{ "statistics": { "processing": [ { "name": "CAPE", "time": 13.131 }, { "name": "AnalysisInfo", "time": 0.009 }, { "name": "BehaviorAnalysis", "time": 0.169 }, { "name": "Debug", "time": 0.001 }, { "name": "NetworkAnalysis", "time": 0.082 }, { "name": "UrlAnalysis", "time": 0.0 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antiemu_wine_func", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "antisandbox_mouse_hook", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "hardware_id_profiling", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "amsi_enumeration", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "suspicious_ntdll_disk_load", "time": 0.0 }, { "name": "direct_syscall_evasion", "time": 0.0 }, { "name": "unbacked_syscall_execution", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "privilege_elevation_check", "time": 0.0 }, { "name": "dotnet_code_compile", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "query_fips_reconnaissance", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "decoy_document", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_self", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "dllload_suspicious_directory", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "install_kernel_driver_service", "time": 0.0 }, { "name": "malformed_dll_loading", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "encrypted_ioc", "time": 0.0 }, { "name": "registers_vectored_exception_handler", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "infostealer_keylog", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_module_stomping_probing", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "injection_rwx", "time": 0.0 }, { "name": "section_mapping_injection", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "apc_injection", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "interprocess_comms_mutex", "time": 0.0 }, { "name": "interprocess_comms_named_pipe", "time": 0.0 }, { "name": "interprocess_comms_shared_memory", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "unbacked_exception_filter", "time": 0.0 }, { "name": "unbacked_process_mitigation_alteration", "time": 0.0 }, { "name": "thread_unbacked_memory", "time": 0.0 }, { "name": "unbacked_api_resolution", "time": 0.0 }, { "name": "unbacked_dotnet_execution", "time": 0.0 }, { "name": "unbacked_library_load", "time": 0.0 }, { "name": "unbacked_memory_apc_execution", "time": 0.0 }, { "name": "unbacked_memory_protection_alteration", "time": 0.0 }, { "name": "unbacked_mutex_creation", "time": 0.0 }, { "name": "unbacked_process_creation", "time": 0.0 }, { "name": "unbacked_veh_registration", "time": 0.0 }, { "name": "unbacked_com_instantiation", "time": 0.0 }, { "name": "unbacked_crypto_operations", "time": 0.0 }, { "name": "unbacked_delay_execution", "time": 0.0 }, { "name": "unbacked_file_dropping", "time": 0.0 }, { "name": "unbacked_process_enumeration", "time": 0.0 }, { "name": "unbacked_registry_modification", "time": 0.0 }, { "name": "unbacked_service_manipulation", "time": 0.0 }, { "name": "unbacked_token_manipulation", "time": 0.0 }, { "name": "unbacked_wmi_execution", "time": 0.0 }, { "name": "unbacked_bind_shell", "time": 0.0 }, { "name": "unbacked_dns_resolution", "time": 0.0 }, { "name": "unbacked_memory_network_connection", "time": 0.0 }, { "name": "unbacked_named_pipe_creation", "time": 0.0 }, { "name": "unbacked_useragent_retrieval", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "etherhiding_smart_contract_call", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "network_document_http", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "office_write_exe", "time": 0.0 }, { "name": "decompress_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_network_connection", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "ransomware_iocp_asynchronous_encryption", "time": 0.0 }, { "name": "kernel_crypto_driver_abuse", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_extension_hijack", "time": 0.0 }, { "name": "mass_file_modification_access", "time": 0.0 }, { "name": "ransomware_attribute_stripping", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "mass_ransom_note_drop", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "reads_self", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "removes_zoneid_ads", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_file", "time": 0.0 }, { "name": "stealth_system_procname", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "binary_yara", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "byod_loldrivers_match", "time": 0.0 }, { "name": "byod_novel_driver", "time": 0.0 }, { "name": "byod_post_load_exploitation", "time": 0.0 }, { "name": "byod_driver_service_install", "time": 0.0 }, { "name": "com_spawned_process", "time": 0.0 }, { "name": "phishing_kit_detected", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_country_distribution", "time": 0.0 }, { "name": "network_cnc_http", "time": 0.001 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.002 }, { "name": "network_excessive_udp", "time": 0.0 }, { "name": "network_http", "time": 0.0 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_questionable_http_path", "time": 0.0 }, { "name": "network_questionable_https_path", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.001 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "pe_deep_entrypoint", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pdf_annot_urls_checker", "time": 0.0 }, { "name": "pe_cert_invalid_signature", "time": 0.0 }, { "name": "pe_cert_self_signed", "time": 0.0 }, { "name": "pe_cert_suspicious_issuer", "time": 0.0 }, { "name": "polymorphic", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.001 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "browser_credential_theft_headless", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "suspicious_html_body", "time": 0.0 }, { "name": "suspicious_html_name", "time": 0.0 }, { "name": "suspicious_html_title", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.0 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.002 }, { "name": "antianalysis_detectreg", "time": 0.016 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.004 }, { "name": "antiav_detectreg", "time": 0.077 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.001 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.001 }, { "name": "antivm_generic_bios", "time": 0.001 }, { "name": "antivm_generic_diskreg", "time": 0.003 }, { "name": "antivm_hyperv_keys", "time": 0.001 }, { "name": "antivm_parallels_keys", "time": 0.005 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.0 }, { "name": "antivm_vbox_files", "time": 0.002 }, { "name": "antivm_vbox_keys", "time": 0.008 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.001 }, { "name": "antivm_vmware_keys", "time": 0.006 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.003 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.004 }, { "name": "ketrican_regkeys", "time": 0.001 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.001 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "executes_headless_browser", "time": 0.001 }, { "name": "suspicious_browser_arguments", "time": 0.001 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.0 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.001 }, { "name": "checks_uac_status", "time": 0.0 }, { "name": "uac_bypass_cmstpcom", "time": 0.0 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_credential_store_access", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.0 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.001 }, { "name": "disables_browser_warn", "time": 0.0 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.0 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.0 }, { "name": "removes_windows_defender_contextmenu", "time": 0.0 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "folder_enumeration", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.0 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "infostealer_bitcoin", "time": 0.003 }, { "name": "infostealer_ftp", "time": 0.028 }, { "name": "infostealer_im", "time": 0.015 }, { "name": "infostealer_mail", "time": 0.006 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.003 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "modify_certs", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.0 }, { "name": "modify_uac_prompt", "time": 0.0 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.001 }, { "name": "network_dns_paste_site", "time": 0.001 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.001 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.005 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.004 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.0 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.0 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.004 }, { "name": "ransomware_files", "time": 