkEditControl"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3c4720"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9940b3b2e",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\\comctl32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff994050000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9940e9e80"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-06-30 02:36:16,676",
            "thread_id": "3940",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff737de5a30"
              },
              {
                "name": "Parameter",
                "value": "0x97e6202000"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de5842",
            "parentcaller": "0x7ff737de590b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef18000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de5842",
            "parentcaller": "0x7ff737de590b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef19000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de6079",
            "parentcaller": "0x7ff737de590b",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de60ac",
            "parentcaller": "0x7ff737de590b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "InitializeConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa59e60"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de60c0",
            "parentcaller": "0x7ff737de590b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "SleepConditionVariableCS"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a849ce10"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de60d4",
            "parentcaller": "0x7ff737de590b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "WakeAllConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa453d0"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de5899",
            "parentcaller": "0x7ff737de592c",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff737de6710"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc657c",
            "parentcaller": "0x7ff737dc74e7",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc6599",
            "parentcaller": "0x7ff737dc74e7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa9f93b0"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc3e47",
            "parentcaller": "0x7ff737dc6a71",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8f9b0"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc6aee",
            "parentcaller": "0x7ff737dc65e2",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa32450"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc3dba",
            "parentcaller": "0x7ff737dc4975",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc480d",
            "parentcaller": "0x7ff737dc6cb5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa4cb70"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc3d2b",
            "parentcaller": "0x7ff737dc706a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa53330"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "1440",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "1440",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2f10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc78b9",
            "parentcaller": "0x7ff737dc68d3",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000220"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dc78e7",
            "parentcaller": "0x7ff737dc68d3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000220"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "2076",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef1b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de55d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff737df7000"
              },
              {
                "name": "ModuleName",
                "value": "NOTEPAD.EXE"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de55d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff737df7000"
              },
              {
                "name": "ModuleName",
                "value": "NOTEPAD.EXE"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1c0",
            "parentcaller": "0x7ff737de59b6",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x214aeef2318",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 3,
            "id": 41
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "2076",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "2076",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c3070"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "42"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "3940"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000022c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8700000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00083000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a8700000"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000234"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000234"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000234"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-06-30 02:36:16,691",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000234"
              },
              {
                "name": "ValueName",
                "value": "Enabled"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000238"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000238"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000234"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000238"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000238"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000238"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xd8\\xcd\\x918\\xbf\\xfa\\xe9zMHvK\\xe2lG\\x08\\xd2\\xca>\\x9f\\xad\\xa9^\\x0c -\\x1f\\xa7\\xb4c\\xcbs\\x886\\xdf\\x7fF\\xf2Jui\\xb4R8c\\xcb\\xc1\\x7f"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8700000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a8738cc0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9d12000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc1d6",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9d12000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "2832",
            "caller": "0x7ff9aaa4ea52",
            "parentcaller": "0x7ff9aaa077c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000248"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000244"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000248"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6030000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a603f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef1c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a6030000"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6030000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a6033f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef1e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "5028",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "5028",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2a40"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "2832",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "2832",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2e50"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a5b50000"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5b50000"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a5b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\uxtheme.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "uxtheme.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a5b50000"
              },
              {
                "name": "FunctionName",
                "value": "ThemeInitApiHook"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a5b57ce0"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xec\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000200"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000204"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              },
              {
                "name": "ValueName",
                "value": "AppsUseLightTheme"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737dcc215",
            "parentcaller": "0x7ff737de59b6",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CLSIDFromOle1Class"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a97680a0"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "26"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\xf4\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf0\\xf4\\x12\\xe6\\x97\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x14;\\x87"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000254"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa53330"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000258"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\__ComCatalogCache__"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000258"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0890000"
              },
              {
                "name": "SectionOffset",
                "value": "0x97e612f530"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\COM3"
              },
              {
                "name": "Handle",
                "value": "0x0000025c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              },
              {
                "name": "ValueName",
                "value": "Com+Enabled"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000025c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "clbcatq.dll"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000025c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9600000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000a9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a96a4000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9679000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9679000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9679000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9679000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9678000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9678000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a9600000"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              },
              {
                "name": "EventName",
                "value": "\\KernelObjects\\MaximumCommitCondition"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9600000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a961d990"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-06-30 02:36:16,707",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000264"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000268"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000264"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ActivatableClassId"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000026c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000268"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.ApplicationModel.Resources.Core.ResourceManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000026c"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff8aX\\x17\\xffce}\\x07\\xffdd\\x01\\x00\\x00\\x00\\x00n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00s\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00R\\x00e\\x00s\\x00o\\x00u\\x00r\\x00c\\x00e\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\xff86\\xffd9r\\x04v)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00\\xffb8\\xfff1\\x12\\xffe6\\xff97\\x00\\x00\\x00\\x16\\xffdcr\\x04v)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc8\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00 \\xff9c\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\xfff2\\x12\\xffe6\\xff97\\x00\\x00\\x00\\xffa4L\\x18\\xff87\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffffd\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00\\xffe5j\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffcd$;\\xff87\\xfff9\\x7f\\x00\\x00\\xffe8#;\\xff87\\xfff9\\x7f\\x00\\x00 \\xff9c\\xfff1\\xffae\\x14\\x02\\x00\\x00\\xffc8\\xffd5:\\xff87\\xfff9\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\x14\\x02\\x00\\x00\\xff98$;\\xff87\\xfff9\\x7f\\x00\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff80$;\\xff87\\xfff9\\x7f\\x00\\x00\\xfff0\\xfff1\\x12\\xffe6\\xff97\\x00\\x00\\x00h\\xffd9:\\xff87\\xfff9\\x7f\\x00\\x00\\x00\\xfff2\\x12\\xffe6\\xff97\\x00\\x00\\x00\\x00\\xffa2\\xfff1\\xffae\\x14\\x02\\x00\\x00\\xffc0\\xffddr\\xffa9\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\xff80\\xfff3\\x12\\xffe6\\xff97\\x00\\x00\\x00 \\xff9c\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\xffc8\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x10\\xffb0\\xffef\\xffae\\x14\\x02\\x00\\x00\\xffd76p\\xffa9\\xfff9\\x7f\\x00\\x00$\\x00&\\x00\\x00\\x00\\x00\\x00\\x1c\\xffa2\\xfff1\\xffae\\x14\\x02\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xfff1\\x12\\xffe6\\xff97\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xff93\\xfff1\\xffae\\x14\\x02\\x00\\x00\\xfff2\\xffd0r\\xffa9\\xfff9\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Server"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\MrmCoreR.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Threading"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000026c"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xf2\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x14\\x02\\x00\\x00\\xb0\\xf4\\x12\\xe6\\x97\\x00\\x00\\x00\\xc0A\\xf1\\xae\\x14\\x02\\x00\\x00x#\\x828\\xdbI\\x00\\x00\\xa1[\\xa1\\xaa\\xf9\\x7f\\x00\\x00\\x009\\xd4\\x91\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000026c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000026c"
              },
              {
                "name": "SubKey",
                "value": "Software\\Classes"
              },
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegNotifyChangeKeyValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\"
              },
              {
                "name": "NotifyFilter",
                "value": "0x10000005"
              },
              {
                "name": "WatchSubtree",
                "value": "1"
              },
              {
                "name": "Asynchronous",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x00000274"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              },
              {
                "name": "ValueName",
                "value": "MaxSxSHashCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-06-30 02:36:16,723",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MrmCoreR"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a06e0000"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\MrmCoreR.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a06e0000"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a06e0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\MrmCoreR.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a06e0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a071e5b0"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a06e0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a071dea0"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a06e0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a071ebc0"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a07ce000"
              },
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a07ce000"
              },
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a07ce000"
              },
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a07ce000"
              },
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e35",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a07ce000"
              },
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a07ce000"
              },
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a07ce000"
              },
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a07ce000"
              },
              {
                "name": "ModuleName",
                "value": "MrmCoreR.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa9f93b0"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8f9b0"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa32450"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa4cb70"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa53330"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef27000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 221
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 224
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef28000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 228
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 233
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 236
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Mrt\\_Merged"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Mrt\\_Merged"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\resources.pri"
              }
            ],
            "repeated": 1,
            "id": 239
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:120:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737de4e5e",
            "parentcaller": "0x7ff737dcc22f",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 6,
            "id": 245
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dd3085",
            "parentcaller": "0x7ff737dd3e31",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef2b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dd3e7e",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x214aee80760",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "Type",
                "value": "#9"
              },
              {
                "name": "Name",
                "value": "GlobalAcc"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dd3e7e",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x214aee829dc",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x214aee80760"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dd3e9b",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x214aee80770",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "Type",
                "value": "#9"
              },
              {
                "name": "Name",
                "value": "MainAcc"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dd3e9b",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x214aee82a7c",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x214aee80770"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x214b0910818",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#2"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x214b09296d8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x214b0910818"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x214b09107e8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "Type",
                "value": "#3"
              },
              {
                "name": "Name",
                "value": "#11"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x214b0927840",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x214b09107e8"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde404",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde449",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x214b0910818",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#2"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde449",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x214b09296d8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x214b0910818"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde449",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x214b0910808",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "Type",
                "value": "#3"
              },
              {
                "name": "Name",
                "value": "#13"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dde449",
            "parentcaller": "0x7ff737dd3ed7",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x214b0929270",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x214b0910808"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dc9090",
            "parentcaller": "0x7ff737dd3f06",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dc9090",
            "parentcaller": "0x7ff737dd3f06",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dc9090",
            "parentcaller": "0x7ff737dd3f06",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dc9090",
            "parentcaller": "0x7ff737dd3f06",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dc9090",
            "parentcaller": "0x7ff737dd3f06",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dc9090",
            "parentcaller": "0x7ff737dd3f06",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-06-30 02:36:16,738",
            "thread_id": "3940",
            "caller": "0x7ff737dc9090",
            "parentcaller": "0x7ff737dd3f06",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd26e3",
            "parentcaller": "0x7ff737dd3f10",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Notepad"
              },
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Notepad"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2710",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfEscapement"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfEscapement"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd272b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfOrientation"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfOrientation"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2746",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfWeight"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfWeight"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2760",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfItalic"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfItalic"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd277a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfUnderline"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfUnderline"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2794",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfStrikeOut"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfStrikeOut"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd27ae",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfCharSet"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfCharSet"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd27c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfOutPrecision"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfOutPrecision"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd27e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfClipPrecision"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfClipPrecision"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd27fc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfQuality"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfQuality"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2816",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfPitchAndFamily"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfPitchAndFamily"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd2844",
            "parentcaller": "0x7ff737dd3f10",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Notepad\\DefaultFonts"
              },
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Notepad\\DefaultFonts"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd21ef",
            "parentcaller": "0x7ff737dd2871",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "ValueName",
                "value": "lfFaceName"
              },
              {
                "name": "Data",
                "value": "Consolas"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\lfFaceName"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2885",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "ValueName",
                "value": "iPointSize"
              },
              {
                "name": "Data",
                "value": "110"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\iPointSize"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd2893",
            "parentcaller": "0x7ff737dd3f10",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd21ef",
            "parentcaller": "0x7ff737dd28bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "lfFaceName"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfFaceName"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd28d0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iPointSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iPointSize"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd28ea",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "fWrap"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWrap"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2974",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iDefaultEncoding"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iDefaultEncoding"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd29f8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "StatusBar"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\StatusBar"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2a12",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "fSaveWindowPositions"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fSaveWindowPositions"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd2117",
            "parentcaller": "0x7ff737dd2a23",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "fWindowsOnlyEOL"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWindowsOnlyEOL"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd2117",
            "parentcaller": "0x7ff737dd2a3a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "fPasteOriginalEOL"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fPasteOriginalEOL"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd2117",
            "parentcaller": "0x7ff737dd2a51",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "fReverse"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fReverse"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-06-30 02:36:16,754",
            "thread_id": "3940",
            "caller": "0x7ff737dd2117",
            "parentcaller": "0x7ff737dd2a6b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "fWrapAround"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWrapAround"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd2117",
            "parentcaller": "0x7ff737dd2a85",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "fMatchCase"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fMatchCase"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd21ef",
            "parentcaller": "0x7ff737dd2ab2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "searchString"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\searchString"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd21ef",
            "parentcaller": "0x7ff737dd2ad1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "replaceString"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\replaceString"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd21ef",
            "parentcaller": "0x7ff737dd2af5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "szHeader"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\szHeader"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd21ef",
            "parentcaller": "0x7ff737dd2b14",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "szTrailer"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\szTrailer"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2b2c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iMarginTop"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginTop"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2b4a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iMarginBottom"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginBottom"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2b68",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iMarginLeft"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginLeft"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2b86",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iMarginRight"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginRight"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2ba5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iWindowPosY"
              },
              {
                "name": "Data",
                "value": "182"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosY"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2bbf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iWindowPosX"
              },
              {
                "name": "Data",
                "value": "182"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosX"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2bd9",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iWindowPosDX"
              },
              {
                "name": "Data",
                "value": "1080"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosDX"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2bf3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "iWindowPosDY"
              },
              {
                "name": "Data",
                "value": "624"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosDY"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd209f",
            "parentcaller": "0x7ff737dd2c0d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "fMLE_is_broken"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fMLE_is_broken"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd2c24",
            "parentcaller": "0x7ff737dd3f10",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de7042",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff737df7000"
              },
              {
                "name": "ModuleName",
                "value": "NOTEPAD.EXE"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de7042",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff737df7000"
              },
              {
                "name": "ModuleName",
                "value": "NOTEPAD.EXE"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de0bee",
            "parentcaller": "0x7ff737dde657",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a7a90000"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de0bee",
            "parentcaller": "0x7ff737dde657",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.storage"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a6230000"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de0bee",
            "parentcaller": "0x7ff737dde657",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3d0000"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de0bee",
            "parentcaller": "0x7ff737dde657",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de0bee",
            "parentcaller": "0x7ff737dde657",
            "category": "filesystem",
            "api": "SHGetKnownFolderPath",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FolderID",
                "value": "F1B32785-6FBA-4FCF-9D55-7B8E7F157091"
              },
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "Path",
                "value": "C:\\Users\\Rajesh\\AppData\\Local"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de16b3",
            "parentcaller": "0x7ff737dd3f70",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0a60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737de16b3",
            "parentcaller": "0x7ff737dd3f70",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x214aee806b0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "Type",
                "value": "#4"
              },
              {
                "name": "Name",
                "value": "#1"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x214aee808a0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff737dc0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x214aee806b0"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002d0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "MSCTF.dll"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002d0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9a10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00115000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9aed000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9aed000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9aed000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9aed000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9aec000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9aec000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00e\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00M\\x00a\\x00n\\x00a\\x00\\x02\\x00\\x00\\x00r\\x00:\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x000\\x003\\x00E\\x00\\x02\\x00\\x00\\x004\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x003\\x00-\\x009\\x00\\x02\\x00\\x00\\x00C\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009\\x00D\\x00D\\x007\\x00\\x02\\x00\\x00\\x001\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x00i\\x00l\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-06-30 02:36:16,770",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a9a10000"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msctf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9a10000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a9a51520"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9239000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9239000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e4"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9239000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9239000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dd3fcb",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\2\\Windows\\ThemeSection"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0a70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x97e612d160"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Windows\\Theme4054054479"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\2\\Windows\\Theme738112361"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0a70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002e4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b25a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x97e612d880"
              },
              {
                "name": "ViewSize",
                "value": "0x000e2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002ec"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0a70000"
              },
              {
                "name": "SectionOffset",
                "value": "0x97e612d880"
              },
              {
                "name": "ViewSize",
                "value": "0x00004000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa9f93b0"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8f9b0"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa32450"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa4cb70"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa53330"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dd3fcb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0b12000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000009",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": "ResourcePolicies"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0a80000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0a80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0b14000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0b15000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000409",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef2d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef32000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              },
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "67"
              },
              {
                "name": "MaxValueNameLength",
                "value": "27"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef37000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "Lucida Sans Unicode"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lucida Sans Unicode"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "Microsoft Sans Serif"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft Sans Serif"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "Tahoma"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Tahoma"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Bold"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Light"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Semibold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Semibold"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "Ebrima"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Ebrima"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "Ebrima Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Ebrima Bold"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "Gadugi"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gadugi"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "Gadugi Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gadugi Bold"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "Khmer UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Khmer UI"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "ValueName",
                "value": "Khmer UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Khmer UI Bold"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "ValueName",
                "value": "Lao UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lao UI"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-06-30 02:36:16,785",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "ValueName",
                "value": "Lao UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lao UI Bold"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee Bold"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee UI"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee UI Bold"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI Bold"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "ValueName",
                "value": "MingLiU"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "ValueName",
                "value": "PMingLiU"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\PMingLiU"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "ValueName",
                "value": "MingLiU_HKSCS"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU_HKSCS"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "ValueName",
                "value": "MingLiU-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU-ExtB"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "ValueName",
                "value": "PMingLiU-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\PMingLiU-ExtB"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "ValueName",
                "value": "MingLiU_HKSCS-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU_HKSCS-ExtB"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei Bold"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI Bold"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI Light"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "ValueName",
                "value": "SimSun"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\SimSun"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-06-30 02:36:16,801",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "ValueName",
                "value": "SimSun-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\SimSun-ExtB"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "ValueName",
                "value": "NSimSun"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\NSimSun"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei Bold"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI Bold"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI Light"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Bold"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Light"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Semibold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Semibold"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "ValueName",
                "value": "Meiryo"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "ValueName",
                "value": "Meiryo Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo Bold"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "ValueName",
                "value": "Meiryo UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo UI"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "ValueName",
                "value": "Meiryo UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo UI Bold"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "ValueName",
                "value": "MS Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS Gothic"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "ValueName",
                "value": "MS PGothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS PGothic"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "ValueName",
                "value": "MS UI Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS UI Gothic"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "ValueName",
                "value": "MS Mincho"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS Mincho"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "ValueName",
                "value": "MS PMincho"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS PMincho"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "ValueName",
                "value": "Batang"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Batang"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-06-30 02:36:16,816",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "ValueName",
                "value": "BatangChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\BatangChe"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "ValueName",
                "value": "Dotum"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Dotum"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "ValueName",
                "value": "DotumChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\DotumChe"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "ValueName",
                "value": "Gulim"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gulim"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "ValueName",
                "value": "GulimChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\GulimChe"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "ValueName",
                "value": "Gungsuh"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gungsuh"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "ValueName",
                "value": "GungsuhChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\GungsuhChe"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic Bold"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic Semilight"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "0",
                "pretty_value": "REG_NONE"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000409",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              },
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "ValueName",
                "value": "Disable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "ValueName",
                "value": "DataFilePath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\Fonts\\staticcache.dat"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\staticcache.dat"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000298"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000298"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "Buffer",
                "value": "\\x1a\\x83W\\xa5\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00$\\x01\\x00\\x00$)\\x00\\x00\\x00\\x00\\x02\\x00\\xbe\\x02\\x00\\x00<\\x00\\x00\\x00$!\\x00\\x00L)\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00"
              },
              {
                "name": "Length",
                "value": "60"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000298"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b2990000"
              },
              {
                "name": "SectionOffset",
                "value": "0x97e612b210"
              },
              {