0.006 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.001 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.0 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.0 }, { "name": "tampers_etw", "time": 0.0 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.026 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.005 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.005 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "target": { "category": "file", "file": { "name": "uninstalltool_setup.exe", "path": "/opt/CAPEv2/storage/binaries/3f1603b39d0d581e9cdf71b099c189b00b49bc80bac73e830b63d3274381729b", "guest_paths": "", "size": 6985928, "crc32": "C4D6324A", "md5": "c43f212ae8758298a049571c88405b6a", "sha1": "cdc319edf82ad986369d1e1cf5e74e7d3c7acb90", "sha256": "3f1603b39d0d581e9cdf71b099c189b00b49bc80bac73e830b63d3274381729b", "sha512": "380b597729bf58976d074fa14159725bdee2c7dd2070904a236ee1c6d531846b194b7c4b3f8a56258048308aaaed5ad4e73b073e586427d97994b2b2a615dce4", "rh_hash": null, "ssdeep": "98304:7N66aQvqWPXtovUpAJLPMdYUnTzlLuT7wuxb/0exb6JAoMBgYV6E0wf98Ms3lGMG:bZv+nJLP9qflCP7B3088MGlGMG", "type": "PE32 executable (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T192661233B28A633EE06E1A3759F692205D3B6A11A45E8C4697F04C4CDF6D1B02E7E747", "sha3_384": "b348051be4c7d756bba1fd9c48a901f9f072c9ed587eafbbe31bf448fe47cb43545e710d5ff4bf5bab1bb68281b6e91b", "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce", "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "File not found: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\109\\uninstalltool_setup.exe", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x000afe60", "ep_bytes": "558bec83c49053565733c08945b08945", "peid_signatures": null, "reported_checksum": "0x006b373e", "actual_checksum": "0x006b373e", "osversion": "6.1", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "kernel32": { "dll": "kernel32.dll", "imports": [ { "address": "0x4bd2dc", "name": "GetACP" }, { "address": "0x4bd2e0", "name": "GetExitCodeProcess" }, { "address": "0x4bd2e4", "name": "CloseHandle" }, { "address": "0x4bd2e8", "name": "LocalFree" }, { "address": "0x4bd2ec", "name": "SizeofResource" }, { "address": "0x4bd2f0", "name": "VirtualProtect" }, { "address": "0x4bd2f4", "name": "QueryPerformanceFrequency" }, { "address": "0x4bd2f8", "name": "VirtualFree" }, { "address": "0x4bd2fc", "name": "GetFullPathNameW" }, { "address": "0x4bd300", "name": "GetProcessHeap" }, { "address": "0x4bd304", "name": "ExitProcess" }, { "address": "0x4bd308", "name": "HeapAlloc" }, { "address": "0x4bd30c", "name": "GetCPInfoExW" }, { "address": "0x4bd310", "name": "RtlUnwind" }, { "address": "0x4bd314", "name": "SetFilePointerEx" }, { "address": "0x4bd318", "name": "GetCPInfo" }, { "address": "0x4bd31c", "name": "GetStdHandle" }, { "address": "0x4bd320", "name": "GetModuleHandleW" }, { "address": "0x4bd324", "name": "FreeLibrary" }, { "address": "0x4bd328", "name": "HeapDestroy" }, { "address": "0x4bd32c", "name": "ReadFile" }, { "address": "0x4bd330", "name": "CreateProcessW" }, { "address": "0x4bd334", "name": "GetLastError" }, { "address": "0x4bd338", "name": "GetModuleFileNameW" }, { "address": "0x4bd33c", "name": "SetLastError" }, { "address": "0x4bd340", "name": "FindResourceW" }, { "address": "0x4bd344", "name": "CreateThread" }, { "address": "0x4bd348", "name": "CompareStringW" }, { "address": "0x4bd34c", "name": "GetFileSizeEx" }, { "address": "0x4bd350", "name": "LoadLibraryA" }, { "address": "0x4bd354", "name": "ResetEvent" }, { "address": "0x4bd358", "name": "GetVolumeInformationW" }, { "address": "0x4bd35c", "name": "GetVersion" }, { "address": "0x4bd360", "name": "GetDriveTypeW" }, { "address": "0x4bd364", "name": "RaiseException" }, { "address": "0x4bd368", "name": "FormatMessageW" }, { "address": "0x4bd36c", "name": "SwitchToThread" }, { "address": "0x4bd370", "name": "GetExitCodeThread" }, { "address": "0x4bd374", "name": "GetCurrentThread" }, { "address": "0x4bd378", "name": "LoadLibraryExW" }, { "address": "0x4bd37c", "name": "LockResource" }, { "address": "0x4bd380", "name": "GetCurrentThreadId" }, { "address": "0x4bd384", "name": "UnhandledExceptionFilter" }, { "address": "0x4bd388", "name": "VirtualQuery" }, { "address": "0x4bd38c", "name": "VirtualQueryEx" }, { "address": "0x4bd390", "name": "Sleep" }, { "address": "0x4bd394", "name": "EnterCriticalSection" }, { "address": "0x4bd398", "name": "LoadResource" }, { "address