                "name": "ViewSize",
                "value": "0x01260000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef41000"
              },
              {
                "name": "RegionSize",
                "value": "0x00015000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef56000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef55000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef39000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef35000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef55000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef41000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef41000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef35000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff998f00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000ac000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff998f4f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff998f4f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff998f4f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff998f4f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff998f4f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff998f4f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\TextShaping"
              },
              {
                "name": "DllBase",
                "value": "0x7ff998f00000"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\TextShaping"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff998f00000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff998f4a760"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8286000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8286000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef39000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane2"
              },
              {
                "name": "Data",
                "value": "SimSun-ExtB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-06-30 02:36:16,832",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane11"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane12"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane13"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane15"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "Plane16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "4"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "13"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "MingLiU"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MingLiU"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MingLiU_HKSCS"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MingLiU_HKSCS"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "PMingLiU"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\PMingLiU"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "SimSun"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "Segoe UI"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbb57",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000268"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Security.EnterpriseData.ProtectionPolicyManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f8"
              },
              {
                "name": "KeyInformation",
                "value": "5s\\x06\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00E\\x00n\\x00t\\x00e\\x00r\\x00p\\x00r\\x00i\\x00s\\x00e\\x00D\\x00a\\x00t\\x00a\\x00.\\x00P\\x00r\\x00o\\x00t\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x15\\x00\\x08\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffff\\xfff0\\xffae\\x14\\x02\\x00\\x00\\xffe9\\xffde\\x12\\xffe6\\xff97\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\xffe0\\x13\\xffe1\\xffae\\x14\\x02\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe1\\xffae\\x14\\x02\\x00\\x00\\xffc4\\x02\\xffe1\\xffae\\x14\\x02\\x00\\x00\\x00\\x1c\\x00\\x1c\\x14\\x02\\x00\\x00XU\\xff9b\\xffa9\\xfff9\\x7f\\x00\\x00\\xffd8w\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffdf\\x12\\xffe6\\xff97\\x00\\x00\\x00\\xff98kp\\xffa9\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\xffe0\\xffbf\\xfff1\\xffae\\x14\\x02\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\xffb0w\\xfff1\\xffae\\x14\\x02\\x00\\x00\\xffe0\\xffbf\\xfff1\\xffae\\x14\\x02\\x00\\x00\\xffa0\\xff94\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff97\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x03\\xffef\\xffae\\x02\\x00\\x00\\x00\\xffa6Ap\\xffa9\\xfff9\\x7f\\x00\\x00\\xff80i\\xfff3\\xffae\\x14\\x02\\x00\\x00\\xffa0\\xff94\\xfff1\\xffae\\x14\\x02\\x00\\x00Pa\\xfff2\\xffae\\x14\\x02\\x00\\x00Pa\\xfff2\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffbf\\xfff1\\xffae\\x14\\x02\\x00\\x00Pa\\xfff2\\xffae\\x14\\x02\\x00\\x00\\xffd76p\\xffa9\\xfff9\\x7f\\x00\\x000V\\xfff3\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\xffe6\\xff97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000V\\xfff3\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff97\\x00\\x00\\x00\\xffb0\\xffe0\\x12\\xffe6\\xff97\\x00\\x00\\x00\\xffa1Ep\\xffa9\\xfff9\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Server"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\system32\\windows.storage.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Threading"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windows.storage.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6230000"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a6230000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\windows.storage.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a6230000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a6331ee0"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a6230000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a63b2b80"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a6230000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a63b9c50"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 548
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a699a000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a699a000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000268"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f8"
              },
              {
                "name": "KeyInformation",
                "value": "\\xffb0\\xffa6%\\xffce}\\x07\\xffdd\\x01\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00E\\x00n\\x00t\\x00e\\x00r\\x00p\\x00r\\x00i\\x00s\\x00e\\x00D\\x00a\\x00t\\x00a\\x00.\\x00P\\x00r\\x00o\\x00t\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00P\\x00o\\x00l\\x00i\\x00c\\x00y\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00P\\x00r\\x00i\\x00v\\x00a\\x00t\\x00e\\x00P\\x00T\\x00@\\xffff\\xfff0\\xffae\\x14\\x02\\x00\\x00\\xffb9\\xffde\\x12\\xffe6\\xff97\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\xffe0\\x13\\xffe1\\xffae\\x14\\x02\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe1\\xffae\\x14\\x02\\x00\\x00\\xffc4\\x02\\xffe1\\xffae\\x14\\x02\\x00\\x00\\x00\\x1c\\x00\\x1c\\x14\\x02\\x00\\x00XU\\xff9b\\xffa9\\xfff9\\x7f\\x00\\x00\\xffc8\\xff84\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffdf\\x12\\xffe6\\xff97\\x00\\x00\\x00\\xff98kp\\xffa9\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x000\\xff95\\xfff3\\xffae\\x14\\x02\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\xffa0\\xff84\\xfff1\\xffae\\x14\\x02\\x00\\x000\\xff95\\xfff3\\xffae\\x14\\x02\\x00\\x00\\xffe0\\xff8d\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff97\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x03\\xffef\\xffae\\x02\\x00\\x00\\x00\\xffa6Ap\\xffa9\\xfff9\\x7f\\x00\\x00\\xffe0\\xff95\\xfff3\\xffae\\x14\\x02\\x00\\x00\\xffe0\\xff8d\\xfff1\\xffae\\x14\\x02\\x00\\x00p`\\xfff2\\xffae\\x14\\x02\\x00\\x00p`\\xfff2\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xff95\\xfff3\\xffae\\x14\\x02\\x00\\x00p`\\xfff2\\xffae\\x14\\x02\\x00\\x00\\xffd76p\\xffa9\\xfff9\\x7f\\x00\\x00 R\\xfff3\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\xffe6\\xff97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 R\\xfff3\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff97\\x00\\x00\\x00\\xff80\\xffe0\\x12\\xffe6\\xff97\\x00\\x00\\x00\\xffa1Ep\\xffa9\\xfff9\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Server"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\efswrt.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Threading"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xe2\\x12\\xe6\\x97\\x00\\x00\\x00`\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\xff\\xff\\xff\\xff\\xc8\\xd5:\\x87\\xf9\\x7f\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x14;\\x87\\xf9\\x7f\\x00\\x00\\x98\\xe3\\x12\\xe6\\x97\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfb\\xb0F\\xa8\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MPR"
              },
              {
                "name": "DllBase",
                "value": "0x7ff998030000"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-06-30 02:36:16,848",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 570
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a4dc0000"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\efswrt"
              },
              {
                "name": "DllBase",
                "value": "0x7ff987b80000"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\efswrt.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff987b80000"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff987b80000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\efswrt.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "efswrt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff987b80000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff987b85da0"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "efswrt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff987b80000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff987b85bc0"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "efswrt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff987b80000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff987b85b50"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000268"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.ApplicationModel.Core.CoreApplication"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002fc"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff8aX\\x17\\xffce}\\x07\\xffdd\\x01\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00C\\x00o\\x00r\\x00e\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x13\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\xffb3\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffff\\xfff0\\xffae\\x14\\x02\\x00\\x00i\\xffdd\\x12\\xffe6\\xff97\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\xffe0\\x13\\xffe1\\xffae\\x14\\x02\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe1\\xffae\\x14\\x02\\x00\\x00\\xffc4\\x02\\xffe1\\xffae\\x14\\x02\\x00\\x00\\x00\\x1c\\x00\\x1c\\x14\\x02\\x00\\x00XU\\xff9b\\xffa9\\xfff9\\x7f\\x00\\x00\\xff88\\xff82\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffde\\x12\\xffe6\\xff97\\x00\\x00\\x00\\xff98kp\\xffa9\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00`y\\xfff1\\xffae\\x14\\x02\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00`\\xff82\\xfff1\\xffae\\x14\\x02\\x00\\x00`y\\xfff1\\xffae\\x14\\x02\\x00\\x00 \\xff8b\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff97\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x03\\xffef\\xffae\\x02\\x00\\x00\\x00\\xffa6Ap\\xffa9\\xfff9\\x7f\\x00\\x00\\xffb0\\xff95\\xfff3\\xffae\\x14\\x02\\x00\\x00 \\xff8b\\xfff1\\xffae\\x14\\x02\\x00\\x00\\xffb0^\\xfff2\\xffae\\x14\\x02\\x00\\x00\\xffb0^\\xfff2\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`y\\xfff1\\xffae\\x14\\x02\\x00\\x00\\xffb0^\\xfff2\\xffae\\x14\\x02\\x00\\x00\\xffd76p\\xffa9\\xfff9\\x7f\\x00\\x00\\xfff0^\\xfff3\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\xffe6\\xff97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0^\\xfff3\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff97\\x00\\x00\\x000\\xffdf\\x12\\xffe6\\xff97\\x00\\x00\\x00\\xffa1Ep\\xffa9\\xfff9\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\twinapi.appcore.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002fc"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\twinapi.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a10f0000"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\twinapi.appcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a10f0000"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a10f0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\twinapi.appcore.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a10f0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a1142010"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a10f0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a113ead0"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a10f0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a114d8f0"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a12e3000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a12e3000"
              },
              {
                "name": "ModuleName",
                "value": "twinapi.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-06-30 02:36:16,863",
            "thread_id": "772",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0947000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9aaa42ad0"
              },
              {
                "name": "Parameter",
                "value": "0x214aeef0b50"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a114f506",
            "parentcaller": "0x7ff9a11109df",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a97708cd",
            "parentcaller": "0x7ff9a972dd38",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000364"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000268"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Foundation.Collections.PropertySet"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a9770927",
            "parentcaller": "0x7ff9a972dd38",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000364"
              },
              {
                "name": "KeyInformation",
                "value": "<\\x1d\\x1c\\xffce}\\x07\\xffdd\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x0f\\x00\r\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffff\\xfff0\\xffae\\x14\\x02\\x00\\x00Y\\xffebo\\xffe6\\xff97\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc7\\xffb3\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\xffe0\\x13\\xffe1\\xffae\\x14\\x02\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe1\\xffae\\x14\\x02\\x00\\x00\\xffc4\\x02\\xffe1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\xffe1\\xffae\\x14\\x02\\x00\\x00XU\\xff9b\\xffa9\\xfff9\\x7f\\x00\\x00\\xffd8\\xff80\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffeco\\xffe6\\xff97\\x00\\x00\\x00\\xff98kp\\xffa9\\xfff9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00 6\\xfff4\\xffae\\x14\\x02\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa1\\xffaa\\xfff9\\x7f\\x00\\x00\\xffb0\\xff80\\xfff1\\xffae\\x14\\x02\\x00\\x00 6\\xfff4\\xffae\\x14\\x02\\x00\\x00\\xffe0\\xff90\\xfff1\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff97\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\xffe0B\\xfff1\\xffae\\x02\\x00\\x00\\x00\\xffa6Ap\\xffa9\\xfff9\\x7f\\x00\\x00\\xffa0=\\xfff4\\xffae\\x14\\x02\\x00\\x00\\xffe0\\xff90\\xfff1\\xffae\\x14\\x02\\x00\\x00\\xff90_\\xfff2\\xffae\\x14\\x02\\x00\\x00\\xff90_\\xfff2\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 6\\xfff4\\xffae\\x14\\x02\\x00\\x00\\xff90_\\xfff2\\xffae\\x14\\x02\\x00\\x00\\xffd76p\\xffa9\\xfff9\\x7f\\x00\\x00\\xff90U\\xfff3\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00o\\xffe6\\xff97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90U\\xfff3\\xffae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff97\\x00\\x00\\x00 \\xffedo\\xffe6\\xff97\\x00\\x00\\x00\\xffa1Ep\\xffa9\\xfff9\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97807bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a97356ac",
            "parentcaller": "0x7ff9a979b1b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000364"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a975ae1b",
            "parentcaller": "0x7ff9a97792f0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a9774022",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e482",
            "parentcaller": "0x7ff9a976d862",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a976ab76",
            "parentcaller": "0x7ff9a976f113",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a4dc0000"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845ae12",
            "parentcaller": "0x7ff9a972d475",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a4dc0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d3d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a4dc0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a4dc95a0"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d3f0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a4dc0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a4dc9100"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a8470741",
            "parentcaller": "0x7ff9a972d410",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a4dc0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a4dd47c0"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9aaa37820",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a4efc000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9aaa37871",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a4efc000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a96de87e",
            "parentcaller": "0x7ff9a970ced5",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 632
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a1119434",
            "parentcaller": "0x7ff9a1118f96",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a11194af",
            "parentcaller": "0x7ff9a1118f96",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xf0\\xee\\xf3\\xae\\x14\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18\\xef\\xf3\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xef\\xf3\\xae\\x14\\x02\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8 \\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845ef7c",
            "parentcaller": "0x7ff9a845eb19",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 635
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845fd34",
            "parentcaller": "0x7ff9a845f960",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845f984",
            "parentcaller": "0x7ff9a845eb81",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000364"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\XAML"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\XAML"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e5d4",
            "parentcaller": "0x7ff9a115164d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "ValueName",
                "value": "OneCoreTransformsEnabledByDefault"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a845e608",
            "parentcaller": "0x7ff9a115164d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9a8462d8a",
            "parentcaller": "0x7ff9a970b7c6",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a9530000"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9aaa37820",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-06-30 02:36:16,879",
            "thread_id": "772",
            "caller": "0x7ff9aaa37871",
            "parentcaller": "0x7ff9aaa220f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000035a"
              },
              {
                "name": "SubKey",
                "value": "AppID\\NOTEPAD.EXE"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\NOTEPAD.EXE"
              }
            ],
            "repeated": 1,
            "id": 657
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "RaiseDefaultAuthnLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "DefaultAccessPermission"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\xc4\\xef\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00002100"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000013c4"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.COM.DISABLE.5060"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.IEC.STATUS.6c736db0"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000035a"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{00000134-0000-0000-C000-000000000046}"
              },
              {
                "name": "Handle",
                "value": "0x00000376"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000376"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000037a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037a"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000376"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000374"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xc7\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xcc\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xc4\\xef\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8^\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00f\\xf8r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00p\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00h\\xd8\\x12\\xe6\\x97\\x00\\x00\\x008\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00X\\xd8\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0^\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xd6\\x12\\xe6\\x97\\x00\\x00\\x00x\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xc8\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xcb\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xc4\\xef\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8]\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xc6\\xfbr\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xd0\\xd4\\x12\\xe6\\x97\\x00\\x00\\x00\\xc8\\xd4\\x12\\xe6\\x97\\x00\\x00\\x00\\x98\\xd4\\x12\\xe6\\x97\\x00\\x00\\x00\\xb8\\xd4\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0]\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xd2\\x12\\xe6\\x97\\x00\\x00\\x00x\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-06-30 02:36:16,895",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000037c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff9a977adb0"
              },
              {
                "name": "Parameter",
                "value": "0x214aef18a20"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "4764"
              },
              {
                "name": "ProcessId",
                "value": "5060"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000037c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff9a977adb0"
              },
              {
                "name": "Parameter",
                "value": "0x214aef18a20"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "4764"
              },
              {
                "name": "ProcessId",
                "value": "5060"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000037c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xcb\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xca\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\x11\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8a\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00V\\xe4r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00@\\xdc\\x12\\xe6\\x97\\x00\\x00\\x008\\xdc\\x12\\xe6\\x97\\x00\\x00\\x00\\x08\\xdc\\x12\\xe6\\x97\\x00\\x00\\x00(\\xdc\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0a\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xda\\x12\\xe6\\x97\\x00\\x00\\x00\\x88\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xce\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xd0\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x10\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "8b\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xb6\\xe7r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xa0\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00\\x98\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00h\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00\\x88\\xd8\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000b\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xd6\\x12\\xe6\\x97\\x00\\x00\\x00\\x88\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000388"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xd2\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xd2\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\x0e\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8a\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00V\\xe4r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00@\\xdc\\x12\\xe6\\x97\\x00\\x00\\x008\\xdc\\x12\\xe6\\x97\\x00\\x00\\x00\\x08\\xdc\\x12\\xe6\\x97\\x00\\x00\\x00(\\xdc\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0a\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xda\\x12\\xe6\\x97\\x00\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xc7\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00h\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xcb\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00v\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "(\\x10\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xb6\\xe7r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xa0\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00\\x98\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00h\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00\\x88\\xd8\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xd6\\x12\\xe6\\x97\\x00\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000037c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xcf\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xcb\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00v\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\x11\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98_\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00V\\xe4r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00@\\xdc\\x12\\xe6\\x97\\x00\\x00\\x008\\xdc\\x12\\xe6\\x97\\x00\\x00\\x00\\x08\\xdc\\x12\\xe6\\x97\\x00\\x00\\x00(\\xdc\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90_\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xda\\x12\\xe6\\x97\\x00\\x00\\x00\\x88\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xd1\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xcb\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\r\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "x`\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xb6\\xe7r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xa0\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00\\x98\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00h\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00\\x88\\xd8\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p`\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xd6\\x12\\xe6\\x97\\x00\\x00\\x00\\x88\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000388"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xd3\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00h\\x00\\\\x00A\\x00p\\x00p\\x00D\\x00a\\x00t\\x00a\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00\\\\x00T\\x00e\\x00m\\x00p\\x00"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xc4\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "X\r\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8b\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00V\\xe4r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00@\\xdc\\x12\\xe6\\x97\\x00\\x00\\x008\\xdc\\x12\\xe6\\x97\\x00\\x00\\x00\\x08\\xdc\\x12\\xe6\\x97\\x00\\x00\\x00(\\xdc\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0b\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xda\\x12\\xe6\\x97\\x00\\x00\\x00\\x8c\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xd1\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xca\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 795
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\x0f\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xb6\\xe7r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xa0\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00\\x98\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00h\\xd8\\x12\\xe6\\x97\\x00\\x00\\x00\\x88\\xd8\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xd6\\x12\\xe6\\x97\\x00\\x00\\x00\\x8c\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 801
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "772",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a9c24a33",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000388"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "4688",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "4688",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9aaa42ad0"
              },
              {
                "name": "Parameter",
                "value": "0x214aeef0b50"
              }
            ],
            "repeated": 0,
            "id": 806
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000035a"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{C50898F6-C536-5F47-8583-8B2C2438A13B}"
              },
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{C50898F6-C536-5F47-8583-8B2C2438A13B}"
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000037e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{c50898f6-c536-5f47-8583-8b2c2438a13b}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{c50898f6-c536-5f47-8583-8b2c2438a13b}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              }
            ],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000256"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}"
              },
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}"
              }
            ],
            "repeated": 0,
            "id": 812
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 813
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\xc2\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x97\\x00\\x00\\x00\\xe0\\xc3\\x12\\xe6\\x97\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000037e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 821
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Ptype_PSFactory"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000037e"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 824
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-06-30 02:36:16,910",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc1\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x97\\x00\\x00\\x00p\\xc2\\x12\\xe6\\x97\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 831
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000037e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 836
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc1\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x97\\x00\\x00\\x00p\\xc2\\x12\\xe6\\x97\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 839
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000037e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000256"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}"
              },
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 845
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 846
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xbf\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x97\\x00\\x00\\x00\\xa0\\xc0\\x12\\xe6\\x97\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 847
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 848
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 849
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000037e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 850
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 851
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 852
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 853
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Ptype_PSFactory"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 854
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000037e"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 855
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 856
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 857
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 858
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 859
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              }
            ],
            "repeated": 0,
            "id": 860
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 861
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 862
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xbe\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x97\\x00\\x00\\x000\\xbf\\x12\\xe6\\x97\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 863
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 864
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 865
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000037e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 866
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 867
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 868
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xbe\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x97\\x00\\x00\\x000\\xbf\\x12\\xe6\\x97\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 869
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 870
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 871
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000037e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 872
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000037e"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 873
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 874
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 875
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 876
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xbd\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf9\\x7f\\x00\\x00\\xe8#;\\x87\\xf9\\x7f\\x00\\x00~\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10';\\x87\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x97\\x00\\x00\\x00p\\xbe\\x12\\xe6\\x97\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 877
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 878
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 879
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000037e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 880
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000256"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}"
              },
              {
                "name": "Handle",
                "value": "0x00000396"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}"
              }
            ],
            "repeated": 0,
            "id": 881
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000396"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 882
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000396"
              }
            ],
            "repeated": 0,
            "id": 883
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              }
            ],
            "repeated": 0,
            "id": 884
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000035a"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}"
              },
              {
                "name": "Handle",
                "value": "0x0000037e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}"
              }
            ],
            "repeated": 0,
            "id": 885
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000037e"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 886
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037e"
              }
            ],
            "repeated": 0,
            "id": 887
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 888
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 889
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 890
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000037c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 891
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 892
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 893
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xca\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 894
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xd1\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00v\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 895
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 896
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "(\\x10\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 897
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 898
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "h]\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 899
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xe6\\xe6r\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xf0\\xd9\\x12\\xe6\\x97\\x00\\x00\\x00\\xe8\\xd9\\x12\\xe6\\x97\\x00\\x00\\x00\\xb8\\xd9\\x12\\xe6\\x97\\x00\\x00\\x00\\xd8\\xd9\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 900
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`]\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xd7\\x12\\xe6\\x97\\x00\\x00\\x00\\x94\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 901
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe7 \\x1d\\x00\\x00\\x00\\x00\\x00\\x8aI\n\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x96I\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 902
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xc4\\xf3\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 903
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xcb\\xf3\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 904
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 905
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\x0e\\xf5\\xae\\x14\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 906
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 907
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8`\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02I\n\\x00"
              }
            ],
            "repeated": 0,
            "id": 908
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00F\\xfar\\x04v)\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00P\\xd6\\x12\\xe6\\x97\\x00\\x00\\x00H\\xd6\\x12\\xe6\\x97\\x00\\x00\\x00\\x18\\xd6\\x12\\xe6\\x97\\x00\\x00\\x008\\xd6\\x12\\xe6"
              }
            ],
            "repeated": 0,
            "id": 909
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0`\\xf2\\xae\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xd4\\x12\\xe6\\x97\\x00\\x00\\x00\\x94\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 910
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 911
          },
          {
            "timestamp": "2026-06-30 02:36:16,926",
            "thread_id": "3940",
            "caller": "0x7ff737de3ac5",
            "parentcaller": "0x7ff737dd4001",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 912
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff994050000"
              }
            ],
            "repeated": 0,
            "id": 913
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff994050000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 914
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940d5680"
              }
            ],
            "repeated": 0,
            "id": 915
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 916
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b3bf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 917
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b3bf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 918
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99429a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 919
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99429a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 920
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 921
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 922
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99429a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 923
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99429a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 924
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 925
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 926
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 927
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 928
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 929
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              }
            ],
            "repeated": 0,
            "id": 930
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "PreferExternalManifest"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest"
              }
            ],
            "repeated": 0,
            "id": 931
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 932
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll.Config"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 933
          },
          {
            "timestamp": "2026-06-30 02:36:16,941",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000394"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 934
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 935
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff994050000"
              }
            ],
            "repeated": 0,
            "id": 936
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff994050000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 937
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0aa0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 938
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 939
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "HIMAGELIST_QueryInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940cfa30"
              }
            ],
            "repeated": 0,
            "id": 940
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "DrawShadowText"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff99414d0d0"
              }
            ],
            "repeated": 0,
            "id": 941
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "DrawSizeBox"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940df790"
              }
            ],
            "repeated": 0,
            "id": 942
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "DrawScrollBar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940c0d30"
              }
            ],
            "repeated": 0,
            "id": 943
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "SizeBoxHwnd"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940c52e0"
              }
            ],
            "repeated": 0,
            "id": 944
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "ScrollBar_MouseMove"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9941422d0"
              }
            ],
            "repeated": 0,
            "id": 945
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "ScrollBar_Menu"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9941420e0"
              }
            ],
            "repeated": 0,
            "id": 946
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "HandleScrollCmd"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff994142040"
              }
            ],
            "repeated": 0,
            "id": 947
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "DetachScrollBars"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff994052450"
              }
            ],
            "repeated": 0,
            "id": 948
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "AttachScrollBars"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940c7160"
              }
            ],
            "repeated": 0,
            "id": 949
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "CCSetScrollInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940c2240"
              }
            ],
            "repeated": 0,
            "id": 950
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "CCGetScrollInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940dbcd0"