": "0x4bd39c", "name": "SuspendThread" }, { "address": "0x4bd3a0", "name": "GetTickCount" }, { "address": "0x4bd3a4", "name": "GetStartupInfoW" }, { "address": "0x4bd3a8", "name": "GetFileAttributesW" }, { "address": "0x4bd3ac", "name": "InitializeCriticalSection" }, { "address": "0x4bd3b0", "name": "GetSystemWindowsDirectoryW" }, { "address": "0x4bd3b4", "name": "GetThreadPriority" }, { "address": "0x4bd3b8", "name": "SetThreadPriority" }, { "address": "0x4bd3bc", "name": "GetCurrentProcess" }, { "address": "0x4bd3c0", "name": "VirtualAlloc" }, { "address": "0x4bd3c4", "name": "GetCommandLineW" }, { "address": "0x4bd3c8", "name": "GetSystemInfo" }, { "address": "0x4bd3cc", "name": "GetTempPathW" }, { "address": "0x4bd3d0", "name": "LeaveCriticalSection" }, { "address": "0x4bd3d4", "name": "GetProcAddress" }, { "address": "0x4bd3d8", "name": "ResumeThread" }, { "address": "0x4bd3dc", "name": "GetVersionExW" }, { "address": "0x4bd3e0", "name": "VerifyVersionInfoW" }, { "address": "0x4bd3e4", "name": "HeapCreate" }, { "address": "0x4bd3e8", "name": "LCMapStringW" }, { "address": "0x4bd3ec", "name": "VerSetConditionMask" }, { "address": "0x4bd3f0", "name": "GetDiskFreeSpaceW" }, { "address": "0x4bd3f4", "name": "FindFirstFileW" }, { "address": "0x4bd3f8", "name": "GetUserDefaultUILanguage" }, { "address": "0x4bd3fc", "name": "lstrlenW" }, { "address": "0x4bd400", "name": "SetEndOfFile" }, { "address": "0x4bd404", "name": "QueryPerformanceCounter" }, { "address": "0x4bd408", "name": "HeapFree" }, { "address": "0x4bd40c", "name": "WideCharToMultiByte" }, { "address": "0x4bd410", "name": "FindClose" }, { "address": "0x4bd414", "name": "MultiByteToWideChar" }, { "address": "0x4bd418", "name": "LoadLibraryW" }, { "address": "0x4bd41c", "name": "SetEvent" }, { "address": "0x4bd420", "name": "CreateFileW" }, { "address": "0x4bd424", "name": "GetLocaleInfoW" }, { "address": "0x4bd428", "name": "GetSystemDirectoryW" }, { "address": "0x4bd42c", "name": "DeleteFileW" }, { "address": "0x4bd430", "name": "GetLocalTime" }, { "address": "0x4bd434", "name": "WaitForSingleObject" }, { "address": "0x4bd438", "name": "WriteFile" }, { "address": "0x4bd43c", "name": "ExitThread" }, { "address": "0x4bd440", "name": "DeleteCriticalSection" }, { "address": "0x4bd444", "name": "TlsGetValue" }, { "address": "0x4bd448", "name": "GetDateFormatW" }, { "address": "0x4bd44c", "name": "IsValidLocale" }, { "address": "0x4bd450", "name": "TlsSetValue" }, { "address": "0x4bd454", "name": "CreateDirectoryW" }, { "address": "0x4bd458", "name": "GetSystemDefaultUILanguage" }, { "address": "0x4bd45c", "name": "EnumCalendarInfoW" }, { "address": "0x4bd460", "name": "LocalAlloc" }, { "address": "0x4bd464", "name": "GetUserDefaultLangID" }, { "address": "0x4bd468", "name": "RemoveDirectoryW" }, { "address": "0x4bd46c", "name": "CreateEventW" }, { "address": "0x4bd470", "name": "SetThreadLocale" }, { "address": "0x4bd474", "name": "GetThreadLocale" } ] }, "comctl32": { "dll": "comctl32.dll", "imports": [ { "address": "0x4bd47c", "name": "InitCommonControls" } ] }, "user32": { "dll": "user32.dll", "imports": [ { "address": "0x4bd484", "name": "CreateWindowExW" }, { "address": "0x4bd488", "name": "TranslateMessage" }, { "address": "0x4bd48c", "name": "CharLowerBuffW" }, { "address": "0x4bd490", "name": "CallWindowProcW" }, { "address": "0x4bd494", "name": "CharUpperW" }, { "address": "0x4bd498", "name": "PeekMessageW" }, { "address": "0x4bd49c", "name": "GetSystemMetrics" }, { "address": "0x4bd4a0", "name": "SetWindowLongW" }, { "address": "0x4bd4a4", "name": "MessageBoxW" }, { "address": "0x4bd4a8", "name": "DestroyWindow" }, { "address": "0x4bd4ac", "name": "CharUpperBuffW" }, { "address": "0x4bd4b0", "name": "CharNextW" }, { "address": "0x4bd4b4", "name": "MsgWaitForMultipleObjects" }, { "address": "0x4bd4b8", "name": "LoadStringW" }, { "address": "0x4bd4bc", "name": "ExitWindowsEx" }, { "address": "0x4bd4c0", "name": "DispatchMessageW" } ] }, "oleaut32": { "dll": "oleaut32.dll", "imports": [ { "address": "0x4bd4c8", "name": "SafeArrayPutElement" }, { "address": "0x4bd4cc", "name": "VariantInit" }, { "address": "0x4bd4d0", "name": "VariantClear" }, { "address": "0x4bd4d4", "name": "SysFreeString" }, { "address": "0x4bd4d8", "name": "SafeArrayAccessData" }, { "address": "0x4bd4dc", "name": "SysReAllocStringLen" }, { "address": "0x4bd4e0", "name": "SafeArrayCreate" }, { "address": "0x4bd4e4", "name": "SafeArrayGetElement" }, { "address": "0x4bd4e8", "name": "SysAllocStringLen" }, { "address": "0x4bd4ec", "name": "SafeArrayUnaccessData" }, { "address": "0x4bd4f0", "name": "SafeArrayPtrOfIndex" }, { "address": "0x4bd4f4", "name": "VariantCopy" }, { "address": "0x4bd4f8", "name": "SafeArrayGetUBound" }, { "address": "0x4bd4fc", "name": "SafeArrayGetLBound" }, { "address": "0x4bd500", "name": "VariantChangeType" } ] }, "advapi32": { "dll": "advapi32.dll", "imports": [ { "address": "0x4bd508", "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW" }, { "address": "0x4bd50c", "name": "OpenThreadToken" }, { "address": "0x4bd510", "name": "AdjustTokenPrivileges" }, { "address": "0x4bd514", "name": "LookupPrivilegeValueW" }, { "address": "0x4bd518", "name": "RegOpenKeyExW" }, { "address": "0x4bd51c", "name": "OpenProcessToken" }, { "address": "0x4bd520", "name": "FreeSid" }, { "address": "0x4bd524", "name": "AllocateAndInitializeSid" }, { "address": "0x4bd528", "name": "EqualSid" }, { "address": "0x4bd52c", "name": "RegQueryValueExW" }, { "address": "0x4bd530", "name": "GetTokenInformation" }, { "address": "0x4bd534", "name": "ConvertSidToStringSidW" }, { "address": "0x4bd538", "name": "RegCloseKey" } ] } }, "exported_dll_name": "SetupLdr.e32", "exports": [ { "address": "0x40e578", "name": "__dbk_fcall_wrapper", "ordinal": 2 }, { "address": "0x4b863c", "name": "dbkFCallWrapperAddr", "ordinal": 1 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x000c0000", "size": "0x00000071" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x000bd000", "size": "0x00001028" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x000d5000", "size": "0x00014710" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x006a4930", "size": "0x00004f98" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x000c3000", "size": "0x00011440" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x000c2000", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x000bd2dc", "size": "0x00000264" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x000bf000", "size": "0x000001a4" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x000ad6f8", "size_of_data": "0x000ad800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.39" }, { "name": ".itext", "raw_address": "0x000adc00", "virtual_address": "0x000af000", "virtual_size": "0x000017f0", "size_of_data": "0x00001800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.22" }, { "name": ".data", "raw_address": "0x000af400", "virtual_address": "0x000b1000", "virtual_size": "0x00003f3c", "size_of_data": "0x00004000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "5.18" }, { "name": ".bss", "raw_address": "0x00000000", "virtual_address": "0x000b5000", "virtual_size": "0x000072f0", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "0.00" }, { "name": ".idata", "raw_address": "0x000b3400", "virtual_address": "0x000bd000", "virtual_size": "0x00001028", "size_of_data": "0x00001200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "4.77" }, { "name": ".didata", "raw_address": "0x000b4600", "virtual_address": "0x000bf000", "virtual_size": "0x000001a4", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "2.75" }, { "name": ".edata", "raw_address": "0x000b4800", "virtual_address": "0x000c0000", "virtual_size": "0x00000071", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.25" }, { "name": ".tls", "raw_address": "0x00000000", "virtual_address": "0x000c1000", "virtual_size": "0x00000018", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "0.00" }, { "name": ".rdata", "raw_address": "0x000b4a00", "virtual_address": "0x000c2000", "virtual_size": "0x0000005d", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.38" }, { "name": ".reloc", "raw_address": "0x000b4c00", "virtual_address": "0x000c3000", "virtual_size": "0x00011440", "size_of_data": "0x00011600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.71" }, { "name": ".rsrc", "raw_address": "0x000c6200", "virtual_address": "0x000d5000", "virtual_size": "0x00014710", "size_of_data": "0x00014800", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "7.33" } ], "overlay": { "offset": "0x000daa00", "size": "0x005ceec8" }, "resources": [ { "name": "RT_ICON", "offset": "0x000d54f8", "size": "0x0000d3c4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.99" }, { "name": "RT_ICON", "offset": "0x000e28bc", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.06" }, { "name": "RT_ICON", "offset": "0x000e4e64", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.32" }, { "name": "RT_ICON", "offset": "0x000e5f0c", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.10" }, { "name": "RT_STRING", "offset": "0x000e6374", "size": "0x0000024c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.11" }, { "name": "RT_STRING", "offset": "0x000e65c0", "size": "0x000002e4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x000e68a4", "size": "0x00000400", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.51" }, { "name": "RT_STRING", "offset": "0x000e6ca4", "size": "0x000003d0", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.24" }, { "name": "RT_STRING", "offset": "0x000e7074", "size": "0x000003fc", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.35" }, { "name": "RT_STRING", "offset": "0x000e7470", "size": "0x000002d4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.37" }, { "name": "RT_STRING", "offset": "0x000e7744", "size": "0x000000b8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.34" }, { "name": "RT_STRING", "offset": "0x000e77fc", "size": "0x0000009c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.15" }, { "name": "RT_STRING", "offset": "0x000e7898", "size": "0x0000038c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x000e7c24", "size": "0x00000398", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x000e7fbc", "size": "0x00000368", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x000e8324", "size": "0x000002a4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.29" }, { "name": "RT_RCDATA", "offset": "0x000e85c8", "size": "0x00000010", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "4.00" }, { "name": "RT_RCDATA", "offset": "0x000e85d8", "size": "0x0000038c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.15" }, { "name": "RT_RCDATA", "offset": "0x000e8964", "size": "0x00000040", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.77" }, { "name": "RT_GROUP_ICON", "offset": "0x000e89a4", "size": "0x0000003e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.55" }, { "name": "RT_VERSION", "offset": "0x000e89e4", "size": "0x00000584", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.83" }, { "name": "RT_MANIFEST", "offset": "0x000e8f68", "size": "0x000007a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.89" } ], "versioninfo": [ { "name": "Comments", "value": "This installation was built with Inno Setup." }, { "name": "CompanyName", "value": "CrystalIDEA Software " }, { "name": "FileDescription", "value": "Uninstall Tool Setup " }, { "name": "FileVersion", "value": "Uninstall Tool " }, { "name": "LegalCopyright", "value": "Copyright © CrystalIDEA Software " }, { "name": "OriginalFileName", "value": "uninstalltool_setup.exe " }, { "name": "ProductName", "value": "Uninstall Tool " }, { "name": "ProductVersion", "value": "3.8.1 " }, { "name": "Translation", "value": "0x0000 0x04b0" } ], "imphash": "ac4ded70f85ef621e5f8917b250855be", "timestamp": "2025-11-10 17:25:51", "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAQ30lEQVR4nL2ZeXTV5ZnHP7/t7jf3Zg9rAgQpiwurKCIi1dZBra1YdabtiLa14wxWLKet1s6MU85pHXu0nY7OUJVi1SlSsFVRCFAQIZZUIWwhCVlIyH7vzc3dl986f9AbkhAwduw85+Tkd97z5rnf7/P9vs/z/nIFxhhFj+/5qV2NfmfO3yxNFRUVuDJZsyWVNTYamvbGruV5DWPN82mHMNaNJY9VpVxWwjnz3i/h0gzcoonTMrEMk6wlxvqj2f9RVfXFXbcWH/5rAh4ZYyJQ8IOqSTZDP1tY4mLSjTeghgewOdw4AJdlkS+b5IkWhm6QzJp0xvRfqbr+6o4vle39K+NHHssm05RvEM0M7nHjqCTFdLWRPcc7adWc5I2fQrhoHE7ZjgcolAXmFSurNU1cPX1XiFDE+n0ilXzxrfsq3vlrEBiTAkWP7d5s0+J3T115Y/YnV/rsS/LPrWuGzrYPm9h9rIW6sIqcPxFv4ThcDg9u0cQvQ5EdDM0kmTHpjxlV8UTm5W0PTt2MIFj/bwRKflCVdOhJV8WqO3jnKgHPRXR7v76dqtpW/tQaJm0rxFNYhsflxylZ5EkWhU4B0RSJJ0yS6dDhe2+uPeOV81ephko023m0KXlw7ZrLt773qRLwrKsqcUlGX0GRh8tvWsKWK8UxJT7TG+bNmib+dLqXswkFn388dmchxd4eFk4/bV03rUKwyz50I0FT7CDH+n9LVO3hqWs7x9xYYAxnQJFtNwlmEmdpMXM9Y088payAR75wNQCaBq/XVBEQfs/c8klMybteiAltnInv548dm8hYcdJhBYfvE2EfGwFJsG7DMnGWleiLfOKYDv3QqA+9z+G+d1GKBT474bOYcoK6gd+w/8wGTMEg1isSaDGY7J2VynhPuT51ApZo3YYAtrw8aW7e2JJm9BTHA1XUhfbhcNmonDIHm+Smvns7NZ2vgCAT6xIJtJosqFzO+m/+hCJHuWv1bm/oUyXgWVdVgqm7XAX55NsEocB26WT96Q6O9u2kLXqEwoIiZs6Yg66aHGvbQUP4D1imTLhdIdolsHT2rTz33f/ALjkASCYzxAXN/FQJKLLjJqw0zpJCFnkvvq89epzavncY0LooKypj7uRFDESC7Kv7FX3JFgxDor9ZJtvv5JZFf8fXv7r+ghxSJpx8pL6s5Y2ap+OEWxtp2nW38PDelv8TAVPgNsGw8JQUWlf7peEnzLI4HtrDib7dYNMZXzqByd4F9IXOsq3mKZL6AGpaItgCYjyPL9/wEHcu+vbIjzDY+4sj7Pm53aGrV1w//wvXMGMxySPG/N7W0ub2td/YWv7sC3f9xQQEwfo8WLiL8rlqiP+P9v2Bs/HDWPYkUyrLscsu2nvreOv4s5iCRiYq0Ndk4hcn8q0b17Fizr3DEx/d3sK76/sJtc1j6sKFLP0aGcNPoLqW0MavYsRVvE4Hntmz8i+F