              }
            ],
            "repeated": 0,
            "id": 951
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "CCEnableScrollBar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff994052840"
              }
            ],
            "repeated": 0,
            "id": 952
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "QuerySystemGestureStatus"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9941420a0"
              }
            ],
            "repeated": 0,
            "id": 953
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 954
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000068"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 955
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000006c"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 956
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 957
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000026"
              },
              {
                "name": "uiParam",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 958
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000103e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 959
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001042"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 960
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000001b"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 961
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99429a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 962
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99429a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 963
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:120:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 964
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 965
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 966
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 967
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 968
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 969
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a0"
              }
            ],
            "repeated": 0,
            "id": 970
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 971
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 972
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 973
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000398"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 974
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "TurnOffSPIAnimations"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations"
              }
            ],
            "repeated": 0,
            "id": 975
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 976
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000398"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 977
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              },
              {
                "name": "ValueName",
                "value": "TurnOffSPIAnimations"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations"
              }
            ],
            "repeated": 0,
            "id": 978
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 979
          },
          {
            "timestamp": "2026-06-30 02:36:16,957",
            "thread_id": "3940",
            "caller": "0x7ff737dd41b3",
            "parentcaller": "0x7ff737dcc29e",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0b17000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 980
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de2479",
            "parentcaller": "0x7ff737dd3a21",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\oleacc"
              },
              {
                "name": "DllBase",
                "value": "0x7ff992900000"
              }
            ],
            "repeated": 0,
            "id": 981
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de2479",
            "parentcaller": "0x7ff737dd3a21",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\oleacc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff992900000"
              }
            ],
            "repeated": 0,
            "id": 982
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de2479",
            "parentcaller": "0x7ff737dd3a21",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "OLEAUT32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9530000"
              }
            ],
            "repeated": 0,
            "id": 983
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de2479",
            "parentcaller": "0x7ff737dd3a21",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B5F8350B-0548-48B1-A6EE-88BD00B4A5E7"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "6E26E776-04F0-495D-80E4-3330352E3169"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 984
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd3a21",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99295d000"
              },
              {
                "name": "ModuleName",
                "value": "oleacc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 985
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd3a21",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99295d000"
              },
              {
                "name": "ModuleName",
                "value": "oleacc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 986
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd3a21",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a95f8000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 987
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd3a21",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a95f8000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 988
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd3a21",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2ee00000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 989
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd3a21",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99295d000"
              },
              {
                "name": "ModuleName",
                "value": "oleacc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 990
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd3a21",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99295d000"
              },
              {
                "name": "ModuleName",
                "value": "oleacc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 991
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd3a21",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MSAA_*FCFFFFFF00000000"
              },
              {
                "name": "Atom",
                "value": "0x0000c043"
              }
            ],
            "repeated": 0,
            "id": 992
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737dd425a",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff994050000"
              }
            ],
            "repeated": 0,
            "id": 993
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737dd425a",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff994050000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 994
          },
          {
            "timestamp": "2026-06-30 02:36:16,988",
            "thread_id": "3940",
            "caller": "0x7ff737dd425a",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff994050000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9940d5680"
              }
            ],
            "repeated": 0,
            "id": 995
          },
          {
            "timestamp": "2026-06-30 02:36:17,004",
            "thread_id": "3940",
            "caller": "0x7ff737dd425a",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 996
          },
          {
            "timestamp": "2026-06-30 02:36:17,004",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd4270",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2ee10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 997
          },
          {
            "timestamp": "2026-06-30 02:36:17,004",
            "thread_id": "3940",
            "caller": "0x7ff737de24be",
            "parentcaller": "0x7ff737dd4270",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MSAA_*FCFFFFFF00000000"
              },
              {
                "name": "Atom",
                "value": "0x0000c043"
              }
            ],
            "repeated": 0,
            "id": 998
          },
          {
            "timestamp": "2026-06-30 02:36:17,004",
            "thread_id": "3940",
            "caller": "0x7ff737dd3adb",
            "parentcaller": "0x7ff737dd42a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 999
          },
          {
            "timestamp": "2026-06-30 02:36:17,004",
            "thread_id": "3940",
            "caller": "0x7ff737dd3adb",
            "parentcaller": "0x7ff737dd42a3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9dd7000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1000
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 1001
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 1002
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 1003
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\NOTEPAD.EXE"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\NOTEPAD.EXE"
              }
            ],
            "repeated": 0,
            "id": 1004
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9239000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1005
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9239000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1006
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9239000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1007
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9239000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1008
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 1009
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 1010
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49245"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1011
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49246"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1012
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 1013
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 1,
            "id": 1014
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 1015
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.Asm.MutexDefault2"
              }
            ],
            "repeated": 0,
            "id": 1016
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1017
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "2000"
              }
            ],
            "repeated": 0,
            "id": 1018
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000394"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Local\\CTF.AsmListCache.FMPDefault2"
              }
            ],
            "repeated": 0,
            "id": 1019
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000394"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0ab0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x97e612cb70"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1020
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0ab0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1021
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 1022
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 1023
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 1024
          },
          {
            "timestamp": "2026-06-30 02:36:17,035",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\NOTEPAD.EXE"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\NOTEPAD.EXE"
              }
            ],
            "repeated": 0,
            "id": 1025
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 1026
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 1027
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "MutexName",
                "value": "CicLoadWinStaWinSta0"
              }
            ],
            "repeated": 0,
            "id": 1028
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1029
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.CtfMonitorInstMutexDefault2"
              }
            ],
            "repeated": 0,
            "id": 1030
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1031
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1032
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1033
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              }
            ],
            "repeated": 0,
            "id": 1034
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "ValueName",
                "value": "LaunchUserOOBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE"
              }
            ],
            "repeated": 0,
            "id": 1035
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1036
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1037
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1038
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1039
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1040
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1041
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              }
            ],
            "repeated": 0,
            "id": 1042
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "ValueName",
                "value": "LaunchUserOOBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE"
              }
            ],
            "repeated": 0,
            "id": 1043
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 1044
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1045
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa9f93b0"
              }
            ],
            "repeated": 0,
            "id": 1046
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8f9b0"
              }
            ],
            "repeated": 0,
            "id": 1047
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa32450"
              }
            ],
            "repeated": 0,
            "id": 1048
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 1049
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa4cb70"
              }
            ],
            "repeated": 0,
            "id": 1050
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa53330"
              }
            ],
            "repeated": 0,
            "id": 1051
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1052
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1053
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1054
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1055
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1056
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1057
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 1058
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 1059
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 1060
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 1061
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1062
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 1063
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 1064
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1065
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextInputFramework.dll"
              }
            ],
            "repeated": 0,
            "id": 1066
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bc00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1067
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1068
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcba000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1069
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcba000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1070
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcba000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1071
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcba000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1072
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcba000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1073
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 1074
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 1075
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 1076
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 1077
          },
          {
            "timestamp": "2026-06-30 02:36:17,051",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 1078
          },
          {
            "timestamp": "2026-06-30 02:36:17,066",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1079
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 1080
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5490000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0035e000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1081
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a579f000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1082
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a564a000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1083
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a564a000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1084
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a564a000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1085
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a564a000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1086
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a564a000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1087
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 1088
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 1089
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 1090
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 1091
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 1092
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1093
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 1094
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a57f0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1095
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1096
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5886000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1097
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5886000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1098
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5886000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1099
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5886000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1100
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5886000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1101
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 1102
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 1103
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 1104
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1105
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 1106
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00033000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1107
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e30000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1108
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e24000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1109
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e24000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1110
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e24000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1111
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e24000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1112
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e24000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1113
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 1114
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 1115
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 1116
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcba000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1117
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5886000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1118
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e24000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1119
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a564a000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1120
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@F\\xf2\\xae\\x14\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x14\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00M\\x00e\\x00s\\x00s\\x00"
              }
            ],
            "repeated": 0,
            "id": 1121
          },
          {
            "timestamp": "2026-06-30 02:36:17,082",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a6e00000"
              }
            ],
            "repeated": 0,
            "id": 1122
          },
          {
            "timestamp": "2026-06-30 02:36:17,098",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a57f0000"
              }
            ],
            "repeated": 0,
            "id": 1123
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a5490000"
              }
            ],
            "repeated": 0,
            "id": 1124
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99bc00000"
              }
            ],
            "repeated": 0,
            "id": 1125
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\ntmarta"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6e00000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a6e06930"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1126
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a57f0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a5847480"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1127
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0948000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1128
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a5490000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a5512fe0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1129
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\TextInputFramework"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bc00000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff99bc3e070"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1130
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1131
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1132
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\AppCompatClassName"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\AppCompatClassName"
              }
            ],
            "repeated": 0,
            "id": 1133
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000001"
              },
              {
                "name": "EventName",
                "value": "Local\\2ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 1134
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 1135
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1136
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1137
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\"
              },
              {
                "name": "Handle",
                "value": "0x000003b0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\"
              }
            ],
            "repeated": 0,
            "id": 1138
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              },
              {
                "name": "ValueName",
                "value": "EnableAnchorContext"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext"
              }
            ],
            "repeated": 0,
            "id": 1139
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 1140
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0949000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1141
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1142
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b3f70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00800000"
              },
              {
                "name": "Protection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1143
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1144
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "58"
              }
            ],
            "repeated": 0,
            "id": 1145
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000003e4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1146
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef5f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1147
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b094a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1148
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1149
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef61000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1150
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000040c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1151
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef63000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1152
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 1153
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1154
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 1155
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9aa760000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1156
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "IsGUIThread"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa7884b0"
              }
            ],
            "repeated": 0,
            "id": 1157
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1158
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1159
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa9f93b0"
              }
            ],
            "repeated": 0,
            "id": 1160
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8f9b0"
              }
            ],
            "repeated": 0,
            "id": 1161
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa32450"
              }
            ],
            "repeated": 0,
            "id": 1162
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 1163
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa4cb70"
              }
            ],
            "repeated": 0,
            "id": 1164
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa53330"
              }
            ],
            "repeated": 0,
            "id": 1165
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1166
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1167
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1168
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1169
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1170
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1171
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 1172
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 1173
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 1174
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 1175
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1176
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa767250"
              }
            ],
            "repeated": 0,
            "id": 1177
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1178
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1179
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "CreateWindowExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa7676b0"
              }
            ],
            "repeated": 0,
            "id": 1180
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1181
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1182
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "DefWindowProcW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8ca40"
              }
            ],
            "repeated": 0,
            "id": 1183
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1184
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1185
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "SetWindowLongPtrW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa76b750"
              }
            ],
            "repeated": 0,
            "id": 1186
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1187
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1188
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "SetTimer"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa784070"
              }
            ],
            "repeated": 0,
            "id": 1189
          },
          {
            "timestamp": "2026-06-30 02:36:17,113",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1190
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1191
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 1192
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9aa760000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1193
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2612"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa78bf10"
              }
            ],
            "repeated": 0,
            "id": 1194
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1195
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1196
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetWindowLongPtrW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa76f7c0"
              }
            ],
            "repeated": 0,
            "id": 1197
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1198
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1199
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetWindowThreadProcessId"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa763500"
              }
            ],
            "repeated": 0,
            "id": 1200
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1201
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1202
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "SendMessageCallbackW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa788280"
              }
            ],
            "repeated": 0,
            "id": 1203
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1204
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b4770000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1205
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b4770000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1206
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000418"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1207
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef64000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1208
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1209
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-com-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a96b0000"
              }
            ],
            "repeated": 0,
            "id": 1210
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a96b0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-com-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1211
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a96b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateGuid"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a97316e0"
              }
            ],
            "repeated": 0,
            "id": 1212
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1213
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1214
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1215
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b3f70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1216
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1217
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2582"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa7874e0"
              }
            ],
            "repeated": 0,
            "id": 1218
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1219
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b4772000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1220
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1221
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "srand",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "seed",
                "value": "0x6a432ba1"
              }
            ],
            "repeated": 0,
            "id": 1222
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1223
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1224
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa9f93b0"
              }
            ],
            "repeated": 0,
            "id": 1225
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8f9b0"
              }
            ],
            "repeated": 0,
            "id": 1226
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa32450"
              }
            ],
            "repeated": 0,
            "id": 1227
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 1228
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa4cb70"
              }
            ],
            "repeated": 0,
            "id": 1229
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa53330"
              }
            ],
            "repeated": 0,
            "id": 1230
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:5060:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1231
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1232
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1233
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1234
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1235
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1236
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1237
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1238
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 1239
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 1240
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              },
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              }
            ],
            "repeated": 0,
            "id": 1241
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "IsVailContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer"
              }
            ],
            "repeated": 0,
            "id": 1242
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1243
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Input"
              },
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Input"
              }
            ],
            "repeated": 0,
            "id": 1244
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "ResyncResetTime"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime"
              }
            ],
            "repeated": 0,
            "id": 1245
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "MaxResyncAttempts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts"
              }
            ],
            "repeated": 0,
            "id": 1246
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1247
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1248
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1249
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef66000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1250
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1251
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1252
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1253
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1254
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1255
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99bcf4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1256
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef68000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1257
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1258
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9b21000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1259
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "iertutil.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x4031c471a94c5fd2"
              }
            ],
            "repeated": 0,
            "id": 1260
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x97e612d900"
              },
              {
                "name": "EventName",
                "value": "Local\\2ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 1261
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dd4455",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 1262
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbabc",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 1263
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbabc",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#32512"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1264
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbabc",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "Type",
                "value": "#22"
              },
              {
                "name": "Name",
                "value": "#32512"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1265
          },
          {
            "timestamp": "2026-06-30 02:36:17,129",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcbabc",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef6a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1266
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msctf.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9a10000"
              }
            ],
            "repeated": 0,
            "id": 1267
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a9a10000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\MSCTF.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 1268
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x97e612d8f0"
              },
              {
                "name": "EventName",
                "value": "Local\\2ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 1269
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcba89",
            "parentcaller": "0x7ff737dcbabc",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 4,
            "id": 1270
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002006"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1271
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 1272
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002006"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1273
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 1274
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xd3\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x97\\x00\\x00\\x00@\\xd9\\x12\\xe6\\x97\\x00\\x00\\x00\\xc0d \\x87\\xf9\\x7f\\x00\\x00p+\\xaf\\xa9\\xf9\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1275
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 1276
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000434"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\CTF\\DirectSwitchHotkeys"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys"
              }
            ],
            "repeated": 0,
            "id": 1277
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1278
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\CTF\\DirectSwitchHotkeys\\"
              }
            ],
            "repeated": 0,
            "id": 1279
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1280
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dcbabc",
            "parentcaller": "0x7ff737dcbabc",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x97e612d8f0"
              },
              {
                "name": "EventName",
                "value": "Local\\2ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 1281
          },
          {
            "timestamp": "2026-06-30 02:36:17,145",
            "thread_id": "3940",
            "caller": "0x7ff737dc9197",
            "parentcaller": "0x7ff737dcbb3f",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 2,
            "id": 1282
          },
          {
            "timestamp": "2026-06-30 02:36:17,160",
            "thread_id": "3940",
            "caller": "0x7ff737dd2e33",
            "parentcaller": "0x7ff737dd459b",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x214aef60960",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x7d1ecff6"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dd0812"
              }
            ],
            "repeated": 0,
            "id": 1283
          },
          {
            "timestamp": "2026-06-30 02:36:17,160",
            "thread_id": "3940",
            "caller": "0x7ff737dd2e48",
            "parentcaller": "0x7ff737dd459b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1284
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737dd45ca",
            "parentcaller": "0x7ff737dcc29e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1285
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737dd0f8f",
            "parentcaller": "0x7ff737dd46c5",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000430"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "FileInformationClass",
                "value": "18",
                "pretty_value": "FileAllInformation"
              },
              {
                "name": "FileInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1286
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1287
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "urlmon.dll"
              }
            ],
            "repeated": 0,
            "id": 1288
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\urlmon.dll"
              }
            ],
            "repeated": 0,
            "id": 1289
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\urlmon.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1290
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\urlmon.dll"
              }
            ],
            "repeated": 0,
            "id": 1291
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000434"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f930000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x001eb000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1292
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fac4000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1293
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fa73000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1294
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fa73000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1295
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fa73000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1296
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fa73000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1297
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fa72000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1298
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "iertutil.dll"
              }
            ],
            "repeated": 0,
            "id": 1299
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "srvcli.dll"
              }
            ],
            "repeated": 0,
            "id": 1300
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "netutils.dll"
              }
            ],
            "repeated": 0,
            "id": 1301
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1302
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1303
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\iertutil.dll"
              }
            ],
            "repeated": 0,
            "id": 1304
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\iertutil.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1305
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\iertutil.dll"
              }
            ],
            "repeated": 0,
            "id": 1306
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000434"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f680000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x002b0000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1307
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f915000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1308
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f7d4000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1309
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f7d4000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1310
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f7d4000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1311
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f7d4000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1312
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f7d3000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1313
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1314
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1315
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef6b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1316
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\srvcli.dll"
              }
            ],
            "repeated": 0,
            "id": 1317
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\srvcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1318
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\srvcli.dll"
              }
            ],
            "repeated": 0,
            "id": 1319
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000434"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f650000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00028000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1320
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f675000"
              },
              {
                "name": "ModuleName",
                "value": "srvcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1321
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f664000"
              },
              {
                "name": "ModuleName",
                "value": "srvcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1322
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f664000"
              },
              {
                "name": "ModuleName",
                "value": "srvcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1323
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f664000"
              },
              {
                "name": "ModuleName",
                "value": "srvcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1324
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f664000"
              },
              {
                "name": "ModuleName",
                "value": "srvcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1325
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f664000"
              },
              {
                "name": "ModuleName",
                "value": "srvcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1326
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1327
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1328
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\netutils.dll"
              }
            ],
            "repeated": 0,
            "id": 1329
          },
          {
            "timestamp": "2026-06-30 02:36:17,176",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\netutils.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1330
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\netutils.dll"
              }
            ],
            "repeated": 0,
            "id": 1331
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000434"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a75f0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1332
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a75f6000"
              },
              {
                "name": "ModuleName",
                "value": "netutils.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1333
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a75f6000"
              },
              {
                "name": "ModuleName",
                "value": "netutils.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1334
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a75f6000"
              },
              {
                "name": "ModuleName",
                "value": "netutils.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1335
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a75f6000"
              },
              {
                "name": "ModuleName",
                "value": "netutils.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1336
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a75f6000"
              },
              {
                "name": "ModuleName",
                "value": "netutils.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1337
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1338
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1339
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f7d3000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1340
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1341
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f664000"
              },
              {
                "name": "ModuleName",
                "value": "srvcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1342
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fa72000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1343
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xdd\\xef\\xae\\x14\\x02\\x00\\x00d\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x000+\\xef\\xae\\x14\\x02\\x00\\x00\\xa4\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00pU\\xef\\xae\\x14\\x02\\x00\\x00\\x10\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x89\\xef\\xae\\x14\\x02\\x00\\x00\\x1c\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0M\\xef\\xae\\x14\\x02\\x00\\x00\\xa0\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc8\\xf1\\xae\\x14\\x02\\x00\\x00\\x04\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xe6\\xf4\\xae\\x14\\x02\\x00\\x00\\x9c\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xf4\\xae\\x14\\x02\\x00\\x00P\\x12\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1344
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a75f6000"
              },
              {
                "name": "ModuleName",
                "value": "netutils.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1345
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\iertutil"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99f680000"
              }
            ],
            "repeated": 0,
            "id": 1346
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\srvcli"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99f650000"
              }
            ],
            "repeated": 0,
            "id": 1347
          },
          {
            "timestamp": "2026-06-30 02:36:17,191",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a75f0000"
              }
            ],
            "repeated": 0,
            "id": 1348
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\urlmon"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99f930000"
              }
            ],
            "repeated": 0,
            "id": 1349
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 5,
            "id": 1350
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1351
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsMultiSessionSku"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa30200"
              }
            ],
            "repeated": 0,
            "id": 1352
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\iertutil"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f680000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff99f6b71b0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1353
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters"
              },
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters"
              }
            ],
            "repeated": 0,
            "id": 1354
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "RpcCacheTimeout"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\LanmanWorkstation\\Parameters\\RpcCacheTimeout"
              }
            ],
            "repeated": 0,
            "id": 1355
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 1356
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\srvcli"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f650000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff99f652110"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1357
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\netutils"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a75f0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a75f1ce0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1358
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aeec1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1359
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1360
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsMultiSessionSku"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa30200"
              }
            ],
            "repeated": 0,
            "id": 1361
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fac4000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1362
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99fac4000"
              },
              {
                "name": "ModuleName",
                "value": "urlmon.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1363
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\urlmon"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f930000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff99f9afc30"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1364
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff737df7000"
              },
              {
                "name": "ModuleName",
                "value": "NOTEPAD.EXE"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1365
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de71fa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff737df7000"
              },
              {
                "name": "ModuleName",
                "value": "NOTEPAD.EXE"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1366
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1367
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetDeviceFamilyInfoEnum"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa2f840"
              }
            ],
            "repeated": 0,
            "id": 1368
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000400",
                "pretty_value": "PROCESS_QUERY_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "5060"
              }
            ],
            "repeated": 0,
            "id": 1369
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1370
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1371
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1372
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1373
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f915000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1374
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99f915000"
              },
              {
                "name": "ModuleName",
                "value": "iertutil.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1375
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1376
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1377
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xfe\\xf5\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\\\x00W\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1378
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1379
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000400",
                "pretty_value": "PROCESS_QUERY_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "5060"
              }
            ],
            "repeated": 0,
            "id": 1380
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1381
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1382
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x03\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1383
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1384
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1385
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xdd\\x12\\xe6\\x97\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00`\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc5\\xa3E\\xa8\\xf9\\x7f\\x00\\x00`\\x04\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1386
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1387
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 1388
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9aa760000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "user32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1389
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "IsImmersiveProcess"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa789a30"
              }
            ],
            "repeated": 0,
            "id": 1390
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "misc",
            "api": "GlobalMemoryStatusEx",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MemoryLoad",
                "value": "48"
              },
              {
                "name": "TotalPhysicalMB",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 1391
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 1392
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows"
              }
            ],
            "repeated": 0,
            "id": 1393
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "35"
              }
            ],
            "repeated": 0,
            "id": 1394
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Internet Explorer\\Main"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main"
              }
            ],
            "repeated": 0,
            "id": 1395
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "FrameTabWindow"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameTabWindow"
              }
            ],
            "repeated": 0,
            "id": 1396
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Internet Explorer\\Main"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main"
              }
            ],
            "repeated": 0,
            "id": 1397
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "FrameTabWindow"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameTabWindow"
              }
            ],
            "repeated": 0,
            "id": 1398
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "FrameMerging"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameMerging"
              }
            ],
            "repeated": 0,
            "id": 1399
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "FrameMerging"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameMerging"
              }
            ],
            "repeated": 0,
            "id": 1400
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "SessionMerging"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\SessionMerging"
              }
            ],
            "repeated": 0,
            "id": 1401
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "SessionMerging"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\SessionMerging"
              }
            ],
            "repeated": 0,
            "id": 1402
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "AdminTabProcs"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\AdminTabProcs"
              }
            ],
            "repeated": 0,
            "id": 1403
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "AdminTabProcs"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\AdminTabProcs"
              }
            ],
            "repeated": 0,
            "id": 1404
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 1405
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1406
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xfe\\xf5\\xae\\x14\\x02\\x00\\x00`\\x00\\x00\\x00\\\\x00W\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1407
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 1408
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 1409
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x03\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1410
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 1411
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Internet Explorer\\Security"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security"
              }
            ],
            "repeated": 0,
            "id": 1412
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "RunBinaryControlHostProcessInSeparateAppContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Security\\RunBinaryControlHostProcessInSeparateAppContainer"
              }
            ],
            "repeated": 0,
            "id": 1413
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Internet Explorer\\Security"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Security"
              }
            ],
            "repeated": 0,
            "id": 1414
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "RunBinaryControlHostProcessInSeparateAppContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Security\\RunBinaryControlHostProcessInSeparateAppContainer"
              }
            ],
            "repeated": 0,
            "id": 1415
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main"
              }
            ],
            "repeated": 0,
            "id": 1416
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef6d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1417
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main"
              }
            ],
            "repeated": 0,
            "id": 1418
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "TabProcGrowth"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth"
              }
            ],
            "repeated": 0,
            "id": 1419
          },
          {
            "timestamp": "2026-06-30 02:36:17,207",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "TabProcGrowth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth"
              }
            ],
            "repeated": 0,
            "id": 1420
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "TabProcGrowth"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth"
              }
            ],
            "repeated": 0,
            "id": 1421
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "TabProcGrowth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth"
              }
            ],
            "repeated": 0,
            "id": 1422
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              }
            ],
            "repeated": 0,
            "id": 1423
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "CreateUriCacheSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize"
              }
            ],
            "repeated": 0,
            "id": 1424
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              }
            ],
            "repeated": 0,
            "id": 1425
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "CreateUriCacheSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize"
              }
            ],
            "repeated": 0,
            "id": 1426
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              }
            ],
            "repeated": 0,
            "id": 1427
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "CreateUriCacheSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize"
              }
            ],
            "repeated": 0,
            "id": 1428
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              }
            ],
            "repeated": 0,
            "id": 1429
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "CreateUriCacheSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize"
              }
            ],
            "repeated": 0,
            "id": 1430
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "EnablePunycode"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode"
              }
            ],
            "repeated": 0,
            "id": 1431
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "EnablePunycode"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode"
              }
            ],
            "repeated": 0,
            "id": 1432
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "EnablePunycode"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode"
              }
            ],
            "repeated": 0,
            "id": 1433
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "EnablePunycode"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode"
              }
            ],
            "repeated": 0,
            "id": 1434
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1435
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000c0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1436
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000c0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"
              }
            ],
            "repeated": 0,
            "id": 1437
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Security_HKLM_only"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only"
              }
            ],
            "repeated": 0,
            "id": 1438
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 1439
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"
              }
            ],
            "repeated": 0,
            "id": 1440
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"
              }
            ],
            "repeated": 0,
            "id": 1441
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"
              }
            ],
            "repeated": 0,
            "id": 1442
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"
              }
            ],
            "repeated": 0,
            "id": 1443
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000480"
              },
              {
                "name": "SubKey",
                "value": "FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562"
              }
            ],
            "repeated": 0,
            "id": 1444
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b4773000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1445
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000480"
              },
              {
                "name": "SubKey",
                "value": "FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION"
              }
            ],
            "repeated": 0,
            "id": 1446
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000480"
              },
              {
                "name": "SubKey",
                "value": "FEATURE_URI_DISABLECACHE"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_URI_DISABLECACHE"
              }
            ],
            "repeated": 0,
            "id": 1447
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": ".ini"
              },
              {
                "name": "Handle",
                "value": "0x00000486"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\.ini"
              }
            ],
            "repeated": 0,
            "id": 1448
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd0e39",
            "parentcaller": "0x7ff737dd0fbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000486"
              },
              {
                "name": "ValueName",
                "value": "Content Type"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ini\\Content Type"
              }
            ],
            "repeated": 1,
            "id": 1449
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737de3928",
            "parentcaller": "0x7ff737dcdc0f",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1450
          },
          {
            "timestamp": "2026-06-30 02:36:17,223",
            "thread_id": "3940",
            "caller": "0x7ff737dd1031",
            "parentcaller": "0x7ff737dd46c5",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000488"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000430"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              }
            ],
            "repeated": 0,
            "id": 1451
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737dd105d",
            "parentcaller": "0x7ff737dd46c5",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000488"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0ab0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x97e612e580"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1452
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737dd107c",
            "parentcaller": "0x7ff737dd46c5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 1453
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737dd10a8",
            "parentcaller": "0x7ff737dd46c5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1454
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737dd16a7",
            "parentcaller": "0x7ff737dd46c5",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0ab0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1455
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737dccc9b",
            "parentcaller": "0x7ff737dd177d",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x214aef60480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x7d1ecff6"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01dd0812"
              }
            ],
            "repeated": 0,
            "id": 1456
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1457
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000488"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "COMDLG32.dll"
              }
            ],
            "repeated": 0,
            "id": 1458
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000488"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9450000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000da000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1459
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9526000"
              },
              {
                "name": "ModuleName",
                "value": "COMDLG32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1460
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a94fe000"
              },
              {
                "name": "ModuleName",
                "value": "COMDLG32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1461
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a94fe000"
              },
              {
                "name": "ModuleName",
                "value": "COMDLG32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1462
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a94fe000"
              },
              {
                "name": "ModuleName",
                "value": "COMDLG32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1463
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a94fe000"
              },
              {
                "name": "ModuleName",
                "value": "COMDLG32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1464
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a94fc000"
              },
              {
                "name": "ModuleName",
                "value": "COMDLG32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1465
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 1466
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a94fc000"
              },
              {
                "name": "ModuleName",
                "value": "COMDLG32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1467
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1468
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\COMDLG32"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a9450000"
              }
            ],
            "repeated": 0,
            "id": 1469
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b4774000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1470
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\comdlg32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9450000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a9483a70"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1471
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff737df7000"
              },
              {
                "name": "ModuleName",
                "value": "NOTEPAD.EXE"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1472
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737de5542",
            "parentcaller": "0x7ff737de6e8a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff737df7000"
              },
              {
                "name": "ModuleName",
                "value": "NOTEPAD.EXE"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1473
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737dcf1e5",
            "parentcaller": "0x7ff737dcf299",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a2720000"
              }
            ],
            "repeated": 0,
            "id": 1474
          },
          {
            "timestamp": "2026-06-30 02:36:17,238",
            "thread_id": "3940",
            "caller": "0x7ff737dcf1e5",
            "parentcaller": "0x7ff737dcf299",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1475
          },
          {
            "timestamp": "2026-06-30 02:36:17,254",
            "thread_id": "3940",
            "caller": "0x7ff737dcf1e5",
            "parentcaller": "0x7ff737dcf299",
            "category": "filesystem",
            "api": "SHGetFileInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Path",
                "value": "rufus.ini"
              },
              {
                "name": "Flags",
                "value": "0x00000210"
              },
              {
                "name": "DisplayName",
                "value": "rufus.ini"
              },
              {
                "name": "TypeName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1476
          },
          {
            "timestamp": "2026-06-30 02:36:17,254",
            "thread_id": "3940",
            "caller": "0x7ff737dccce9",
            "parentcaller": "0x7ff737dd177d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1477
          },
          {
            "timestamp": "2026-06-30 02:36:17,254",
            "thread_id": "3940",
            "caller": "0x7ff737dd17aa",
            "parentcaller": "0x7ff737dd46c5",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef78000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1478
          },
          {
            "timestamp": "2026-06-30 02:36:17,254",
            "thread_id": "3940",
            "caller": "0x7ff737dd17aa",
            "parentcaller": "0x7ff737dd46c5",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214aef7b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1479
          },
          {
            "timestamp": "2026-06-30 02:36:17,254",
            "thread_id": "3940",
            "caller": "0x7ff737dd17aa",
            "parentcaller": "0x7ff737dd46c5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 1480
          },
          {
            "timestamp": "2026-06-30 02:36:17,254",
            "thread_id": "3940",
            "caller": "0x7ff737dd17aa",
            "parentcaller": "0x7ff737dd46c5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000438"
              },
              {
                "name": "SubKey",
                "value": "Consolas"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Consolas"
              }
            ],
            "repeated": 0,
            "id": 1481
          },
          {
            "timestamp": "2026-06-30 02:36:17,254",
            "thread_id": "3940",
            "caller": "0x7ff737dd17aa",
            "parentcaller": "0x7ff737dd46c5",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1482
          },
          {
            "timestamp": "2026-06-30 02:36:17,285",
            "thread_id": "3940",
            "caller": "0x7ff737dd183f",
            "parentcaller": "0x7ff737dd46c5",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000b0414"
              },
              {
                "name": "Message",
                "value": "0x000000c5"
              }
            ],
            "repeated": 0,
            "id": 1483
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd1912",
            "parentcaller": "0x7ff737dd46c5",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00002006"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1484
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd1912",
            "parentcaller": "0x7ff737dd46c5",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 1485
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd1947",
            "parentcaller": "0x7ff737dd46c5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              },
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              }
            ],
            "repeated": 0,
            "id": 1486
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd1947",
            "parentcaller": "0x7ff737dd46c5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "Start_TrackDocs"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackDocs"
              }
            ],
            "repeated": 0,
            "id": 1487
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd1947",
            "parentcaller": "0x7ff737dd46c5",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1488
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4778",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 1489
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4c18",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "gdi32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              }
            ],
            "repeated": 0,
            "id": 1490
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "BitBlt"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a3980"
              }
            ],
            "repeated": 0,
            "id": 1491
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "CreateCompatibleBitmap"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a4aa0"
              }
            ],
            "repeated": 0,
            "id": 1492
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "CreateCompatibleDC"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a3b70"
              }
            ],
            "repeated": 0,
            "id": 1493
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "CreateDIBSection"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a2820"
              }
            ],
            "repeated": 0,
            "id": 1494
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "CreateFontIndirectW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a1630"
              }
            ],
            "repeated": 0,
            "id": 1495
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "CreateSolidBrush"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a4b70"
              }
            ],
            "repeated": 0,
            "id": 1496
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "DeleteDC"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a2c70"
              }
            ],
            "repeated": 0,
            "id": 1497
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "DeleteObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a2130"
              }
            ],
            "repeated": 0,
            "id": 1498
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "GdiAlphaBlend"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a6c30"
              }
            ],
            "repeated": 0,
            "id": 1499
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "GdiGradientFill"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a6d70"
              }
            ],
            "repeated": 0,
            "id": 1500
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "GetCurrentObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a4880"
              }
            ],
            "repeated": 0,
            "id": 1501
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "GetDIBits"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a4560"
              }
            ],
            "repeated": 0,
            "id": 1502
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "GetDeviceCaps"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a3290"
              }
            ],
            "repeated": 0,
            "id": 1503
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "GetObjectW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a3f80"
              }
            ],
            "repeated": 0,
            "id": 1504
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "GetStockObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a3910"
              }
            ],
            "repeated": 0,
            "id": 1505
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "SelectObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a3660"
              }
            ],
            "repeated": 0,
            "id": 1506
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "SetBkMode"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a3ad0"
              }
            ],
            "repeated": 0,
            "id": 1507
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3a0000"
              },
              {
                "name": "FunctionName",
                "value": "SetTextColor"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3a3c40"
              }
            ],
            "repeated": 0,
            "id": 1508
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4c18",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              }
            ],
            "repeated": 0,
            "id": 1509
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetLocaleInfoEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3ecb40"
              }
            ],
            "repeated": 0,
            "id": 1510
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetTickCount64"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3e5d30"
              }
            ],
            "repeated": 0,
            "id": 1511
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetUserPreferredUILanguages"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3f0590"
              }
            ],
            "repeated": 0,
            "id": 1512
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "LCIDToLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3f0640"
              }
            ],
            "repeated": 0,
            "id": 1513
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "LocaleNameToLCID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3ee080"
              }
            ],
            "repeated": 0,
            "id": 1514
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "MulDiv"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3f5000"
              }
            ],
            "repeated": 0,
            "id": 1515
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "MultiByteToWideChar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3e5810"
              }
            ],
            "repeated": 0,
            "id": 1516
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "SleepEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3f4aa0"
              }
            ],
            "repeated": 0,
            "id": 1517
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4c18",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1518
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "WinSqmAddToStream"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6fec0"
              }
            ],
            "repeated": 0,
            "id": 1519
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4c18",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "user32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 1520
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "DrawTextExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa77eae0"
              }
            ],
            "repeated": 0,
            "id": 1521
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "EnumDisplaySettingsW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa768830"
              }
            ],
            "repeated": 0,
            "id": 1522
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "FillRect"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa783640"
              }
            ],
            "repeated": 0,
            "id": 1523
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetDC"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa786600"
              }
            ],
            "repeated": 0,
            "id": 1524
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetDCEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa794410"
              }
            ],
            "repeated": 0,
            "id": 1525
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetDesktopWindow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa76ae40"
              }
            ],
            "repeated": 0,
            "id": 1526
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetMonitorInfoW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa780b70"
              }
            ],
            "repeated": 0,
            "id": 1527
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetProcessWindowStation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa794690"
              }
            ],
            "repeated": 0,
            "id": 1528
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetSysColor"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa786310"
              }
            ],
            "repeated": 0,
            "id": 1529
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetSystemMetrics"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa781220"
              }
            ],
            "repeated": 0,
            "id": 1530
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetThreadDesktop"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa794730"
              }
            ],
            "repeated": 0,
            "id": 1531
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "GetUserObjectInformationW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa794780"
              }
            ],
            "repeated": 0,
            "id": 1532
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "InvalidateRect"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa794980"
              }
            ],
            "repeated": 0,
            "id": 1533
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "LogicalToPhysicalPointForPerMonitorDPI"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa794ab0"
              }
            ],
            "repeated": 0,
            "id": 1534
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "MonitorFromWindow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa7814b0"
              }
            ],
            "repeated": 0,
            "id": 1535
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "OffsetRect"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa76ae10"
              }
            ],
            "repeated": 0,
            "id": 1536
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "RedrawWindow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa794d50"
              }
            ],
            "repeated": 0,
            "id": 1537
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "ReleaseDC"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa784010"
              }
            ],
            "repeated": 0,
            "id": 1538
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd4cbc",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "SystemParametersInfoW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa7836b0"
              }
            ],
            "repeated": 0,
            "id": 1539
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd6aa8",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 1540
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd6af7",
            "parentcaller": "0x7ff737dcc29e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8d420"