79IE1hzKs6ykz+H3kS+LQv4Q/z9dvY5SbxH/eO2/cSK0nT3N/40kyyRCIoHTBpP8s/iXO55kbsXy83/UeSLMW//aRMP+mVRcNY05K6YZvgqCHxwj8OIh0r1xPHYFv6jQYap0RVJ6ZUqYessta+w7dvwi+4kJePPMFZZhkVdSwFXe4VO/K9JFXyJEZ/Bsalfbc65UwE6w2WLmhHk8fv9PmFZ8+bmN8aDOuz+uo+a1IoqnTmD64qu56qf0154m+EY98aaD2GUJl6JgSAr1kaTmvm6pPP/Bbwq90ZTc/NQ/T7lxQVWosvya43Vd163Z+/bTRz6WwJo1a+xOUX3yd5GT3+v1VJJXWsiCEQNGFCRkU2Zf81tqX5PsuqLoZp599OfkOwrObdj3fAO7fiZgt81gxtIr+fJTxFu7Ce4/SfjEJkRDxG2z47M5aeofQL1sul75pTvkVX+7SgHACqPvWc3l//42Qj4eHG3Xtn0UP/y4dM0p2Tv7+VdeefG5HJYLRt+SJUus5rqjJB/4LZZsZ8HKxWxZ5KLEfn7PDS9MQkwrfKZwGl9f/h3mjf88/ft/Q8+2HzPLEUWcvRwqryEdMwi9X0t/bRtGXMdls6Mg0R1P0CvLVtmttwgL/+HrOAv95xJrQdT6tZB4DTkPxKJSssml9B5uJn76KFUBmU375zLrM1NObdmyZfaoCjTU16OLDoxUAk+hiM1mxzXi+qOnJIS4QtZtMWn85SRffgxvRw2Fa/4TLZsltP1tgm++Tbo7idPmwCs7SJgqdYEY7uuu5sqv3cv1SxadL56WQG38J4i9jOQFaVIxmrGMjuo2Qie2ItuAIojGbmfVnfNoOl0/66IWsjscOEyNUM1vLGPWAsHt+Rx3Hga/pTPPZ7C42A5ZET0pYmkSrc1nGdixl+KeBq68x8ap7/8MYSCFw2bHZvPQ1B9BmzSBKV/9CqtW3z2iEkm0xkewYpuQPDrSxDxUczldtSECR7Yi2UAugaqua61QYqUQjXURaT9OIpEYTHEBAcuysASZwu5qgY79HNj9i6x39jX24vkrCM68mg8qFyDpCtmkAKZCW2s7dsMkEoe2d/fhjlj0JA1Op1OU3LKC67/193gmjbsQePOjWJGNSG4dabwDXfgiXaeCdNa8iSKDrRTe61tEZ+cdVqS/Uwj3H0GSJCRJQhDOi3fRLmQJEsgSdrCnTxygsWZnxtBUh9tZwNyn8ol2JYjEY1iChaqq9KsaBZ3d1GcSXP/Mkyy98doLk44EPs6BLt9B54kAnTW/RZLBVQIHQ/No7VhlRfo7hf7gh4IoioiiOAz4xxIYJAKIsoLHl+8wTZNUIq0d2XhG+faaR1hz6w853dXG8UQCNINIOM6q997G5nEMT2Kk0JrWngdeJmMoK+mqz3D2g61IEjiK4Gh8DifP3mtFw91Cf/AjASwkSQIYFfxFCciyjGEYWNb5/m9ZFoIgoBmq8srj25g3bx6pTJJQsB81ncHSDf7U2cP+Z5+mpLCQB77xEHYFtKZHsfqfR3JnEUsEcK6kq1Gk/f23EUVwFcKxxGUca/8KiViA3p4aQRCEPwO/EPRIIqMSyLE2TRPTPH9BTKfTPPPMM8yeM4tUOomYFXnise8zPZBlmWXRmlL50UMPUX3gAG++8EXuWrQT0ZZBLAYcN9PXqtC6/9y7vTMfGrJTOdK5mthAgL7eI1iWiWVZGIaBJEkJwHOp6n8sAUEQEEURXdexLIvCwkJuv/12gsEgfr+fzZs309p4mna7Q3+915Tff/4HnGlp4dZb7+B793+RL99pQ7JuorfFTvN7O8AycHihzZhETff9JGJRujs/xDAMBEFAVVWmTZsWveeee3xr1671TJs2bdAFY7aQZVnI8vll0zSRJIlsNsvKlSuJxWJIksTAwAC//vWvURQFXc3KV1x5FaWVFcSiURQZuhqBM9P44weH0FJxXF7oEsaxv/M+tIzG2faj6LqGKIpomsbEiRMH7rrrrvwJEyb4BEGwSktLBcMwEEVxEFfueUwKCIKAIAiD1cmt5Szl8/lYvHgx27Zt4+677+aBBx5AU1X8fj/hcJgth+0sfqaea+ZDSCjiUM83SKUNzp45hWFog13F6XTGH3zwQW9FRUW+qqoANDU1GYqiyDngn0gBAJvNhqqqSJI0aCFZlqmvr0eSJCzrXOtct24dTz75JKZpkkqlEASBkpIS1q9fT4HPww+rvFrNjw4r+zf8F20tpwYrnqukpmmsWbPG6/V6MU2TeDyeeumll1wnTpyQ8/PzKSgouMAdYyIgyzKWda6FaZqGoigIgsDhw4dJJpMoioKmaUiSRDQaxTAMXC4Xfr+fo0ePsn37dhRFxuVSlM2vvkBbyymG2mEooLKyMgKBQOa1115zVFdXu5xOJ+Xl5YiiOKz6uS44ksSoZ8Butw92g9xvWZax2Ww0NDQwY8aMQYKKouD1enE6ndTW1rJx40bOnj2L1+vNdZNBO44MRVF46aWX2Llzp0MURSZPnoyiKJimeVHwuedLKpBLomnaYBJN05g1axaXXXYZmqYxc+ZMPvzwQ44dO0YsFqOjo4P29nYOHTqE1+sdJvlo0gOIokhtbS1lZWU4HOeG39C2PbKwOfBD94yqgM1mG9yUOwPZbJb777+fVCrFjBkz8Pl8HDx4kJ07d9LV1UVnZyd+vx+fzzdYLdM0MQxjVEC5GAo8V9mhFTZNc9BOOfCjKjBx4kSnpmlllmXhcDgG25amaZimybx585gyZQoApaWl7N69m2g0ykcffYQsy/h8Ptxu9zD5cwAupsBI4KOtDwU91D4ej2em3+9vG9lYSwVBIJPJ4HK5sNvt2Gw2RFHktttuI5PJUFlZSTqd5sCBA+zevRu73Y4kSbjd7sGuNVTNS4EfGbn9OdK555ySgiCQTqfJZrPIslxqmqYwzEJ/7j67amtrby4tLR2s+PTp05kwYQJ2u53i4mI2b95MJBLhzJkzKIqCZVk4nc4LbJcDMBbgl1rP5YvFYqRSKdLp9F6Hw5GCIRbq7OxMV1RUNGSz2cclSdoTDAYfDYVCZRUVFSxcuBBVVZk9eza9vb3U1dVx6NChQf8qijLYWnOgcy34UgRGAz604+S8H4lESKVSZLPZvnA4/FQymdxbWlra2tjYmBqmQFtbWwQ4PH78+IBlWcez2ew95eXl91VUVOD1eikoKGDDhg2Ew2F6enqw2WwYhoHX60UUxcF5MbTnj3YGRt5yRyNjmiaJRIJkMomu61oikdgYi8VeE0WxMRKJBCKRCMMUGBrd3d0dQGD+/PmRBQsW3GeaJpWVlTQ3N9PT00NzczOCIKAoCqIo4vF4sCxrcLgNbXU5K40cQiOBD92TyWRIJBLouk46nd4VCoWeE0WxLhgMtgHD2tqlXmiyy5Yt+2llZSV+vx+3282mTZtoaGigo6MDp9M5eLAcDge5e0zOOhdTYOjBHgleVVUSiQSZTAZd1xsDgcDTgiB8JAhCSyAQSDBKXJTAE088Md0wjOvsdjtTp07lxIkTRKNRq7q6+t1YLLbS5XLh8/nw+XzIsjwIIDe9cwrkhuGlgJumSTKZJJPJoGnaQCQSeS6dTu8RRbEhEAj0XaLIFyfQ39//zrJlyygqKkKWZXbs2EFfX9+m7u7uVrfbPaCq6ore3t5xdrsdv9+PqqqDJHKVH6nAaHZJJpOkUikMwzASicSWRCLxummadaFQ6Awj7DJmAg8//PByh8Mx3ePxUF5eTk1NDdlsVv/lL3+5DVBUVe3Xdb3H7XZPCYVCnxsYGPCWl5djt5/775coioMEhr6aDr0OZDIZ4vE4hmGQSqUODQwMbACOAs3BYHBUu4yZQCqVevWKK67A4/FgGAbV1dW0tLT8HEgATk3TjpeUlLyhKMo4XderDMO4p7m5eYXf76esrAxJkobNgaHAdV0f6vOOSCTynGmaNYIg1H+cXcZMQFXV8U6nE6fTyb59+9B1Pfb666+/CriAU0AwEAgA9E2cODFomuZZ4EAsFrsvFotVlJWV4ff7AYadiSE+T0Sj0Zez2ewfLMs6GQwGWxmDXcZMwGazIUkSra2t1NfX09TU9F2g988/w6Kzs7MLCE2aNKnbsqwW0zRv7OnpuTMSieTlJmgymSSZTGIYhpFMJt+Nx+O/B2qBpk9ilzETsNvt9508efJpVVWtVCq1fuvWrRs+Jk+2o6PjpMfj6fN6ve2yLO/LZrNLBEFYrWmaLRaLoev6G/39/b8TRbEDaAwGgxcU4y+JT/7F7MeHWFBQ4CktLZ2sKEop4DIMI2lZVl9vb29HOBxOAJ/4y7yLxf8Cqcce7B/KtMAAAAAASUVORK5CYII=", "icon_hash": "4740e8214f71a7b8bfa204b086a75d41", "icon_fuzzy": "1a1010aa6a1d01679c6b3c7d467dd16a", "icon_dhash": "7cfccce0d88ce672", "imported_dll_count": 