              }
            ],
            "repeated": 0,
            "id": 1541
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dd6b19",
            "parentcaller": "0x7ff737dcc29e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 1542
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc09b",
            "parentcaller": "0x7ff737dcc2ab",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1543
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc0cb",
            "parentcaller": "0x7ff737dcc2ab",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1544
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc0e3",
            "parentcaller": "0x7ff737dcc2ab",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1545
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1546
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2541"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa7946a0"
              }
            ],
            "repeated": 0,
            "id": 1547
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1548
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1549
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2613"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa7841e0"
              }
            ],
            "repeated": 0,
            "id": 1550
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1551
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1552
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "FunctionName",
                "value": "PostMessageW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa781410"
              }
            ],
            "repeated": 0,
            "id": 1553
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a58d0000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1554
          },
          {
            "timestamp": "2026-06-30 02:36:17,301",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000e02e0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 1555
          },
          {
            "timestamp": "2026-06-30 02:36:21,441",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x97e612f750"
              },
              {
                "name": "EventName",
                "value": "Local\\2ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 1556
          },
          {
            "timestamp": "2026-06-30 02:36:21,441",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 1557
          },
          {
            "timestamp": "2026-06-30 02:36:21,441",
            "thread_id": "3940",
            "caller": "0x7ff737dcc3ac",
            "parentcaller": "0x7ff737de59b6",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000e02e0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 1558
          },
          {
            "timestamp": "2026-06-30 02:36:21,676",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcc3ac",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0b18000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1559
          },
          {
            "timestamp": "2026-06-30 02:36:21,676",
            "thread_id": "3940",
            "caller": "0x7ff737dcbb57",
            "parentcaller": "0x7ff737dcc3ac",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x214b0b19000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1560
          }
        ],
        "threads": [
          "3940",
          "1440",
          "2076",
          "2832",
          "5028",
          "772",
          "4688"
        ],
        "environ": {
          "UserName": "Rajesh",
          "ComputerName": "DESKTOP-P54VDBR",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "1c64-b66f",
          "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff737dc0000",
          "MainExeSize": "0x0003a000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 1820,
        "process_name": "WmiPrvSE.exe",
        "parent_id": 756,
        "module_path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        "first_seen": "2026-06-30 02:36:29,565",
        "calls": [
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "3596",
            "caller": "0x7ff9aaa5c1e7",
            "parentcaller": "0x7ff9aaa5bf7a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\ncobjapi"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a4240000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a4245be0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "3596",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "3596",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff712ff2580"
              },
              {
                "name": "Parameter",
                "value": "0x2d0e250000"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "2696",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "2696",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2f10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "2440",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "2440",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c3070"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "4204",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "4204",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2e50"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "4516",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f07000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "4516",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-06-30 02:36:29,800",
            "thread_id": "4516",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9871c2a40"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712ff2cd1",
            "parentcaller": "0x7ff712ff264a",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff712ff2c80"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff36d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff36d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fe8469",
            "parentcaller": "0x7ff712fe7f6c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f08000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef9ae",
            "parentcaller": "0x7ff712fe8019",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WBEM\\CIMOM"
              },
              {
                "name": "Handle",
                "value": "0x00000230"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef9f5",
            "parentcaller": "0x7ff712fe8019",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              },
              {
                "name": "ValueName",
                "value": "Sink Transmit Buffer Size"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\Sink Transmit Buffer Size"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fefa06",
            "parentcaller": "0x7ff712fe8019",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef8ba",
            "parentcaller": "0x7ff712fe801e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Wbem\\Cimom"
              },
              {
                "name": "Handle",
                "value": "0x00000230"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Cimom"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef906",
            "parentcaller": "0x7ff712fe801e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              },
              {
                "name": "ValueName",
                "value": "DefaultRpcStackSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\DefaultRpcStackSize"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef91f",
            "parentcaller": "0x7ff712fe801e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca03",
            "parentcaller": "0x7ff712fec74d",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x21976ee2174",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000074"
              },
              {
                "name": "ValueName",
                "value": "000603xx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "kernel32.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3d0000"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9aa3d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "SortGetHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3da190"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa3d0000"
              },
              {
                "name": "FunctionName",
                "value": "SortCloseHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa3efe60"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000001fc"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21978f30000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2d0e47f770"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f8"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712feca74",
            "parentcaller": "0x7ff712fec74d",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff307c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff307c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff34c8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff34c8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff342b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff342b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff3314",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff3314",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa760000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#32513"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "Type",
                "value": "#22"
              },
              {
                "name": "Name",
                "value": "#32513"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-06-30 02:36:29,815",
            "thread_id": "3596",
            "caller": "0x7ff712fec96b",
            "parentcaller": "0x7ff712fec762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9aa3c7000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff2ff1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff2ff1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff3107",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff3107",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec99f",
            "parentcaller": "0x7ff712fec762",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x219775907d0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "Type",
                "value": "#4"
              },
              {
                "name": "Name",
                "value": "#16"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec99f",
            "parentcaller": "0x7ff712fec762",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x21977591190",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff9aa760000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x219775907d0"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff35f0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff35f0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "42"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "3596"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000023c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000240"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000023c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000240"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6030000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a603f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000023c"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6035000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a6030000"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a6030000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a6033f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8700000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00083000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f8"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8768000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-06-30 02:36:29,831",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a8700000"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001f0"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f0"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001f0"
              },
              {
                "name": "ValueName",
                "value": "Enabled"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001ec"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000001f0"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f0"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001ec"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000001ec"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "t\\xa3\\x9d*\\x97\\x99d\\xc2\\x0b\\xc5r\\xf8\\x90+w\\xe5\\xec\\x01q)!0l\\x87\\x81\\x082\\xc3K\\x02\\xf7 \\x81\\xff\\xa1k\\x90~\\xaa\\x91\\xe2\\x98\\xb8\\xe5\\x9d\\xfe\\xc2U"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8700000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff9a8738cc0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9d12000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a9d12000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f0a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec378",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f12000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f13000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xf2G\\x0e-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00-\\x00\\x00\\x00\\xb0\\xf3G\\x0e-\\x00\\x00\\x00\\xb2}s\\xa9\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00O\\x14;\\x87\\xf9\\x7f\\x00\\x00p\\x11;\\x87\\xf9\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xe0\\xf2G\\x0e-\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x14;\\x87"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-18_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Classes"
              },
              {
                "name": "Handle",
                "value": "0x00000248"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "AppID\\wmiprvse.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\wmiprvse.exe"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64GetCurrentMachine"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa40d80"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64IsWowGuestMachineSupported"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6c590"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "AppID\\wmiprvse.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\wmiprvse.exe"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xf7G\\x0e-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xff\\xff\\xff\\xffD\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01F\\xa8\\xf9\\x7f\\x00\\x00N3\\x00t\\xac%\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a99e2000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-06-30 02:36:29,847",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec5a5",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec60b",
            "parentcaller": "0x7ff712feb501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7ff9a9600000"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec60b",
            "parentcaller": "0x7ff712feb501",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec297",
            "parentcaller": "0x7ff712feb513",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000288"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000006"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\Wmi Provider Sub System Counters"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec2ca",
            "parentcaller": "0x7ff712feb513",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000288"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x219775c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2d0e47fba0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1b9",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x219775f7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1b9",
            "parentcaller": "0x7ff712feb518",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              },
              {
                "name": "EventName",
                "value": "WBEM_ESS_OPEN_FOR_BUSINESS"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1b9",
            "parentcaller": "0x7ff712feb518",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1b9",
            "parentcaller": "0x7ff712feb518",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1b9",
            "parentcaller": "0x7ff712feb518",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x219775f1790"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 9,
            "id": 154
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1b9",
            "parentcaller": "0x7ff712feb518",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff9a4243ca0"
              },
              {
                "name": "Parameter",
                "value": "0x21976f13420"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "3380"
              },
              {
                "name": "ProcessId",
                "value": "1820"
              },
              {
                "name": "Module",
                "value": "NCObjAPI.DLL"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1b9",
            "parentcaller": "0x7ff712feb518",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002a4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff9a4243ca0"
              },
              {
                "name": "Parameter",
                "value": "0x21976f13420"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "3380"
              },
              {
                "name": "ProcessId",
                "value": "1820"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21979270000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21979270000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f1a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21979272000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f1c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21979273000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f1e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3380",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3380",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9a4243ca0"
              },
              {
                "name": "Parameter",
                "value": "0x21976f13420"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21979276000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3380",
            "caller": "0x7ff9a846170f",
            "parentcaller": "0x7ff9a4243cd8",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "EventName",
                "value": "EVENT_READYROOT/CIMV2PROVIDERSUBSYSTEM"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f21000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-06-30 02:36:29,862",
            "thread_id": "3596",
            "caller": "0x7ff712fec1ff",
            "parentcaller": "0x7ff712feb518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2197927b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb555",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemprox"
              },
              {
                "name": "DllBase",
                "value": "0x7ff97fc40000"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb555",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff97fc40000"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb555",
            "parentcaller": "0x7ff712fec77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff3553",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff3553",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb574",
            "parentcaller": "0x7ff712fec77a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a95f8000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb574",
            "parentcaller": "0x7ff712fec77a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a95f8000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "wmisvc.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff97fc4e000"
              },
              {
                "name": "ModuleName",
                "value": "wbemprox.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff97fc4e000"
              },
              {
                "name": "ModuleName",
                "value": "wbemprox.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "misc",
            "api": "GetComputerNameExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ComputerName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "misc",
            "api": "GetComputerNameExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "DESKTOP-P54VDBR"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002cc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff9a977adb0"
              },
              {
                "name": "Parameter",
                "value": "0x21976f100c0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "4300"
              },
              {
                "name": "ProcessId",
                "value": "1820"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "4300",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f2b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "4300",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-06-30 02:36:29,878",
            "thread_id": "4300",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9a977adb0"
              },
              {
                "name": "Parameter",
                "value": "0x21976f100c0"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "4836",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "4836",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9aaa42ad0"
              },
              {
                "name": "Parameter",
                "value": "0x21976ee0b50"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "4836",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a9c24a33",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3048",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3048",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9aaa42ad0"
              },
              {
                "name": "Parameter",
                "value": "0x21976ee0b50"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7ff97fc20000"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff97fc20000"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8BC3F05E-D86B-11D0-A075-00C04FB68820"
              },
              {
                "name": "ClsContext",
                "value": "0x00000014",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f8"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-06-30 02:36:29,894",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f8"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "misc",
            "api": "GetComputerNameExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "DESKTOP-P54VDBR"
              }
            ],
            "repeated": 1,
            "id": 213
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8430000"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a8430000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff9a8430000"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff9a8430000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "GetThreadPreferredUILanguages"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a849f9a0"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "SetThreadPreferredUILanguages"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a84485b0"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "LocaleNameToLCID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a8499e80"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "GetLocaleInfoEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a844ebd0"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "LCIDToLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a84497f0"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9a8430000"
              },
              {
                "name": "FunctionName",
                "value": "GetSystemDefaultLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9a84af0c0"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}"
              },
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000300"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000250"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000300"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IWbemServices"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000300"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 251
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000300"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000300"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000250"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000300"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IWbemServices"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000300"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-06-30 02:36:29,909",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 271
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000300"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000300"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000300"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000300"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000300"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000250"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f8"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000300"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99dc10000"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7ff99dc10000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff99dc10000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff99dc390e0"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff99dc10000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff99dc10000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff99dc39030"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aa9f93b0"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa8f9b0"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa32450"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa6f950"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa4cb70"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa53330"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:1820:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000308"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb5bc",
            "parentcaller": "0x7ff712fec77a",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedafb",
            "parentcaller": "0x7ff712feb615",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99dd18000"
              },
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedafb",
            "parentcaller": "0x7ff712feb615",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99dd18000"
              },
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedafb",
            "parentcaller": "0x7ff712feb615",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff97fc31000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedafb",
            "parentcaller": "0x7ff712feb615",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff97fc31000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedafb",
            "parentcaller": "0x7ff712feb615",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedafb",
            "parentcaller": "0x7ff712feb615",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WBEM\\CIMOM"
              },
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedafb",
            "parentcaller": "0x7ff712feb615",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "ValueName",
                "value": "EnableObjectValidation"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedafb",
            "parentcaller": "0x7ff712feb615",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedc61",
            "parentcaller": "0x7ff712fedb18",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClearAfter"
              },
              {
                "name": "Value",
                "value": "00000000000030.000000:000"
              },
              {
                "name": "Class",
                "value": "__ObjectProviderCacheControl"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedb93",
            "parentcaller": "0x7ff712feb615",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fedc61",
            "parentcaller": "0x7ff712fedbb0",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClearAfter"
              },
              {
                "name": "Value",
                "value": "00000000000030.000000:000"
              },
              {
                "name": "Class",
                "value": "__EventProviderCacheControl"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fe1167",
            "parentcaller": "0x7ff712feb67e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fe1383",
            "parentcaller": "0x7ff712fe117a",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ThreadsPerHost"
              },
              {
                "name": "Value",
                "value": "256"
              },
              {
                "name": "Class",
                "value": "__ProviderHostQuotaConfiguration"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fe13fc",
            "parentcaller": "0x7ff712fe117a",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HandlesPerHost"
              },
              {
                "name": "Value",
                "value": "4096"
              },
              {
                "name": "Class",
                "value": "__ProviderHostQuotaConfiguration"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712fe1471",
            "parentcaller": "0x7ff712fe117a",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ProcessLimitAllHosts"
              },
              {
                "name": "Value",
                "value": "32"
              },
              {
                "name": "Class",
                "value": "__ProviderHostQuotaConfiguration"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb1d8",
            "parentcaller": "0x7ff712feb33c",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000304"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff712feb120"
              },
              {
                "name": "Parameter",
                "value": "0x21976f35d30"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "4132"
              },
              {
                "name": "ProcessId",
                "value": "1820"
              },
              {
                "name": "Module",
                "value": "wmiprvse.exe"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb1d8",
            "parentcaller": "0x7ff712feb33c",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000304",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff712feb120"
              },
              {
                "name": "Parameter",
                "value": "0x21976f35d30"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "4132"
              },
              {
                "name": "ProcessId",
                "value": "1820"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-06-30 02:36:29,925",
            "thread_id": "3596",
            "caller": "0x7ff712feb350",
            "parentcaller": "0x7ff712feb763",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "4132",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "4132",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff712feb120"
              },
              {
                "name": "Parameter",
                "value": "0x21976f35d30"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "4132",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff3277",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000250"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}"
              },
              {
                "name": "Handle",
                "value": "0x00000320"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000320"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000320"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000320"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WMI Provider Subsystem Host"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000320"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000320"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000320"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000320"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000320"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f3a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000320"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x7f\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x19\\x02\\x00\\x00\\x12~\\xf3v\\x19\\x02\\x00\\x00\\xb8\\x7f\\xf3v\\x19\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00P~\\xf3v\\x19\\x02\\x00\\x00\\x10\\x7f\\xf3v\\x19\\x02\\x00\\x000\\x80\\xf3v"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x85\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "(|\\xf1v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xfd\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xae'\\x00t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xb0\\xedG\\x0e-\\x00\\x00\\x00\\xa8\\xedG\\x0e-\\x00\\x00\\x00x\\xedG\\x0e-\\x00\\x00\\x00\\x98\\xedG\\x0e"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfd\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xebG\\x0e-\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "(\\x8a\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P|\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x9b\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x1e\\x01\\x00\\x00U\\xfd\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff^\\x01\\x00\\x80\\x00__Provider"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "h{\\xf1v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xfd\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\x0e#\\x00t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\x10\\xeaG\\x0e-\\x00\\x00\\x00\\x08\\xeaG\\x0e-\\x00\\x00\\x00\\xd8\\xe9G\\x0e-\\x00\\x00\\x00\\xf8\\xe9G\\x0e"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xfd\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xe7G\\x0e-\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fea124",
            "parentcaller": "0x7ff712feb77b",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a9c24a33",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000320"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f3b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x81$\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa33f6a",
            "parentcaller": "0x7ff9a9bff557",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a9bff351",
            "parentcaller": "0x7ff9a9bfd90f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000330"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a846b0fb",
            "parentcaller": "0x7ff9a9bff42f",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa69b6e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x8b\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x82\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "h3\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xf6\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00N{\\xd0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00P\\xc2\\x97\\x0e-\\x00\\x00\\x00H\\xc2\\x97\\x0e-\\x00\\x00\\x00\\x18\\xc2\\x97\\x0e-\\x00\\x00\\x008\\xc2\\x97\\x0e"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xf6\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xc0\\x97\\x0e-\\x00\\x00\\x004\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa2953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x88\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\x85\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x080\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xf7\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xaet\\xd0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xb0\\xbe\\x97\\x0e-\\x00\\x00\\x00\\xa8\\xbe\\x97\\x0e-\\x00\\x00\\x00x\\xbe\\x97\\x0e-\\x00\\x00\\x00\\x98\\xbe\\x97\\x0e"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf7\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xbc\\x97\\x0e-\\x00\\x00\\x004\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4a7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3048",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff31a4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "3596",
            "caller": "0x7ff712fef292",
            "parentcaller": "0x7ff712ff31a4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff71304c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "4836",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f40000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa64f9d",
            "parentcaller": "0x7ff9aaa64b63",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff9aaa42ad0"
              },
              {
                "name": "Parameter",
                "value": "0x21976ee0b50"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a9c24a33",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000338"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}"
              },
              {
                "name": "Handle",
                "value": "0x0000033c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768313",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000033c"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a976834e",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768377",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768388",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa33f6a",
            "parentcaller": "0x7ff9a9bff557",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9bff351",
            "parentcaller": "0x7ff9a9bfd90f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000033c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a846b0fb",
            "parentcaller": "0x7ff9a9bff42f",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa69b6e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x82\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\x84\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00I\\x00D\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00F\\x008\\x001\\x002\\x00-\\x001\\x00D\\x003\\x00A\\x00-\\x001\\x001\\x00D\\x000\\x00-\\x008\\x009\\x001\\x00F\\x00-\\x000\\x000\\x00A\\x00A\\x000\\x000\\x004\\x00B\\x00"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x882\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xf5\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xbe\\x04\\xe0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xa0\\xce\\xa7\\x0e-\\x00\\x00\\x00\\x98\\xce\\xa7\\x0e-\\x00\\x00\\x00h\\xce\\xa7\\x0e-\\x00\\x00\\x00\\x88\\xce\\xa7\\x0e"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xf5\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xcc\\xa7\\x0e-\\x00\\x00\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa2953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x88\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\x85\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa82\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xff\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\x1e\\x00\\xe0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\x00\\xcb\\xa7\\x0e-\\x00\\x00\\x00\\xf8\\xca\\xa7\\x0e-\\x00\\x00\\x00\\xc8\\xca\\xa7\\x0e-\\x00\\x00\\x00\\xe8\\xca\\xa7\\x0e"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xc8\\xa7\\x0e-\\x00\\x00\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4a7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768313",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000340"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000033c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a976834e",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768377",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768388",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa33f6a",
            "parentcaller": "0x7ff9a9bff557",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9bff351",
            "parentcaller": "0x7ff9a9bfd90f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000340"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a846b0fb",
            "parentcaller": "0x7ff9a9bff42f",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa69b6e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x82\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "p\\x89\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00\\xf9\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\xf9\\x7f\\x00\\x00P\\xf9\\x8e\\xa9\\xf9\\x7f\\x00\\x00\\x18\\xf9\\x8e\\xa9\\xf9\\x7f\\x00\\x00\\xa0\\xde\\xf3v\\x19\\x02\\x00\\x00\\xd0i\\xf2v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xdd~\\x1e\\xde\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x080\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xf2\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xbe\\x04\\xe0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xa0\\xce\\xa7\\x0e-\\x00\\x00\\x00\\x98\\xce\\xa7\\x0e-\\x00\\x00\\x00h\\xce\\xa7\\x0e-\\x00\\x00\\x00\\x88\\xce\\xa7\\x0e"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf2\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xcc\\xa7\\x0e-\\x00\\x00\\x00<\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa2953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\x88\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\x80\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x19\\x02\\x00\\x00\\xff\\xff\\xff\\xff\\x19\\x02\\x00\\x00X\\xe8\\xcb\\x9d\\xf9\\x7f\\x00\\x00\\x0f\\x00\\x00\\x00\\x19\\x02\\x00\\x000|\\xf3v\\x19\\x02\\x00\\x00\\xa8\\x80\\xf3v\\x19\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00P~\\xf3v"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe81\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xf5\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\x1e\\x00\\xe0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\x00\\xcb\\xa7\\x0e-\\x00\\x00\\x00\\xf8\\xca\\xa7\\x0e-\\x00\\x00\\x00\\xc8\\xca\\xa7\\x0e-\\x00\\x00\\x00\\xe8\\xca\\xa7\\x0e"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf5\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xc8\\xa7\\x0e-\\x00\\x00\\x00<\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4a7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa6$\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xa3$\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xaf$\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xac$\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}"
              },
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768313",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000344"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000348"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a976834e",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768377",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768388",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa33f6a",
            "parentcaller": "0x7ff9a9bff557",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9bff351",
            "parentcaller": "0x7ff9a9bfd90f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000344"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a846b0fb",
            "parentcaller": "0x7ff9a9bff42f",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000348"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa69b6e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88\\x87\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0}\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x002\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\""
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe81\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xf9\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xbe\\x7f\\xe0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xa0\\xc5\\xa7\\x0e-\\x00\\x00\\x00\\x98\\xc5\\xa7\\x0e-\\x00\\x00\\x00h\\xc5\\xa7\\x0e-\\x00\\x00\\x00\\x88\\xc5\\xa7\\x0e"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xf9\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xc3\\xa7\\x0e-\\x00\\x00\\x00H\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa2953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88\\x81\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\x83\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x883\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xf5\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\x1e{\\xe0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\x00\\xc2\\xa7\\x0e-\\x00\\x00\\x00\\xf8\\xc1\\xa7\\x0e-\\x00\\x00\\x00\\xc8\\xc1\\xa7\\x0e-\\x00\\x00\\x00\\xe8\\xc1\\xa7\\x0e"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xf5\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xbf\\xa7\\x0e-\\x00\\x00\\x00H\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4a7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a97092aa",
            "parentcaller": "0x7ff9a97090af",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}"
              },
              {
                "name": "Handle",
                "value": "0x00000348"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768313",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000348"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a976834e",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768377",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9768388",
            "parentcaller": "0x7ff9a96e293b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa33f6a",
            "parentcaller": "0x7ff9a9bff557",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a9bff351",
            "parentcaller": "0x7ff9a9bfd90f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000348"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9a846b0fb",
            "parentcaller": "0x7ff9a9bff42f",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa69b6e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8}\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "0~\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00onfi\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\xf9\\x7f\\x00\\x00\\x08~\\xf3v\\x19\\x02\\x00\\x00+\\x00\\x01*\\xd1Y\\x00\\x10\\xa0\\xe9\\xcb\\x9d\\xf9\\x7f\\x00\\x00\\x10\\xe5\\xcb\\x9d\\xf9\\x7f\\x00\\x00X\\xe5\\xcb\\x9d\\xf9\\x7f\\x00\\x00\\x80\\xe5\\xcb\\x9d\\xf9\\x7f\\x00\\x00h\\xe9\\xcb\\x9d"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x883\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-06-30 02:36:29,940",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\x00\\xf2v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\xbe\\x04\\xe0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\xa0\\xce\\xa7\\x0e-\\x00\\x00\\x00\\x98\\xce\\xa7\\x0e-\\x00\\x00\\x00h\\xce\\xa7\\x0e-\\x00\\x00\\x00\\x88\\xce\\xa7\\x0e"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\xf2v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xcc\\xa7\\x0e-\\x00\\x00\\x00D\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa28cde",
            "parentcaller": "0x7ff9aaa2953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "a\n\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xab\\xf1\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56d66",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "h\\x80\\xf3v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xff\\xff\\xff\\xff;|\\xf3v\\x19\\x02\\x00\\x00\\xe8\\x7f\\xf3v\\x19\\x02\\x00\\x00g|\\xf3v\\x19\\x02\\x00\\x00i|\\xf3v\\x19\\x02\\x00\\x00\\x1e\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\xf0\\x7f\\xf3v\\x19\\x02\\x00\\x00\\x89|\\xf3v"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56dbb",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\x84\\xf3v\\x19\\x02\\x00\\x00`\\x00\\x00\\x00I\\x00D\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00F\\x008\\x001\\x002\\x00-\\x001\\x00D\\x003\\x00A\\x00-\\x001\\x001\\x00D\\x000\\x00-\\x008\\x009\\x001\\x00F\\x00-\\x000\\x000\\x00A\\x00A\\x000\\x000\\x004\\x00B\\x00"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56de0",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e2e",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe81\\xf2v\\x19\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56e57",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56eaf",
            "parentcaller": "0x7ff9aaa28d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xfd\\xf1v\\x19\\x02\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f68",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1>\\x87\\xf9\\x7f\\x00\\x00\\xfbR\\x16\\x87\\xf9\\x7f\\x00\\x00\\x1e\\x00\\xe0t\\xac%\\x00\\x00\\x88\\xa1:\\x87\\xf9\\x7f\\x00\\x00\\x00\\xcb\\xa7\\x0e-\\x00\\x00\\x00\\xf8\\xca\\xa7\\x0e-\\x00\\x00\\x00\\xc8\\xca\\xa7\\x0e-\\x00\\x00\\x00\\xe8\\xca\\xa7\\x0e"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9aaa56f9b",
            "parentcaller": "0x7ff9aaa56ec8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfd\\xf1v\\x19\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x17\\x87\\xf9\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xc8\\xa7\\x0e-\\x00\\x00\\x00D\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xc0j\\xf9\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6:\\x87"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4a7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a9bff4c9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff99dc3b02d",
            "parentcaller": "0x7ff99dc3a607",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff99dc3b02d",
            "parentcaller": "0x7ff99dc3a607",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fef038",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiutils"
              },
              {
                "name": "DllBase",
                "value": "0x7ff99e310000"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fef038",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wmiutils.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff99e310000"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fef038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a84801fc",
            "parentcaller": "0x7ff9a96d879f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000340"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x02%\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xff$\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x07%\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00'\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xb9\t\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe1cb2",
            "parentcaller": "0x7ff712fe1a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe26d3",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "1"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2765",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "InvProv"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2810",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Enabled"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe28a2",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CLSID"
              },
              {
                "name": "Value",
                "value": "{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe4112",
            "parentcaller": "0x7ff712fe3c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe41aa",
            "parentcaller": "0x7ff712fe3c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe4112",
            "parentcaller": "0x7ff712ff68a4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe41aa",
            "parentcaller": "0x7ff712ff68a4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe3d53",
            "parentcaller": "0x7ff712fe3c9f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe3e6b",
            "parentcaller": "0x7ff712fe3cb2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe3a94",
            "parentcaller": "0x7ff712fe28ef",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2958",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClientLoadableCLSID"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe29ee",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DefaultMachineName"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2a86",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UnloadTimeout"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2b25",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ImpersonationLevel"
              },
              {
                "name": "Value",
                "value": "1"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2bbd",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsSendStatus"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2c4f",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsShutdown"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2cde",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsQuotas"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2d6d",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "OperationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2e05",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2e9d",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsThrottling"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2f2c",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": false,
            "return": "0xffffffff80041002",
            "arguments": [
              {
                "name": "Name",
                "value": "ConcurrentIndependantRequests"
              },
              {
                "name": "Value",
                "value": "Unhandled VARIANT Type: 0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe2fa6",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationReentrancy"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe3036",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializeAsAdminFirst"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe30c5",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerUserInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe3154",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerLocaleInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe31e6",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Pure"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe327a",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HostingModel"
              },
              {
                "name": "Value",
                "value": "LocalSystemHost"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-06-30 02:36:29,956",
            "thread_id": "532",
            "caller": "0x7ff712fe3348",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityDescriptor"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{027947E1-D731-11CE-A357-000000000001}"
              },
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000034c"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000250"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000034c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000034c"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 598
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000034c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000034c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000250"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000034c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000034c"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 618
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000034c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000034c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000034c"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000034c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000034c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000250"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000350"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000034c"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000344"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000248"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000350"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000354"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f48000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe4ef3",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe1d75",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsPut"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe1dfb",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsGet"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe1e86",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsDelete"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe1f0c",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsEnumeration"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe1f97",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsBatching"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe201c",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsTransactions"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe20a1",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "QuerySupportLevels"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-06-30 02:36:29,972",
            "thread_id": "532",
            "caller": "0x7ff712fe212a",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InteractionType"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe56cb",
            "parentcaller": "0x7ff712fe5514",
            "category": "com",
            "api": "CoGetClassObject",
            "status": false,
            "return": "0xffffffff80040154",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe5a00",
            "parentcaller": "0x7ff712fe1b65",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe5a00",
            "parentcaller": "0x7ff712fe1b65",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa32e70"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe5a00",
            "parentcaller": "0x7ff712fe1b65",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa40380"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe5a00",
            "parentcaller": "0x7ff712fe1b65",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa3f1a0"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe5a00",
            "parentcaller": "0x7ff712fe1b65",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventActivityIdControl"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa4b690"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe5a00",
            "parentcaller": "0x7ff712fe1b65",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWriteTransfer"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa3f1e0"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe5a00",
            "parentcaller": "0x7ff712fe1b65",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff9aa9f0000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff9aaa40d00"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x19&\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x0f&\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9aa9fe715",
            "parentcaller": "0x7ff9aa9fe37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21976f4b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff99dc3b02d",
            "parentcaller": "0x7ff99dc3a607",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff99dc3b02d",
            "parentcaller": "0x7ff99dc3a607",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fef038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "F&\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00C&\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe1cb2",
            "parentcaller": "0x7ff712fe1a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe26d3",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "1"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2765",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "InvProv"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2810",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Enabled"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe28a2",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CLSID"
              },
              {
                "name": "Value",
                "value": "{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe4112",
            "parentcaller": "0x7ff712fe3c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe41aa",
            "parentcaller": "0x7ff712fe3c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe4112",
            "parentcaller": "0x7ff712ff68a4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe41aa",
            "parentcaller": "0x7ff712ff68a4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe3d53",
            "parentcaller": "0x7ff712fe3c9f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe3e6b",
            "parentcaller": "0x7ff712fe3cb2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe3a94",
            "parentcaller": "0x7ff712fe28ef",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2958",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClientLoadableCLSID"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe29ee",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DefaultMachineName"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2a86",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UnloadTimeout"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2b25",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ImpersonationLevel"
              },
              {
                "name": "Value",
                "value": "1"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2bbd",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsSendStatus"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2c4f",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsShutdown"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2cde",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsQuotas"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2d6d",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "OperationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2e05",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2e9d",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsThrottling"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2f2c",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": false,
            "return": "0xffffffff80041002",
            "arguments": [
              {
                "name": "Name",
                "value": "ConcurrentIndependantRequests"
              },
              {
                "name": "Value",
                "value": "Unhandled VARIANT Type: 0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe2fa6",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationReentrancy"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe3036",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializeAsAdminFirst"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe30c5",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerUserInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe3154",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerLocaleInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe31e6",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Pure"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe327a",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HostingModel"
              },
              {
                "name": "Value",
                "value": "LocalSystemHost"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-06-30 02:36:29,987",
            "thread_id": "532",
            "caller": "0x7ff712fe3348",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityDescriptor"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe1d75",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsPut"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe1dfb",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsGet"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe1e86",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsDelete"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe1f0c",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsEnumeration"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe1f97",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsBatching"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe201c",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsTransactions"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe20a1",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "QuerySupportLevels"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe212a",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InteractionType"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fe56cb",
            "parentcaller": "0x7ff712fe5514",
            "category": "com",
            "api": "CoGetClassObject",
            "status": false,
            "return": "0xffffffff80040154",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "l'\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00d'\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff99dc3b02d",
            "parentcaller": "0x7ff99dc3a607",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff99dc3b02d",
            "parentcaller": "0x7ff99dc3a607",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-06-30 02:36:30,003",
            "thread_id": "532",
            "caller": "0x7ff712fef038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xbf'\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xbc'\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc4'\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00'\\x00\\x00\\x00\\x1c\\x00\\x00\\x00*&\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe1cb2",
            "parentcaller": "0x7ff712fe1a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe26d3",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "1"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2765",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "InvProv"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2810",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Enabled"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe28a2",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CLSID"
              },
              {
                "name": "Value",
                "value": "{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe4112",
            "parentcaller": "0x7ff712fe3c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe41aa",
            "parentcaller": "0x7ff712fe3c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe4112",
            "parentcaller": "0x7ff712ff68a4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe41aa",
            "parentcaller": "0x7ff712ff68a4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe3d53",
            "parentcaller": "0x7ff712fe3c9f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe3e6b",
            "parentcaller": "0x7ff712fe3cb2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe3a94",
            "parentcaller": "0x7ff712fe28ef",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2958",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClientLoadableCLSID"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe29ee",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DefaultMachineName"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2a86",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UnloadTimeout"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2b25",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ImpersonationLevel"
              },
              {
                "name": "Value",
                "value": "1"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2bbd",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsSendStatus"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2c4f",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsShutdown"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2cde",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsQuotas"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2d6d",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "OperationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2e05",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2e9d",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsThrottling"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2f2c",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": false,
            "return": "0xffffffff80041002",
            "arguments": [
              {
                "name": "Name",
                "value": "ConcurrentIndependantRequests"
              },
              {
                "name": "Value",
                "value": "Unhandled VARIANT Type: 0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe2fa6",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationReentrancy"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe3036",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializeAsAdminFirst"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe30c5",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerUserInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe3154",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerLocaleInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe31e6",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Pure"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe327a",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HostingModel"
              },
              {
                "name": "Value",
                "value": "LocalSystemHost"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe3348",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityDescriptor"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe1d75",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsPut"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe1dfb",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsGet"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe1e86",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsDelete"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe1f0c",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsEnumeration"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe1f97",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsBatching"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe201c",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsTransactions"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe20a1",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "QuerySupportLevels"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe212a",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InteractionType"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff712fe56cb",
            "parentcaller": "0x7ff712fe5514",
            "category": "com",
            "api": "CoGetClassObject",
            "status": false,
            "return": "0xffffffff80040154",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x9e(\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x97(\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff99dc3b02d",
            "parentcaller": "0x7ff99dc3a607",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff9a8451a8e",
            "parentcaller": "0x7ff9a9766a91",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 795
          },
          {
            "timestamp": "2026-06-30 02:36:30,019",
            "thread_id": "532",
            "caller": "0x7ff99dc3b02d",
            "parentcaller": "0x7ff99dc3a607",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fef038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xec(\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xe9(\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a96da750",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf1(\\x1e\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\xb8\\x0f\\x00\\x00'\\x00\\x00\\x00\\x1c\\x00\\x00\\x00&'\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff9a845a3c5",
            "parentcaller": "0x7ff9a96da6fa",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 801
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff9a845ac4b",
            "parentcaller": "0x7ff9a97384fa",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff9a96e6f09",
            "parentcaller": "0x7ff9a976771d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe1cb2",
            "parentcaller": "0x7ff712fe1a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe26d3",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "1"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2765",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "InvProv"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 806
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2810",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Enabled"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe28a2",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CLSID"
              },
              {
                "name": "Value",
                "value": "{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe4112",
            "parentcaller": "0x7ff712fe3c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe41aa",
            "parentcaller": "0x7ff712fe3c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe4112",
            "parentcaller": "0x7ff712ff68a4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe41aa",
            "parentcaller": "0x7ff712ff68a4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 812
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe3d53",
            "parentcaller": "0x7ff712fe3c9f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 813
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe3e6b",
            "parentcaller": "0x7ff712fe3cb2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe3a94",
            "parentcaller": "0x7ff712fe28ef",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}"
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2958",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClientLoadableCLSID"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe29ee",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DefaultMachineName"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2a86",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UnloadTimeout"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2b25",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ImpersonationLevel"
              },
              {
                "name": "Value",
                "value": "1"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2bbd",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsSendStatus"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2c4f",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsShutdown"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 821
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2cde",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsQuotas"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2d6d",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "OperationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2e05",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 824
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2e9d",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsThrottling"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2f2c",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": false,
            "return": "0xffffffff80041002",
            "arguments": [
              {
                "name": "Name",
                "value": "ConcurrentIndependantRequests"
              },
              {
                "name": "Value",
                "value": "Unhandled VARIANT Type: 0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe2fa6",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationReentrancy"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe3036",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializeAsAdminFirst"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe30c5",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerUserInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe3154",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerLocaleInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe31e6",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Pure"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 831
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe327a",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HostingModel"
              },
              {
                "name": "Value",
                "value": "LocalSystemHost"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe3348",
            "parentcaller": "0x7ff712fe1cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityDescriptor"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe4e98",
            "parentcaller": "0x7ff712fe1ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 836
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe1d75",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsPut"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe1dfb",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsGet"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe1e86",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsDelete"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 839
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe1f0c",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsEnumeration"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe1f97",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsBatching"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe201c",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsTransactions"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe20a1",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "QuerySupportLevels"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-06-30 02:36:30,034",
            "thread_id": "532",
            "caller": "0x7ff712fe212a",
            "parentcaller": "0x7ff712fe5043",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InteractionType"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__InstanceProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-06-30 02:36:30,050",
            "thread_id": "532",
            "caller": "0x7ff712fe56cb",
            "parentcaller": "0x7ff712fe5514",
            "category": "com",
            "api": "CoGetClassObject",
            "status": false,
            "return": "0xffffffff80040154",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 845
          }
        ],
        "threads": [
          "3596",
          "2696",
          "2440",
          "4204",
          "4516",
          "3380",
          "4300",
          "4836",
          "3048",
          "4132",
          "532"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "DESKTOP-P54VDBR",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "1c64-b66f",
          "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff712fe0000",
          "MainExeSize": "0x0007e000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      }
    ],
    "anomaly": [],
    "processtree": [
      {
        "name": "cmd.exe",
        "pid": 3792,
        "parent_id": 2892,
        "module_path": "C:\\Windows\\System32\\cmd.exe",
        "children": [
          {
            "name": "notepad.exe",
            "pid": 5060,
            "parent_id": 3792,
            "module_path": "C:\\Windows\\System32\\notepad.exe",
            "children": [],
            "threads": [
              "3940",
              "1440",
              "2076",
              "2832",
              "5028",
              "772",
              "4688"
            ],
            "environ": {
              "UserName": "Rajesh",
              "ComputerName": "DESKTOP-P54VDBR",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\",
              "CommandLine": "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "1c64-b66f",
              "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff737dc0000",
              "MainExeSize": "0x0003a000",
              "Bitness": "64-bit"
            }
          }
        ],
        "threads": [
          "2248",
          "4284",
          "4512",
          "1944",
          "2784",
          "960",
          "2396",
          "2328",
          "3812"
        ],
        "environ": {
          "UserName": "Rajesh",
          "ComputerName": "DESKTOP-P54VDBR",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Windows\\system32\\cmd.exe\" /c start /wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\"",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "1c64-b66f",
          "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff79a450000",
          "MainExeSize": "0x00067000",
          "Bitness": "64-bit"
        }
      },
      {
        "name": "svchost.exe",
        "pid": 756,
        "parent_id": 632,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "children": [
          {
            "name": "WmiPrvSE.exe",
            "pid": 1820,
            "parent_id": 756,
            "module_path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "children": [],
            "threads": [
              "3596",
              "2696",
              "2440",
              "4204",
              "4516",
              "3380",
              "4300",
              "4836",
              "3048",
              "4132",
              "532"
            ],
            "environ": {
              "UserName": "SYSTEM",
              "ComputerName": "DESKTOP-P54VDBR",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Windows\\TEMP\\",
              "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "1c64-b66f",
              "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff712fe0000",
              "MainExeSize": "0x0007e000",
              "Bitness": "64-bit"
            }
          }
        ],
        "threads": [
          "3624",
          "1176"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "DESKTOP-P54VDBR",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "1c64-b66f",
          "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff69d480000",
          "MainExeSize": "0x00011000",
          "Bitness": "64-bit"
        }
      }
    ],
    "summary": {
      "files": [
        "C:\\Users\\Rajesh\\AppData\\Local\\Temp",
        "C:\\Users",
        "C:\\Users\\Rajesh",
        "C:\\Users\\Rajesh\\AppData",
        "C:\\Users\\Rajesh\\AppData\\Local",
        "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini",
        "C:\\Windows\\System32\\kernel.appcore.dll",
        "\\Device\\CNG",
        "\\Device\\DeviceApi\\CMApi",
        "\\??\\MountPointManager",
        "\\??\\PhysicalDrive0",
        "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        "C:\\Windows\\WindowsShell.Manifest",
        "C:\\Windows\\System32\\resources.pri",
        "C:\\Windows\\Fonts\\staticcache.dat",
        "C:\\Windows\\System32\\TextShaping.dll",
        "C:\\Windows\\System32\\uxtheme.dll.Config",
        "C:\\Windows\\System32\\uxtheme.dll",
        "C:\\Windows\\System32\\textinputframework.dll",
        "C:\\Windows\\System32\\CoreUIComponents.dll",
        "C:\\Windows\\System32\\CoreMessaging.dll",
        "C:\\Windows\\System32\\ntmarta.dll",
        "C:\\Windows\\System32\\urlmon.dll",
        "C:\\Windows\\System32\\iertutil.dll",
        "C:\\Windows\\System32\\srvcli.dll",
        "C:\\Windows\\System32\\netutils.dll",
        "C:\\Windows\\system32",
        "C:\\Windows",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
      ],
      "read_files": [],
      "write_files": [
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
      ],
      "delete_files": [],
      "keys": [
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DisableUNCCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\EnableExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DelayedExpansion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DefaultColor",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\CompletionChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\PathCompletionChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\AutoRun",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration",
        "HKEY_CURRENT_USER",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
        "HKEY_CURRENT_USER\\Software\\Classes",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Scaling",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Mrt\\_Merged",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Notepad",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfEscapement",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfOrientation",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfWeight",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfItalic",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfUnderline",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfStrikeOut",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfCharSet",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfOutPrecision",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfClipPrecision",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfQuality",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfPitchAndFamily",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Notepad\\DefaultFonts",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\lfFaceName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\iPointSize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfFaceName",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iPointSize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWrap",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iDefaultEncoding",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\StatusBar",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fSaveWindowPositions",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWindowsOnlyEOL",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fPasteOriginalEOL",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fReverse",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWrapAround",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fMatchCase",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\searchString",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\replaceString",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\szHeader",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\szTrailer",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginTop",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginBottom",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginLeft",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginRight",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosY",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosX",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosDX",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosDY",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fMLE_is_broken",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\XAML",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
        "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\NOTEPAD.EXE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{C50898F6-C536-5F47-8583-8B2C2438A13B}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{c50898f6-c536-5f47-8583-8b2c2438a13b}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{c50898f6-c536-5f47-8583-8b2c2438a13b}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\Elevation",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\NOTEPAD.EXE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\AppCompatClassName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Input",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\LanmanWorkstation\\Parameters\\RpcCacheTimeout",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameTabWindow",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameTabWindow",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameMerging",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameMerging",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\SessionMerging",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\SessionMerging",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\AdminTabProcs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\AdminTabProcs",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Security\\RunBinaryControlHostProcessInSeparateAppContainer",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Security\\RunBinaryControlHostProcessInSeparateAppContainer",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
        "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_URI_DISABLECACHE",
        "HKEY_CLASSES_ROOT\\.ini",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ini\\Content Type",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Consolas",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackDocs",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\Sink Transmit Buffer Size",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Cimom",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\DefaultRpcStackSize",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids",
        "HKEY_LOCAL_MACHINE\\Software\\Classes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\wmiprvse.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\Elevation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32\\(Default)",
        "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\InProcServer32",
        "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}\\LocalServer32",
        "HKEY_CLASSES_ROOT\\CLSID\\{F4BA59CC-2506-45AE-84C8-78EA8D7F9B3E}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)"
      ],
      "read_keys": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DisableUNCCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\EnableExtensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DelayedExpansion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DefaultColor",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\CompletionChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\PathCompletionChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\AutoRun",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfEscapement",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfOrientation",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfWeight",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfItalic",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfUnderline",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfStrikeOut",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfCharSet",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfOutPrecision",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfClipPrecision",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfQuality",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfPitchAndFamily",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\lfFaceName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\iPointSize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfFaceName",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iPointSize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWrap",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iDefaultEncoding",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\StatusBar",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fSaveWindowPositions",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWindowsOnlyEOL",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fPasteOriginalEOL",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fReverse",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWrapAround",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fMatchCase",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\searchString",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\replaceString",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\szHeader",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\szTrailer",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginTop",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginBottom",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginLeft",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginRight",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosY",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosX",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosDX",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosDY",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fMLE_is_broken",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{c50898f6-c536-5f47-8583-8b2c2438a13b}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\LanmanWorkstation\\Parameters\\RpcCacheTimeout",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameTabWindow",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameTabWindow",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameMerging",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameMerging",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\SessionMerging",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\SessionMerging",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\AdminTabProcs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\AdminTabProcs",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Security\\RunBinaryControlHostProcessInSeparateAppContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Security\\RunBinaryControlHostProcessInSeparateAppContainer",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ini\\Content Type",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackDocs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\Sink Transmit Buffer Size",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\DefaultRpcStackSize",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)"
      ],
      "write_keys": [],
      "delete_keys": [],
      "executed_commands": [
        "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\"",
        "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini",
        "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini ",
        "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
      ],
      "resolved_apis": [
        "ntdll.dll.RtlWow64GetCurrentMachine",
        "ntdll.dll.RtlWow64IsWowGuestMachineSupported"
      ],
      "mutexes": [
        "Local\\SM0:5060:304:WilStaging_02",
        "Local\\SM0:5060:120:WilError_03",
        "Local\\MSCTF.Asm.MutexDefault2",
        "CicLoadWinStaWinSta0",
        "Local\\MSCTF.CtfMonitorInstMutexDefault2",
        "Local\\SM0:1820:304:WilStaging_02"
      ],
      "created_services": [],
      "started_services": []
    },
    "enhanced": [
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,604",
        "eid": 1,
        "data": {
          "file": "KERNEL32.DLL",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,604",
        "eid": 2,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DisableUNCCheck",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,604",
        "eid": 3,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\EnableExtensions",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,604",
        "eid": 4,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DelayedExpansion",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,604",
        "eid": 5,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\DefaultColor",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,604",
        "eid": 6,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\CompletionChar",
          "content": "9"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,604",
        "eid": 7,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\PathCompletionChar",
          "content": "9"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,604",
        "eid": 8,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Command Processor\\AutoRun",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,620",
        "eid": 9,
        "data": {
          "file": "KERNEL32.DLL",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-06-30 02:36:13,620",
        "eid": 10,
        "data": {
          "file": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\" "
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,620",
        "eid": 11,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,636",
        "eid": 12,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,636",
        "eid": 13,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,636",
        "eid": 14,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,636",
        "eid": 15,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,651",
        "eid": 16,
        "data": {
          "file": "C:\\Windows\\System32\\uxtheme.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a5b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,651",
        "eid": 17,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,667",
        "eid": 18,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
          "content": "0"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,682",
        "eid": 19,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff994050000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,682",
        "eid": 20,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa3d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,714",
        "eid": 21,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa9f0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,729",
        "eid": 22,
        "data": {
          "file": "C:\\Windows\\System32\\propsys.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a2720000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,807",
        "eid": 23,
        "data": {
          "file": "C:\\Windows\\System32\\Windows.Storage.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a6230000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,823",
        "eid": 24,
        "data": {
          "file": "C:\\Windows\\System32\\windows.storage.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a6230000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,932",
        "eid": 25,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data",
          "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\xc4\\xd8c\\xf2\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,932",
        "eid": 26,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,932",
        "eid": 27,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data",
          "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00o\\xb6d\\x1c\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,932",
        "eid": 28,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,932",
        "eid": 29,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data",
          "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\xd9T\\x98P\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x008\\x00E\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,932",
        "eid": 30,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,948",
        "eid": 31,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,948",
        "eid": 32,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server",
          "content": "StateRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,948",
        "eid": 33,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,948",
        "eid": 34,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 35,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 36,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 37,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 38,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 39,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 40,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 41,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 42,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 43,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 44,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 45,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 46,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
          "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 47,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 48,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 49,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 50,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity",
          "content": "nt authority\\system"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 51,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName",
          "content": "StateRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 52,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,964",
        "eid": 53,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 54,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 55,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 56,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 57,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 58,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 59,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 60,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 61,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 62,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 63,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 64,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 65,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 66,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 67,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 68,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,979",
        "eid": 69,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,995",
        "eid": 70,
        "data": {
          "file": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a1300000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:13,995",
        "eid": 71,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:13,995",
        "eid": 72,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,011",
        "eid": 73,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,011",
        "eid": 74,
        "data": {
          "file": "C:\\Windows\\System32\\Windows.UI.AppDefaults.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9903b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,011",
        "eid": 75,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff994050000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,089",
        "eid": 76,
        "data": {
          "file": "user32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa760000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,120",
        "eid": 77,
        "data": {
          "file": "C:\\Windows\\System32\\urlmon.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff99f930000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,120",
        "eid": 78,
        "data": {
          "file": "API-MS-WIN-CORE-URL-L1-1-0.DLL",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a8430000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,151",
        "eid": 79,
        "data": {
          "file": "C:\\Windows\\System32\\WinTypes.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a4dc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,151",
        "eid": 80,
        "data": {
          "file": "C:\\Windows\\System32\\WinTypes.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a4dc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,167",
        "eid": 81,
        "data": {
          "file": "C:\\Windows\\System32\\appresolver.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9971f0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,182",
        "eid": 82,
        "data": {
          "file": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff99d480000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,182",
        "eid": 83,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 84,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 85,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 86,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 87,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 88,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 89,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 90,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 91,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 92,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 93,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 94,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 95,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 96,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 97,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,198",
        "eid": 98,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 99,
        "data": {
          "file": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff99eea0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 100,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 101,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 102,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 103,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 104,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 105,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 106,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 107,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 108,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 109,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 110,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:14,214",
        "eid": 111,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,386",
        "eid": 112,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa9f0000"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-06-30 02:36:16,401",
        "eid": 113,
        "data": {
          "file": "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,417",
        "eid": 114,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa9f0000"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-06-30 02:36:16,417",
        "eid": 115,
        "data": {
          "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,417",
        "eid": 116,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,083",
        "eid": 117,
        "data": {
          "file": "C:\\Windows\\System32\\rsaenh.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a7170000"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-06-30 02:36:29,536",
        "eid": 118,
        "data": {
          "file": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,676",
        "eid": 119,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,676",
        "eid": 120,
        "data": {
          "file": "LPK",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,676",
        "eid": 121,
        "data": {
          "file": "GDI32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,691",
        "eid": 122,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,691",
        "eid": 123,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,691",
        "eid": 124,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,691",
        "eid": 125,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,707",
        "eid": 126,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,707",
        "eid": 127,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,707",
        "eid": 128,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,707",
        "eid": 129,
        "data": {
          "file": "C:\\Windows\\System32\\uxtheme.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a5b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,707",
        "eid": 130,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,707",
        "eid": 131,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
          "content": "0"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,707",
        "eid": 132,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,707",
        "eid": 133,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 134,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 135,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 136,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\DllPath",
          "content": "C:\\Windows\\System32\\MrmCoreR.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 137,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 138,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 139,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 140,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 141,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 142,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 143,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 144,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Resources.Core.ResourceManager\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,723",
        "eid": 145,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,738",
        "eid": 146,
        "data": {
          "file": "C:\\Windows\\System32\\MrmCoreR.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a06e0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,738",
        "eid": 147,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,738",
        "eid": 148,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,738",
        "eid": 149,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,738",
        "eid": 150,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,738",
        "eid": 151,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 152,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfEscapement",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 153,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfOrientation",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 154,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfWeight",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 155,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfItalic",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 156,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfUnderline",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 157,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfStrikeOut",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 158,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfCharSet",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 159,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfOutPrecision",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 160,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfClipPrecision",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 161,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfQuality",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 162,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfPitchAndFamily",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 163,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\lfFaceName",
          "content": "Consolas"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 164,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Notepad\\DefaultFonts\\iPointSize",
          "content": "110"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 165,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\lfFaceName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 166,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iPointSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 167,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWrap",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 168,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iDefaultEncoding",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 169,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\StatusBar",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 170,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fSaveWindowPositions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 171,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWindowsOnlyEOL",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 172,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fPasteOriginalEOL",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 173,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fReverse",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,754",
        "eid": 174,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fWrapAround",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 175,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fMatchCase",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 176,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\searchString",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 177,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\replaceString",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 178,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\szHeader",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 179,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\szTrailer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 180,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginTop",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 181,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginBottom",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 182,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginLeft",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 183,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iMarginRight",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 184,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosY",
          "content": "182"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 185,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosX",
          "content": "182"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 186,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosDX",
          "content": "1080"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 187,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\iWindowPosDY",
          "content": "624"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 188,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Notepad\\fMLE_is_broken",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,770",
        "eid": 189,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa3d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,785",
        "eid": 190,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,785",
        "eid": 191,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,832",
        "eid": 192,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,832",
        "eid": 193,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
          "content": "C:\\Windows\\Fonts\\staticcache.dat"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-06-30 02:36:16,832",
        "eid": 194,
        "data": {
          "file": "C:\\Windows\\Fonts\\StaticCache.dat"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,832",
        "eid": 195,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,832",
        "eid": 196,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
          "content": "SimSun-ExtB"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,832",
        "eid": 197,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,832",
        "eid": 198,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,832",
        "eid": 199,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 200,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 201,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 202,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 203,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 204,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 205,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 206,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 207,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 208,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 209,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 210,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 211,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 212,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 213,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\DllPath",
          "content": "%SystemRoot%\\system32\\windows.storage.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 214,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 215,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 216,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 217,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 218,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 219,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 220,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 221,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManager\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 222,
        "data": {
          "file": "C:\\Windows\\System32\\windows.storage.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a6230000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 223,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 224,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 225,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 226,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\DllPath",
          "content": "C:\\Windows\\System32\\efswrt.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 227,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 228,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\TrustLevel",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 229,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 230,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 231,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 232,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 233,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,848",
        "eid": 234,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.EnterpriseData.ProtectionPolicyManagerPrivatePT\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 235,
        "data": {
          "file": "C:\\Windows\\System32\\efswrt.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff987b80000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 236,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 237,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 238,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 239,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath",
          "content": "C:\\Windows\\System32\\twinapi.appcore.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 240,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 241,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 242,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 243,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 244,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 245,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 246,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 247,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 248,
        "data": {
          "file": "C:\\Windows\\System32\\twinapi.appcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a10f0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 249,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,863",
        "eid": 250,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 251,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 252,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 253,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 254,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 255,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 256,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 257,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 258,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 259,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 260,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 261,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 262,
        "data": {
          "file": "C:\\Windows\\System32\\WinTypes.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a4dc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 263,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 264,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,879",
        "eid": 265,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,895",
        "eid": 266,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,895",
        "eid": 267,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,895",
        "eid": 268,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,895",
        "eid": 269,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,895",
        "eid": 270,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,895",
        "eid": 271,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,895",
        "eid": 272,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,895",
        "eid": 273,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,910",
        "eid": 274,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{c50898f6-c536-5f47-8583-8b2c2438a13b}\\ProxyStubClsid32\\(Default)",
          "content": "{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,910",
        "eid": 275,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,910",
        "eid": 276,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,910",
        "eid": 277,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)",
          "content": "Ptype_PSFactory"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,910",
        "eid": 278,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,910",
        "eid": 279,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,910",
        "eid": 280,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 281,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 282,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 283,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 284,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\(Default)",
          "content": "Ptype_PSFactory"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 285,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 286,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 287,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 288,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,926",
        "eid": 289,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,941",
        "eid": 290,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff994050000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,941",
        "eid": 291,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,941",
        "eid": 292,
        "data": {
          "file": "user32",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa760000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,941",
        "eid": 293,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,957",
        "eid": 294,
        "data": {
          "file": "comctl32",
          "pathtofile": null,
          "moduleaddress": "0x7ff994050000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,957",
        "eid": 295,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,957",
        "eid": 296,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:16,957",
        "eid": 297,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,988",
        "eid": 298,
        "data": {
          "file": "C:\\Windows\\System32\\oleacc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff992900000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,988",
        "eid": 299,
        "data": {
          "file": "OLEAUT32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a9530000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,988",
        "eid": 300,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff994050000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:16,988",
        "eid": 301,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,051",
        "eid": 302,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,051",
        "eid": 303,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,051",
        "eid": 304,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,113",
        "eid": 305,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,113",
        "eid": 306,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,113",
        "eid": 307,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa760000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,113",
        "eid": 308,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,113",
        "eid": 309,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 310,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa760000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 311,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 312,
        "data": {
          "file": "api-ms-win-core-com-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a96b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 313,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 314,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 315,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 316,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 317,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 318,
        "data": {
          "file": "iertutil.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,129",
        "eid": 319,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,145",
        "eid": 320,
        "data": {
          "file": "C:\\Windows\\System32\\msctf.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a9a10000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,145",
        "eid": 321,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 322,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 323,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\LanmanWorkstation\\Parameters\\RpcCacheTimeout",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 324,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 325,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 326,
        "data": {
          "file": "user32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa760000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 327,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 328,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameTabWindow",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 329,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameTabWindow",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 330,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameMerging",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 331,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FrameMerging",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 332,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\SessionMerging",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 333,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\SessionMerging",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 334,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\AdminTabProcs",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 335,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\AdminTabProcs",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 336,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Security\\RunBinaryControlHostProcessInSeparateAppContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 337,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Security\\RunBinaryControlHostProcessInSeparateAppContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 338,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,207",
        "eid": 339,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 340,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 341,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\TabProcGrowth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 342,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 343,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 344,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 345,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 346,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 347,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 348,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 349,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 350,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,223",
        "eid": 351,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ini\\Content Type",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,238",
        "eid": 352,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa9f0000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:17,301",
        "eid": 353,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackDocs",
          "content": "0"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,301",
        "eid": 354,
        "data": {
          "file": "gdi32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,301",
        "eid": 355,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,301",
        "eid": 356,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,301",
        "eid": 357,
        "data": {
          "file": "user32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:17,301",
        "eid": 358,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,815",
        "eid": 359,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\Sink Transmit Buffer Size",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,815",
        "eid": 360,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\DefaultRpcStackSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,815",
        "eid": 361,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
          "content": "kernel32.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,815",
        "eid": 362,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9aa3d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,815",
        "eid": 363,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,815",
        "eid": 364,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,831",
        "eid": 365,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,847",
        "eid": 366,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,847",
        "eid": 367,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,847",
        "eid": 368,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,847",
        "eid": 369,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,847",
        "eid": 370,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,847",
        "eid": 371,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,847",
        "eid": 372,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,847",
        "eid": 373,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,878",
        "eid": 374,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff97fc40000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,878",
        "eid": 375,
        "data": {
          "file": "wmisvc.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,894",
        "eid": 376,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff97fc20000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,894",
        "eid": 377,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 378,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 379,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a8430000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 380,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 381,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff9a8430000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 382,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 383,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 384,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 385,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 386,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 387,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)",
          "content": "{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 388,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 389,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 390,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IWbemServices"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 391,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 392,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 393,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 394,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 395,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 396,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 397,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IWbemServices"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 398,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,909",
        "eid": 399,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,925",
        "eid": 400,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,925",
        "eid": 401,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,925",
        "eid": 402,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,925",
        "eid": 403,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff99dc10000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,925",
        "eid": 404,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,925",
        "eid": 405,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,925",
        "eid": 406,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,940",
        "eid": 407,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,940",
        "eid": 408,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,940",
        "eid": 409,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)",
          "content": "Microsoft WMI Provider Subsystem Host"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,940",
        "eid": 410,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,940",
        "eid": 411,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,940",
        "eid": 412,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,940",
        "eid": 413,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,956",
        "eid": 414,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wmiutils.dll",
          "pathtofile": null,
          "moduleaddress": "0x7ff99e310000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 415,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
          "content": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 416,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 417,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 418,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 419,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 420,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 421,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 422,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 423,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 424,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 425,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 426,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 427,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 428,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 429,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 430,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 431,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-06-30 02:36:29,972",
        "eid": 432,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-06-30 02:36:29,987",
        "eid": 433,
        "data": {
          "file": "ntdll",
          "pathtofile": null,
          "moduleaddress": null
        }
      }
    ],
    "encryptedbuffers": [],
    "network_map": {
      "endpoint_map": {},
      "http_host_map": {},
      "dns_intents": {},
      "http_requests": [],
      "winhttp_sessions": [],
      "com_activations": []
    }
  },
  "debug": {
    "log": "2026-06-29 14:58:59,948 [root] INFO: Date set to: 20260629T19:36:00, timeout set to: 15\n2026-06-29 19:36:00,470 [root] DEBUG: Starting analyzer from: C:\\7d7wfxi0\n2026-06-29 19:36:00,471 [root] DEBUG: Storing results at: C:\\BxeBJc\n2026-06-29 19:36:00,471 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\QYkbIs\n2026-06-29 19:36:00,471 [root] DEBUG: Python path: C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314\n2026-06-29 19:36:00,472 [root] INFO: analysis running as an admin\n2026-06-29 19:36:00,472 [root] DEBUG: no analysis package configured, picking one for you\n2026-06-29 19:36:00,473 [root] INFO: analysis package selected: \"generic\"\n2026-06-29 19:36:00,473 [root] DEBUG: importing analysis package module: \"modules.packages.generic\"...\n2026-06-29 19:36:00,478 [root] DEBUG: imported analysis package \"generic\"\n2026-06-29 19:36:00,479 [root] DEBUG: initializing analysis package \"generic\"...\n2026-06-29 19:36:00,479 [lib.common.common] INFO: no wrapping\n2026-06-29 19:36:00,480 [lib.core.compound] INFO: C:\\Users\\Rajesh\\AppData\\Local\\Temp already exists, skipping creation\n2026-06-29 19:36:00,480 [root] DEBUG: New location of moved file: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\n2026-06-29 19:36:00,481 [root] INFO: Analyzer: Package modules.packages.generic does not specify a dll option\n2026-06-29 19:36:00,481 [root] INFO: Analyzer: Package modules.packages.generic does not specify a dll_64 option\n2026-06-29 19:36:00,482 [root] INFO: Analyzer: Package modules.packages.generic does not specify a loader option\n2026-06-29 19:36:00,482 [root] INFO: Analyzer: Package modules.packages.generic does not specify a loader_64 option\n2026-06-29 19:36:00,733 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-06-29 19:36:00,745 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-06-29 19:36:00,785 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-06-29 19:36:01,132 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-06-29 19:36:01,139 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-06-29 19:36:01,139 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-06-29 19:36:01,140 [root] DEBUG: attempting to configure 'Browser' from data\n2026-06-29 19:36:01,143 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-06-29 19:36:01,144 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-06-29 19:36:01,159 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-06-29 19:36:01,159 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-06-29 19:36:01,160 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-06-29 19:36:01,161 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-06-29 19:36:01,162 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-06-29 19:36:01,162 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature\n2026-06-29 19:36:01,861 [modules.auxiliary.digisig] DEBUG: File has an invalid signature\n2026-06-29 19:36:01,861 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json\n2026-06-29 19:36:01,867 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-06-29 19:36:01,868 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-06-29 19:36:01,868 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-06-29 19:36:01,868 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-06-29 19:36:01,869 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-06-29 19:36:01,881 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 2624)\n2026-06-29 19:36:01,886 [modules.auxiliary.disguise] INFO: Disguising GUID to aaf550a6-7a62-4bb8-9d95-1e7652f2d63b\n2026-06-29 19:36:01,886 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-06-29 19:36:01,886 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-06-29 19:36:01,887 [root] DEBUG: attempting to configure 'Human' from data\n2026-06-29 19:36:01,887 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-06-29 19:36:01,887 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-06-29 19:36:01,903 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-06-29 19:36:01,903 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-06-29 19:36:01,903 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-06-29 19:36:01,904 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-06-29 19:36:01,904 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-06-29 19:36:01,906 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-06-29 19:36:01,906 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-06-29 19:36:08,392 [root] INFO: Restarting WMI Service\n2026-06-29 19:36:10,567 [root] DEBUG: package modules.packages.generic does not support configure, ignoring\n2026-06-29 19:36:10,569 [root] WARNING: configuration error for package modules.packages.generic: error importing data.packages.generic: No module named 'data.packages'\n2026-06-29 19:36:10,570 [lib.core.compound] INFO: C:\\Users\\Rajesh\\AppData\\Local\\Temp already exists, skipping creation\n2026-06-29 19:36:10,573 [lib.api.process] INFO: Successfully executed process from path \"C:\\Windows\\system32\\cmd.exe\" with arguments \"/c start /wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\"\" with pid 3792\n2026-06-29 19:36:10,830 [lib.api.process] INFO: Monitor config for process 3792: C:\\7d7wfxi0\\dll\\3792.ini\n2026-06-29 19:36:10,847 [lib.api.process] INFO: 64-bit DLL to inject is C:\\7d7wfxi0\\dll\\XVaHDaL.dll, loader C:\\7d7wfxi0\\bin\\OzgDrRsD.exe\n2026-06-29 19:36:10,875 [root] DEBUG: Loader: Injecting process 3792 (thread 2248) with C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:10,999 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-29 19:36:11,001 [root] DEBUG: Successfully injected DLL C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:11,008 [lib.api.process] INFO: Injected into 64-bit <Process 3792 cmd.exe>\n2026-06-29 19:36:13,028 [lib.api.process] INFO: Successfully resumed process with pid 3792\n2026-06-29 19:36:13,310 [root] DEBUG: 3792: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-29 19:36:13,317 [root] DEBUG: 3792: Disabling sleep skipping.\n2026-06-29 19:36:13,318 [root] DEBUG: 3792: Dropped file limit defaulting to 100.\n2026-06-29 19:36:13,352 [root] DEBUG: 3792: YaraInit: Compiled 44 rule files\n2026-06-29 19:36:13,357 [root] DEBUG: 3792: YaraInit: Compiled rules saved to file C:\\7d7wfxi0\\data\\yara\\capemon.yac\n2026-06-29 19:36:13,428 [root] DEBUG: 3792: RtlInsertInvertedFunctionTable 0x00007FF9AAA0090E, LdrpInvertedFunctionTableSRWLock 0x00007FF9AAB5B4F0\n2026-06-29 19:36:13,430 [root] DEBUG: 3792: YaraScan: Scanning 0x00007FF79A450000, size 0x6630a\n2026-06-29 19:36:13,437 [root] DEBUG: 3792: YaraScan hit: FindFixAndRun\n2026-06-29 19:36:13,439 [root] DEBUG: 3792: Monitor initialised: 64-bit capemon loaded in process 3792 at 0x00007FF9870C0000, thread 2248, image base 0x00007FF79A450000, stack from 0x000000F098A04000-0x000000F098B00000\n2026-06-29 19:36:13,440 [root] DEBUG: 3792: Commandline: \"C:\\Windows\\system32\\cmd.exe\" /c start /wait \"\" \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\"\n2026-06-29 19:36:13,466 [root] DEBUG: 3792: hook_api: LdrpCallInitRoutine export address 0x00007FF9AAA099BC obtained via GetFunctionAddress\n2026-06-29 19:36:13,535 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-06-29 19:36:13,536 [root] DEBUG: 3792: set_hooks: Unable to hook LockResource\n2026-06-29 19:36:13,554 [root] DEBUG: 3792: Hooked 630 out of 631 functions\n2026-06-29 19:36:13,561 [root] DEBUG: 3792: set_hooks_exe: Hooked FindFixAndRun at 0x00007FF79A45C620\n2026-06-29 19:36:13,565 [root] DEBUG: 3792: Syscall hook installed, syscall logging level 1\n2026-06-29 19:36:13,585 [root] DEBUG: 3792: RestoreHeaders: Restored original import table.\n2026-06-29 19:36:13,586 [root] INFO: Loaded monitor into process with pid 3792\n2026-06-29 19:36:13,588 [root] DEBUG: 3792: caller_dispatch: Added region at 0x00007FF79A450000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF79A4693C1, thread 2248).\n2026-06-29 19:36:13,591 [root] DEBUG: 3792: YaraScan: Scanning 0x00007FF79A450000, size 0x6630a\n2026-06-29 19:36:13,604 [root] DEBUG: 3792: ProcessImageBase: Main module image at 0x00007FF79A450000 unmodified (entropy change 0.000000e+00)\n2026-06-29 19:36:13,634 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A6030000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-06-29 19:36:13,637 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A8700000: C:\\Windows\\System32\\bcryptPrimitives (0x83000 bytes).\n2026-06-29 19:36:13,657 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A5B50000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-06-29 19:36:13,676 [root] DEBUG: 3792: DLL loaded at 0x00007FF994050000: C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\\comctl32 (0x29a000 bytes).\n2026-06-29 19:36:13,681 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A9D30000: C:\\Windows\\System32\\SHCORE (0xad000 bytes).\n2026-06-29 19:36:13,686 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A7A90000: C:\\Windows\\system32\\Wldp (0x2c000 bytes).\n2026-06-29 19:36:13,688 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A6230000: C:\\Windows\\SYSTEM32\\windows.storage (0x790000 bytes).\n2026-06-29 19:36:13,694 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A2720000: C:\\Windows\\system32\\PROPSYS (0xf6000 bytes).\n2026-06-29 19:36:13,717 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A9600000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-06-29 19:36:13,752 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A8050000: C:\\Windows\\system32\\profapi (0x1f000 bytes).\n2026-06-29 19:36:13,922 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A8110000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-06-29 19:36:13,940 [root] DEBUG: 3792: DLL loaded at 0x00007FF993730000: C:\\Windows\\system32\\edputil (0x24000 bytes).\n2026-06-29 19:36:13,994 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A1300000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-06-29 19:36:14,016 [root] DEBUG: 3792: DLL loaded at 0x00007FF9903B0000: C:\\Windows\\System32\\Windows.UI.AppDefaults (0x4c000 bytes).\n2026-06-29 19:36:14,093 [root] DEBUG: 3792: DLL loaded at 0x00007FF99F680000: C:\\Windows\\system32\\iertutil (0x2b0000 bytes).\n2026-06-29 19:36:14,095 [root] DEBUG: 3792: DLL loaded at 0x00007FF99F650000: C:\\Windows\\system32\\srvcli (0x28000 bytes).\n2026-06-29 19:36:14,096 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A75F0000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-06-29 19:36:14,099 [root] DEBUG: 3792: DLL loaded at 0x00007FF99F930000: C:\\Windows\\system32\\urlmon (0x1eb000 bytes).\n2026-06-29 19:36:14,111 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A7200000: C:\\Windows\\system32\\msvcp110_win (0x8a000 bytes).\n2026-06-29 19:36:14,113 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A35E0000: C:\\Windows\\SYSTEM32\\policymanager (0xa0000 bytes).\n2026-06-29 19:36:14,148 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A4DC0000: C:\\Windows\\System32\\wintypes (0x154000 bytes).\n2026-06-29 19:36:14,163 [root] DEBUG: 3792: DLL loaded at 0x00007FF99E080000: C:\\Windows\\System32\\Bcp47Langs (0x5c000 bytes).\n2026-06-29 19:36:14,164 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A6C60000: C:\\Windows\\System32\\sppc (0x25000 bytes).\n2026-06-29 19:36:14,166 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A6C90000: C:\\Windows\\System32\\SLC (0x29000 bytes).\n2026-06-29 19:36:14,167 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A7F80000: C:\\Windows\\System32\\USERENV (0x2e000 bytes).\n2026-06-29 19:36:14,168 [root] DEBUG: 3792: DLL loaded at 0x00007FF9971F0000: C:\\Windows\\System32\\appresolver (0x90000 bytes).\n2026-06-29 19:36:14,187 [root] DEBUG: 3792: DLL loaded at 0x00007FF99D480000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7d000 bytes).\n2026-06-29 19:36:14,209 [root] DEBUG: 3792: DLL loaded at 0x00007FF99EEA0000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x798000 bytes).\n2026-06-29 19:36:14,222 [lib.api.process] INFO: Monitor config for process 756: C:\\7d7wfxi0\\dll\\756.ini\n2026-06-29 19:36:14,227 [lib.api.process] INFO: 64-bit DLL to inject is C:\\7d7wfxi0\\dll\\XVaHDaL.dll, loader C:\\7d7wfxi0\\bin\\OzgDrRsD.exe\n2026-06-29 19:36:14,241 [root] DEBUG: Loader: Injecting process 756 with C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:14,250 [root] DEBUG: 756: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-29 19:36:14,251 [root] DEBUG: 756: Disabling sleep skipping.\n2026-06-29 19:36:14,252 [root] DEBUG: 756: Dropped file limit defaulting to 100.\n2026-06-29 19:36:14,256 [root] DEBUG: 756: Services hook set enabled\n2026-06-29 19:36:14,262 [root] DEBUG: 756: YaraInit: Compiled rules loaded from existing file C:\\7d7wfxi0\\data\\yara\\capemon.yac\n2026-06-29 19:36:14,285 [root] DEBUG: 756: RtlInsertInvertedFunctionTable 0x00007FF9AAA0090E, LdrpInvertedFunctionTableSRWLock 0x00007FF9AAB5B4F0\n2026-06-29 19:36:14,286 [root] DEBUG: 756: Monitor initialised: 64-bit capemon loaded in process 756 at 0x00007FF9870C0000, thread 1140, image base 0x00007FF69D480000, stack from 0x00000036AC4F4000-0x00000036AC500000\n2026-06-29 19:36:14,288 [root] DEBUG: 756: Commandline: C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p\n2026-06-29 19:36:14,313 [root] DEBUG: 756: Hooked 69 out of 69 functions\n2026-06-29 19:36:14,316 [root] INFO: Loaded monitor into process with pid 756\n2026-06-29 19:36:14,319 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-06-29 19:36:14,321 [root] DEBUG: Successfully injected DLL C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:14,324 [lib.api.process] INFO: Injected into 64-bit <Process 756 svchost.exe>\n2026-06-29 19:36:16,359 [root] DEBUG: 3792: CreateProcessHandler: Injection info set for new process 5060: C:\\Windows\\system32\\NOTEPAD.EXE, ImageBase: 0x00007FF737DC0000\n2026-06-29 19:36:16,361 [root] INFO: Announced 64-bit process name: notepad.exe pid: 5060\n2026-06-29 19:36:16,361 [lib.api.process] INFO: Monitor config for process 5060: C:\\7d7wfxi0\\dll\\5060.ini\n2026-06-29 19:36:16,366 [lib.api.process] INFO: 64-bit DLL to inject is C:\\7d7wfxi0\\dll\\XVaHDaL.dll, loader C:\\7d7wfxi0\\bin\\OzgDrRsD.exe\n2026-06-29 19:36:16,378 [root] DEBUG: Loader: Injecting process 5060 (thread 3940) with C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:16,379 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-29 19:36:16,382 [root] DEBUG: Successfully injected DLL C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:16,385 [lib.api.process] INFO: Injected into 64-bit <Process 5060 notepad.exe>\n2026-06-29 19:36:16,388 [root] INFO: Announced 64-bit process name: notepad.exe pid: 5060\n2026-06-29 19:36:16,389 [lib.api.process] INFO: Monitor config for process 5060: C:\\7d7wfxi0\\dll\\5060.ini\n2026-06-29 19:36:16,391 [lib.api.process] INFO: 64-bit DLL to inject is C:\\7d7wfxi0\\dll\\XVaHDaL.dll, loader C:\\7d7wfxi0\\bin\\OzgDrRsD.exe\n2026-06-29 19:36:16,402 [root] DEBUG: Loader: Injecting process 5060 (thread 3940) with C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:16,403 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-29 19:36:16,404 [root] DEBUG: Successfully injected DLL C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:16,407 [lib.api.process] INFO: Injected into 64-bit <Process 5060 notepad.exe>\n2026-06-29 19:36:16,411 [root] DEBUG: 3792: DLL loaded at 0x00007FF998030000: C:\\Windows\\system32\\MPR (0x1d000 bytes).\n2026-06-29 19:36:16,412 [root] DEBUG: 3792: DLL loaded at 0x00007FF9A31D0000: C:\\Windows\\SYSTEM32\\pcacli (0x16000 bytes).\n2026-06-29 19:36:16,436 [root] DEBUG: 5060: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-29 19:36:16,437 [root] DEBUG: 5060: Dropped file limit defaulting to 100.\n2026-06-29 19:36:16,450 [root] DEBUG: 5060: Disabling sleep skipping.\n2026-06-29 19:36:16,453 [root] DEBUG: 5060: YaraInit: Compiled rules loaded from existing file C:\\7d7wfxi0\\data\\yara\\capemon.yac\n2026-06-29 19:36:16,538 [root] DEBUG: 5060: RtlInsertInvertedFunctionTable 0x00007FF9AAA0090E, LdrpInvertedFunctionTableSRWLock 0x00007FF9AAB5B4F0\n2026-06-29 19:36:16,540 [root] DEBUG: 5060: YaraScan: Scanning 0x00007FF737DC0000, size 0x392ee\n2026-06-29 19:36:16,545 [root] DEBUG: 5060: Monitor initialised: 64-bit capemon loaded in process 5060 at 0x00007FF9870C0000, thread 3940, image base 0x00007FF737DC0000, stack from 0x00000097E611F000-0x00000097E6130000\n2026-06-29 19:36:16,546 [root] DEBUG: 5060: Commandline: \"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\n2026-06-29 19:36:16,568 [root] DEBUG: 5060: hook_api: LdrpCallInitRoutine export address 0x00007FF9AAA099BC obtained via GetFunctionAddress\n2026-06-29 19:36:16,633 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-06-29 19:36:16,635 [root] DEBUG: 5060: set_hooks: Unable to hook LockResource\n2026-06-29 19:36:16,650 [root] DEBUG: 5060: Hooked 630 out of 631 functions\n2026-06-29 19:36:16,656 [root] DEBUG: 5060: Syscall hook installed, syscall logging level 1\n2026-06-29 19:36:16,667 [root] DEBUG: 5060: RestoreHeaders: Restored original import table.\n2026-06-29 19:36:16,668 [root] INFO: Loaded monitor into process with pid 5060\n2026-06-29 19:36:16,679 [root] DEBUG: 5060: caller_dispatch: Added region at 0x00007FF737DC0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF737DE5842, thread 3940).\n2026-06-29 19:36:16,681 [root] DEBUG: 5060: YaraScan: Scanning 0x00007FF737DC0000, size 0x392ee\n2026-06-29 19:36:16,690 [root] DEBUG: 5060: ProcessImageBase: Main module image at 0x00007FF737DC0000 unmodified (entropy change 0.000000e+00)\n2026-06-29 19:36:16,695 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A8700000: C:\\Windows\\System32\\bcryptPrimitives (0x83000 bytes).\n2026-06-29 19:36:16,703 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A6030000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-06-29 19:36:16,707 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A5B50000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-06-29 19:36:16,714 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A9600000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-06-29 19:36:16,725 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A06E0000: C:\\Windows\\System32\\MrmCoreR (0xf5000 bytes).\n2026-06-29 19:36:16,764 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A7A90000: C:\\Windows\\system32\\Wldp (0x2c000 bytes).\n2026-06-29 19:36:16,765 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A6230000: C:\\Windows\\SYSTEM32\\windows.storage (0x790000 bytes).\n2026-06-29 19:36:16,776 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A9A10000: C:\\Windows\\System32\\MSCTF (0x115000 bytes).\n2026-06-29 19:36:16,830 [root] DEBUG: 5060: DLL loaded at 0x00007FF998F00000: C:\\Windows\\system32\\TextShaping (0xac000 bytes).\n2026-06-29 19:36:16,854 [root] DEBUG: 5060: DLL loaded at 0x00007FF998030000: C:\\Windows\\System32\\MPR (0x1d000 bytes).\n2026-06-29 19:36:16,856 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A4DC0000: C:\\Windows\\SYSTEM32\\wintypes (0x154000 bytes).\n2026-06-29 19:36:16,857 [root] DEBUG: 5060: DLL loaded at 0x00007FF987B80000: C:\\Windows\\System32\\efswrt (0xde000 bytes).\n2026-06-29 19:36:16,867 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A10F0000: C:\\Windows\\System32\\twinapi.appcore (0x201000 bytes).\n2026-06-29 19:36:16,982 [root] DEBUG: 5060: DLL loaded at 0x00007FF992900000: C:\\Windows\\System32\\oleacc (0x66000 bytes).\n2026-06-29 19:36:17,099 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A6E00000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-06-29 19:36:17,102 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A57F0000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-06-29 19:36:17,103 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A5490000: C:\\Windows\\System32\\CoreUIComponents (0x35e000 bytes).\n2026-06-29 19:36:17,104 [root] DEBUG: 5060: DLL loaded at 0x00007FF99BC00000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-06-29 19:36:17,191 [root] DEBUG: 5060: DLL loaded at 0x00007FF99F680000: C:\\Windows\\system32\\iertutil (0x2b0000 bytes).\n2026-06-29 19:36:17,193 [root] DEBUG: 5060: DLL loaded at 0x00007FF99F650000: C:\\Windows\\system32\\srvcli (0x28000 bytes).\n2026-06-29 19:36:17,196 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A75F0000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-06-29 19:36:17,200 [root] DEBUG: 5060: DLL loaded at 0x00007FF99F930000: C:\\Windows\\system32\\urlmon (0x1eb000 bytes).\n2026-06-29 19:36:17,237 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A9450000: C:\\Windows\\System32\\COMDLG32 (0xda000 bytes).\n2026-06-29 19:36:17,244 [root] DEBUG: 5060: DLL loaded at 0x00007FF9A2720000: C:\\Windows\\system32\\PROPSYS (0xf6000 bytes).\n2026-06-29 19:36:27,999 [root] DEBUG: 756: CreateProcessHandler: Injection info set for new process 1820: C:\\Windows\\system32\\wbem\\wmiprvse.exe, ImageBase: 0x00007FF712FE0000\n2026-06-29 19:36:28,001 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 1820\n2026-06-29 19:36:28,002 [lib.api.process] INFO: Monitor config for process 1820: C:\\7d7wfxi0\\dll\\1820.ini\n2026-06-29 19:36:28,251 [root] INFO: Analysis timeout hit, terminating analysis\n2026-06-29 19:36:28,253 [lib.api.process] INFO: Terminate event set for process 3792\n2026-06-29 19:36:28,254 [root] DEBUG: 3792: Terminate Event: Attempting to dump process 3792\n2026-06-29 19:36:28,258 [root] DEBUG: 3792: VerifyCodeSection: Executable code does not match, 0xb620 of 0x30ef9 matching\n2026-06-29 19:36:28,259 [root] DEBUG: 3792: DoProcessDump: Code modification detected, dumping Imagebase at 0x00007FF79A450000.\n2026-06-29 19:36:28,261 [root] DEBUG: 3792: DumpImageInCurrentProcess: Attempting to dump virtual PE image.\n2026-06-29 19:36:28,262 [root] DEBUG: 3792: DumpProcess: Instantiating PeParser with address: 0x00007FF79A450000.\n2026-06-29 19:36:28,263 [root] DEBUG: 3792: DumpProcess: Module entry point VA is 0x00007FF79A468F50.\n2026-06-29 19:36:28,286 [lib.common.results] INFO: Uploading file C:\\BxeBJc\\CAPE\\3792_108242836230262026 to procdump\\f4dd0d951a26f0fe9d8ea0afcbfb650ce05b3e9e3d31cfdc394da2f1fe8dc80d; Size is 401920; Max size: 100000000\n2026-06-29 19:36:28,324 [root] DEBUG: 3792: DumpProcess: Module image dump success - dump size 0x62200.\n2026-06-29 19:36:28,340 [root] DEBUG: 3792: Terminate Event: Shutdown complete for process 3792 but failed to inform analyzer.\n2026-06-29 19:36:29,500 [lib.api.process] INFO: 64-bit DLL to inject is C:\\7d7wfxi0\\dll\\XVaHDaL.dll, loader C:\\7d7wfxi0\\bin\\OzgDrRsD.exe\n2026-06-29 19:36:29,524 [root] DEBUG: Loader: Injecting process 1820 (thread 3596) with C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:29,527 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-29 19:36:29,530 [root] DEBUG: Successfully injected DLL C:\\7d7wfxi0\\dll\\XVaHDaL.dll.\n2026-06-29 19:36:29,535 [lib.api.process] INFO: Injected into 64-bit <Process 1820 WmiPrvSE.exe>\n2026-06-29 19:36:29,561 [root] DEBUG: 1820: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-29 19:36:29,562 [root] DEBUG: 1820: Dropped file limit defaulting to 100.\n2026-06-29 19:36:29,575 [root] DEBUG: 1820: Disabling sleep skipping.\n2026-06-29 19:36:29,577 [root] DEBUG: 1820: YaraInit: Compiled rules loaded from existing file C:\\7d7wfxi0\\data\\yara\\capemon.yac\n2026-06-29 19:36:29,608 [root] DEBUG: 1820: RtlInsertInvertedFunctionTable 0x00007FF9AAA0090E, LdrpInvertedFunctionTableSRWLock 0x00007FF9AAB5B4F0\n2026-06-29 19:36:29,614 [root] DEBUG: 1820: YaraScan: Scanning 0x00007FF712FE0000, size 0x7dcfe\n2026-06-29 19:36:29,624 [root] DEBUG: 1820: Monitor initialised: 64-bit capemon loaded in process 1820 at 0x00007FF9870C0000, thread 3596, image base 0x00007FF712FE0000, stack from 0x0000002D0E470000-0x0000002D0E480000\n2026-06-29 19:36:29,626 [root] DEBUG: 1820: Commandline: C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding\n2026-06-29 19:36:29,653 [root] DEBUG: 1820: hook_api: LdrpCallInitRoutine export address 0x00007FF9AAA099BC obtained via GetFunctionAddress\n2026-06-29 19:36:29,751 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-06-29 19:36:29,754 [root] DEBUG: 1820: set_hooks: Unable to hook LockResource\n2026-06-29 19:36:29,769 [root] DEBUG: 1820: Hooked 630 out of 631 functions\n2026-06-29 19:36:29,777 [root] DEBUG: 1820: Syscall hook installed, syscall logging level 1\n2026-06-29 19:36:29,789 [root] DEBUG: 1820: RestoreHeaders: Restored original import table.\n2026-06-29 19:36:29,790 [root] INFO: Loaded monitor into process with pid 1820\n2026-06-29 19:36:29,793 [root] DEBUG: 1820: caller_dispatch: Added region at 0x00007FF712FE0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF712FF2CD1, thread 3596).\n2026-06-29 19:36:29,795 [root] DEBUG: 1820: YaraScan: Scanning 0x00007FF712FE0000, size 0x7dcfe\n2026-06-29 19:36:29,808 [root] DEBUG: 1820: ProcessImageBase: Main module image at 0x00007FF712FE0000 unmodified (entropy change 0.000000e+00)\n2026-06-29 19:36:29,830 [root] DEBUG: 1820: DLL loaded at 0x00007FF9A6030000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-06-29 19:36:29,833 [root] DEBUG: 1820: DLL loaded at 0x00007FF9A8700000: C:\\Windows\\System32\\bcryptPrimitives (0x83000 bytes).\n2026-06-29 19:36:29,855 [root] DEBUG: 1820: DLL loaded at 0x00007FF9A9600000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-06-29 19:36:29,867 [root] DEBUG: 1820: DLL loaded at 0x00007FF97FC40000: C:\\Windows\\system32\\wbem\\wbemprox (0x11000 bytes).\n2026-06-29 19:36:29,890 [root] DEBUG: 1820: DLL loaded at 0x00007FF97FC20000: C:\\Windows\\system32\\wbem\\wbemsvc (0x14000 bytes).\n2026-06-29 19:36:29,955 [root] DEBUG: 1820: DLL loaded at 0x00007FF99E310000: C:\\Windows\\system32\\wbem\\wmiutils (0x28000 bytes).\n2026-06-29 19:36:33,251 [lib.api.process] INFO: Termination confirmed for process 3792\n2026-06-29 19:36:33,252 [root] INFO: Terminate event set for process 3792\n2026-06-29 19:36:33,252 [lib.api.process] INFO: Terminate event set for process 756\n2026-06-29 19:36:33,253 [root] DEBUG: 756: Terminate Event: Attempting to dump process 756\n2026-06-29 19:36:33,255 [root] DEBUG: 756: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-06-29 19:36:33,260 [lib.api.process] INFO: Termination confirmed for process 756\n2026-06-29 19:36:33,260 [root] DEBUG: 756: Terminate Event: monitor shutdown complete for process 756\n2026-06-29 19:36:33,260 [root] INFO: Terminate event set for process 756\n2026-06-29 19:36:33,261 [lib.api.process] INFO: Terminate event set for process 5060\n2026-06-29 19:36:33,262 [root] DEBUG: 5060: Terminate Event: Attempting to dump process 5060\n2026-06-29 19:36:33,264 [root] DEBUG: 5060: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-06-29 19:36:33,277 [root] DEBUG: 5060: Terminate Event: Shutdown complete for process 5060 but failed to inform analyzer.\n2026-06-29 19:36:38,252 [lib.api.process] INFO: Termination confirmed for process 5060\n2026-06-29 19:36:38,253 [root] INFO: Terminate event set for process 5060\n2026-06-29 19:36:38,253 [lib.api.process] INFO: Terminate event set for process 1820\n2026-06-29 19:36:38,254 [root] DEBUG: 1820: Terminate Event: Attempting to dump process 1820\n2026-06-29 19:36:38,256 [root] DEBUG: 1820: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-06-29 19:36:38,265 [lib.api.process] INFO: Termination confirmed for process 1820\n2026-06-29 19:36:38,266 [root] INFO: Terminate event set for process 1820\n2026-06-29 19:36:38,266 [root] DEBUG: 1820: Terminate Event: monitor shutdown complete for process 1820\n2026-06-29 19:36:38,266 [root] INFO: Created shutdown mutex\n2026-06-29 19:36:39,276 [root] INFO: Shutting down package\n2026-06-29 19:36:39,277 [root] INFO: Stopping auxiliary modules\n2026-06-29 19:36:39,277 [root] INFO: Stopping auxiliary module: Browser\n2026-06-29 19:36:39,278 [root] INFO: Stopping auxiliary module: Human\n2026-06-29 19:36:39,699 [root] INFO: Finishing auxiliary modules\n2026-06-29 19:36:39,700 [root] INFO: Shutting down pipe server and dumping dropped files\n2026-06-29 19:36:39,705 [root] WARNING: Folder at path \"C:\\BxeBJc\\debugger\" does not exist, skipping\n2026-06-29 19:36:39,709 [root] WARNING: Folder at path \"C:\\BxeBJc\\tlsdump\" does not exist, skipping\n2026-06-29 19:36:39,711 [root] INFO: Analysis completed\n",
    "errors": []
  },
  "network": {
    "pcap_sha256": "87dc2db16fca7d3c5060786aa91bde3143779aad8dcb7d35c61bfe216ac3dd5b",
    "hosts": [
      {
        "ip": "108.177.15.94",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "64.233.167.101",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "142.251.14.94",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "beacons.gcp.gvt2.com",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "142.251.16.94",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "172.253.157.95",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      },
      {
        "ip": "151.101.206.172",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          80
        ]
      },
      {
        "ip": "20.190.159.23",
        "country_name": "unknown",
        "asn": "",
        "asn_name": "",
        "hostname": "",
        "inaddrarpa": "",
        "ports": [
          443
        ]
      }
    ],
    "domains": [
      {
        "domain": "beacons.gcp.gvt2.com",
        "ip": "142.251.14.94"
      }
    ],
    "tcp": [
      {
        "src": "192.168.122.139",
        "sport": 49769,
        "dst": "20.190.159.23",
        "dport": 443,
        "offset": 24,
        "time": 0.0
      },
      {
        "src": "192.168.122.139",
        "sport": 49780,
        "dst": "20.190.159.23",
        "dport": 443,
        "offset": 7260,
        "time": 0.29377007484436035
      },
      {
        "src": "192.168.122.139",
        "sport": 49781,
        "dst": "151.101.206.172",
        "dport": 80,
        "offset": 17878,
        "time": 0.3956930637359619
      },
      {
        "src": "192.168.122.139",
        "sport": 49782,
        "dst": "151.101.206.172",
        "dport": 80,
        "offset": 34585,
        "time": 0.5342261791229248
      },
      {
        "src": "192.168.122.139",
        "sport": 49755,
        "dst": "172.253.157.95",
        "dport": 443,
        "offset": 44298,
        "time": 16.118499994277954
      },
      {
        "src": "192.168.122.139",
        "sport": 49763,
        "dst": "74.125.206.138",
        "dport": 443,
        "offset": 45266,
        "time": 22.115811109542847
      },
      {
        "src": "192.168.122.139",
        "sport": 49754,
        "dst": "142.251.16.94",
        "dport": 443,
        "offset": 50106,
        "time": 22.17026114463806
      },
      {
        "src": "192.168.122.139",
        "sport": 49787,
        "dst": "142.251.14.94",
        "dport": 443,
        "offset": 51842,
        "time": 22.280014038085938
      },
      {
        "src": "142.251.14.94",
        "sport": 443,
        "dst": "192.168.122.139",
        "dport": 49788,
        "offset": 59437,
        "time": 23.917618989944458
      },
      {
        "src": "192.168.122.139",
        "sport": 49757,
        "dst": "64.233.167.101",
        "dport": 443,
        "offset": 59650,
        "time": 36.103142976760864
      },
      {
        "src": "192.168.122.139",
        "sport": 49758,
        "dst": "108.177.15.94",
        "dport": 443,
        "offset": 59791,
        "time": 36.987842082977295
      }
    ],
    "udp": [
      {
        "src": "192.168.122.139",
        "sport": 56312,
        "dst": "192.168.122.1",
        "dport": 53,
        "offset": 44946,
        "time": 22.111147165298462
      },
      {
        "src": "192.168.122.139",
        "sport": 61788,
        "dst": "192.168.122.1",
        "dport": 53,
        "offset": 51358,
        "time": 22.26447296142578
      }
    ],
    "icmp": [],
    "http": [],
    "dns": [
      {
        "request": "beacons.gcp.gvt2.com",
        "type": "A",
        "answers": [
          {
            "type": "CNAME",
            "data": "beacons-handoff.gcp.gvt2.com"
          },
          {
            "type": "A",
            "data": "142.251.14.94"
          }
        ],
        "first_seen": 1782761788.892609
      }
    ],
    "smtp": [],
    "irc": [],
    "dead_hosts": []
  },
  "url_analysis": {},
  "procmemory": [],
  "signatures": [
    {
      "name": "stealth_network",
      "description": "Network activity detected but not expressed in monitor API logs",
      "categories": [
        "stealth"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "ip": "108.177.15.94"
        },
        {
          "ip": "64.233.167.101"
        },
        {
          "ip": "142.251.14.94"
        },
        {
          "ip": "142.251.16.94"
        },
        {
          "ip": "172.253.157.95"
        },
        {
          "ip": "151.101.206.172"
        },
        {
          "ip": "20.190.159.23"
        },
        {
          "domain": "beacons.gcp.gvt2.com"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "antivm_checks_available_memory",
      "description": "Checks available memory",
      "categories": [
        "antivm"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5060,
          "cid": 1391
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "queries_keyboard_layout",
      "description": "Queries the keyboard layout",
      "categories": [
        "location_discovery"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5060,
          "cid": 922
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 927
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1001
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1026
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1135
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1262
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1270
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1272
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1274
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1282
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1485
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1489
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1557
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "queries_locale_api",
      "description": "Queries the computer locale (possible geofencing)",
      "categories": [
        "location_discovery",
        "geofence"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 3792,
          "cid": 62
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 388
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 464
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "antidebug_setunhandledexceptionfilter",
      "description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
      "categories": [
        "anti-debug"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 40,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 3792,
          "cid": 15
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "language_check_registry",
      "description": "Checks system language via registry key (possible geofencing)",
      "categories": [
        "location_discovery",
        "geofence"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
        },
        {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "privilege_elevation_check",
      "description": "Queries process token information to check for Administrator privileges or UAC elevation status",
      "categories": [
        "discovery",
        "privilege_escalation"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 80,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 5060,
          "cid": 117
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1383
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1410
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 1544
        },
        {
          "type": "call",
          "pid": 1820,
          "cid": 130
        },
        {
          "type": "call",
          "pid": 1820,
          "cid": 131
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "query_fips_reconnaissance",
      "description": "Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software",
      "categories": [
        "discovery",
        "c2"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 3792,
          "cid": 124
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 125
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 128
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 130
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 131
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 56
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 57
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 60
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 62
        },
        {
          "type": "call",
          "pid": 5060,
          "cid": 63
        },
        {
          "type": "call",
          "pid": 1820,
          "cid": 96
        },
        {
          "type": "call",
          "pid": 1820,
          "cid": 97
        },
        {
          "type": "call",
          "pid": 1820,
          "cid": 100
        },
        {
          "type": "call",
          "pid": 1820,
          "cid": 102
        },
        {
          "type": "call",
          "pid": 1820,
          "cid": 103
        },
        {
          "behavioral_fips_reconnaissance": [
            "notepad.exe (PID: 5060) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "notepad.exe (PID: 5060) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'",
            "WmiPrvSE.exe (PID: 1820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "cmd.exe (PID: 3792) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "notepad.exe (PID: 5060) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'",
            "notepad.exe (PID: 5060) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "WmiPrvSE.exe (PID: 1820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'",
            "cmd.exe (PID: 3792) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "notepad.exe (PID: 5060) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "WmiPrvSE.exe (PID: 1820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "cmd.exe (PID: 3792) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "WmiPrvSE.exe (PID: 1820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'",
            "WmiPrvSE.exe (PID: 1820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "cmd.exe (PID: 3792) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'",
            "cmd.exe (PID: 3792) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'"
          ]
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "mountpoints_volume_discovery",
      "description": "Queries the mount points and then resolves volume paths to enumerate storage devices",
      "categories": [
        "discovery",
        "ransomware",
        "wiper"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 20,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 3792,
          "cid": 215
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 220
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 229
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 230
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 236
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 245
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 248
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 253
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "creates_suspended_process",
      "description": "Creates a process in a suspended state, likely for injection",
      "categories": [
        "injection",
        "process hollowing"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 3792,
          "cid": 622
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "discover_registry_mount_points",
      "description": "Queries registry mount points to identify historical or connected removable/network drives",
      "categories": [
        "discovery",
        "ransomware",
        "wiper"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 20,
      "references": [],
      "data": [
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "process_creation_suspicious_location",
      "description": "Created a process from a suspicious location",
      "categories": [
        "execution"
      ],
      "severity": 3,
      "weight": 1,
      "confidence": 20,
      "references": [],
      "data": [
        {
          "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini"
        },
        {
          "command": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\rufus.ini\" "
        },
        {
          "type": "call",
          "pid": 3792,
          "cid": 89
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    }
  ],
  "malscore": 5.300000000000001,
  "ttps": [
    {
      "signature": "stealth_network",
      "ttps": [
        "T1071"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "antivm_checks_available_memory",
      "ttps": [
        "T1082"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "privilege_elevation_check",
      "ttps": [
        "T1033",
        "T1082"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "query_fips_reconnaissance",
      "ttps": [
        "T1082"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "mountpoints_volume_discovery",
      "ttps": [
        "T1082"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "process_creation_suspicious_location",
      "ttps": [
        "T1106"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "creates_suspended_process",
      "ttps": [
        "T1055"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    },
    {
      "signature": "discover_registry_mount_points",
      "ttps": [
        "T1082"
      ],
      "mbcs": [
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002",
        "OC0006",
        "C0002"
      ]
    }
  ],
  "malstatus": null
}