5 }, "data": null, "strings": [ "7?eN[", "&N*S1>", "1(]CAjk", "AobF*", "]dD;ZB", "+TArray", "7#${V=", "}_pTm", "Yl-6q", "Y+Ds$", "3TDictionary&", "|@47)", "*SbJV", "_st*&J7", "b7>Y@", "76lS-/V", "M@M%e", "mfNLe", ">QaSoc", "Uh4*I", "x_&5g", "/2}*`z", "euFi*%_", "Tz9Dt", "|1m\\,", "zTp5?", "t6Y9g", "F\"`L|!t??,", ";w-befCeF", "Vv'v9", "DN<7_uI", "Y0:!c", "{D0liDU", "6X`,r>", "DZ`:9", "AAttrClass", "$cwfk", "tkDynArray", "gwAOq", "nWA^}", "GBsm3", "trBfuS", "6F6Y6z6", "!r3y1", ":TCollectionNotifyEvent", "y!wAu", "t\\R9,Q", "/1>F9", "Invalid destination array\"Character index out of bounds (%d)", "cKjq}?Xo", "~0&a4", "axCuF#J", "xDs:He", "V?BTe", "t5$|W", "p(R:3", "!`,X4", "x6mXXX", "~nVs1", "?p\"#+", "System.UITypes", "!TMethodImplementation.TInvokeInfo\\", "B{mrc)", "LJ(t&s", "-P4m1D", "\"Q:)\\", "F'!u@;", "ZAm", "ykRGG", "KB_If!", "}jC\"O\\", "nS^1b", "iaTfR", "ExceptionRecord", "e%_kr", "8&nD0", "fw42\"", "F/", "Ec}6)", "\\HyB(\\", "Nk0)8SO", "Property '%s' is read-only", "AM(-BI", "iso-ir-148", "`M)D=", "T\"zO9#", "xBILL", "d>ru#", "Xl-NA", "8[AR5s", "o#H]B", "6,NO$", "/O.1>", "Ry-Ee%2", "eekz'", "Vk2Ir/", "Iznl3", "({n4\\6", "F]k7R=", "lgY5=", "r1YJlQ", "La5j$", "B4;Zq", "f>=I6", "O=cXRE", "+b.$Tj", "[$btE", "kPC=!", "FClients", "]DeU^", "%E4#~Y", "6#Z\\H", "3#F3e", "Gq'p}5Tk*", "wn8q-", "CDUj`gzx", "|M:2w%", "{#hH6", "VIC6\\", "dt4,9-I", "]3E@%", "@Vg1%", "260709235959Z0e1", "LL?wk", "yw=&E", "LAF2V", "bE?ogo", "h;~W`?", "Z0CtRB", "qByCI@", "TMultiWaitEvent", "4o+D@A", "@Q{nu", "L9gJ%", "8K9u6", "$lz;&", "PropInfo", "Tf|IMA", "sms-FI,sms,se", "FreeEncodings", "1TList.TEmptyFunc", "EVariantArrayCreateError8", ":',3uA", "c}O3?\\%9iX", "MaeHk", "XsX%J", "|&,>!Pb", "Z3I8 ", "Z91O?", "\"jF'Q", "p?|$.", "CFS_;", "}ADOR", "R}n7:v", "6~F/F", "s&RiL", "b'# -", "KP\"S%1 0", "Q*Kk(7", "-6,1pU", "A)wr6]Sl", "crGreaterThan", "9K3LJa", "ES", "~#;UuT", "L:m1^", "4Ry;`", "#oT(dj", "?#?'?+?/?k?", "Au1\"`N2+{", "WriteBufferData", "1K2O2|2", "wz@i`", "iRN\\d", "g&d/~", "vY>=b", "^8{,F", "3Abu.", "@TDictionary.TItem", "cj2eL0", "\\i_,Ig", ")6\\T{r", "Kaok[", "6?&P`T", "CyE~t", "J*#I/", "2z?ml", "k]BCdH;h", "5h5z5", "\\yGK6", "Gu(iv", "`N?6-@", "9 9$9(9,9094989<9@9D9H9L9P9]9n9", "W!20jG", "^i)!:", "3!3/373E3W3g3o3}3", "c:PvS", "VN1{\"", "}UvDW", "SetArg", "sgX-$", "z_B fq", "tkx5y", "TRttiMethodTypeQ", "(basic) procedure ", "Lel%l", "0#090L0T0b0p0", "A^up\"Y", "AElCount", "ATypeInfos", "Ck~D=", "-{kEk!8", "-t3 8", "/X5`B", "]/2O*", "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl05", "STATIC", "\"E", "V3\\8B", "tQH", "ZfyPtZ", "8!h&E", "&#Q\"/", "LongBool", "C.BS4", "*\"41?g", "#=kM'g", "7W$^YW", ":[k0)", ",qy/2", "/,j@/:", "9Y:]:a:e:i:m:q:u:y:}:", "tpTimeCritical", "/ xZA", "tofQ0", "t3!`h.f", ".2B$0O_x", "j5fA*.D", "BisQJ.1k", "xQp9IP", "R?EzX", "x35`W", "\\WZ>-", "H`^ec", ":$DZ4NY", " !\"#$%&'(!)*+,-./0'", "120gi", "4|W#%e", "GrwSh", "SVWUQ", "_(enV", "Invalid destination index (%d)", ",$rva1", "UB-OPv", "K=p)C", "@'TCL", "-.IOp", "0I ]c", "1,W6(", "8JhD3", "OnNotify,", ":wK9B", "?!?/?C?P?X?f?x?", "ua$uK", "kpT5Sj", "D!(@C", "$%,d[KL", ";*;.;2;6;:;>;B;F;J;N;R;V;Z;x;|;", "VRi>1X", "~=( V", "u\"nVh", "7m>>1]", "x>q:e", "Kd'n~", "neY(|", "s4AID", "GaB@R;", "8 8$8(8,8084888<8@8D8H8P8X8z8", ".jRm'", "lYfP)1", "&cr8*X(", "e_", "&ZbAo|", "<(<>{U", " C,z0", "JMc3A", "l\\inM", "t]gdt", "opF'$", "%BXK\"[", "count64", "%!pKF", "+(AR;", "DTDictionary.TValueEnumerator ", "83e#z", "8MsAZx", "AsOrdinal", "3uu=S-*", "6j`#J", "I@E[HX%", "tuSo`", "t;eDZ0", "}`Ogl", "FFinished%", "vY%5Q ", "y[nlt", "#uOt,", "NlX3z", "/NOSTYLE", "n5s?!", "@K9O^", "Zjjcf ", "gR:1nRs", "Z$BYr", "3m\\Ty", ".", "n>.P%r", "1b~WBI$", "+TList.TEnumeratorhUH", "u,A:1", "Hf5Jy", "}: g6", "Construct", "SxL4e", "lk|RI", "NK7D@,", "|g}l0", "j%Fzu", "@DO;/", ")OC?{", "+Twk:.", "Q?hSz", "YK*{Ra", "<*kQOb", "}~mMVk", "bV!\\D", "R37S[", "1lA1*v", "b\\!H=N", "pnU`Y", "zl1@o", "%_NDU:", "Uh8QE", "NO DX", "Bo380Q", "b(|0'H)q", "?xU+Ii", "Ne^Av", "Y~j2+", "?KndW", "_1X08", "`\\U$!#", "f'RZj,i", "maLu2R", "MU Ey,", "R?Au?", "3-ZaV", "x6eT:", "imO*6", "g9S[-", "fsNZero", "Zv.u_", "XMGz[}", "BeforeDestruction", "8ZCV ", "a7/ f", "1bC5gsp", "#ok^fu%h", ":0kjY", "OA'|y", "4\\:G5 ", "@bhg=k", "$`gC'", "UhR[B", "Out of memory", "ITDictionary.TItemArray", ":KA)WJ", "/|T^3H", "'s@nu", "5$5,545<5n5", "!TArray", "ZOl>O^Z", "%TEnumerable", "3<3U3x3", "s\"2w:d", "Mcwro", "e*zN@", "}J)6x*M", "I[:!9%[!C|", "xz/Wd", "4_\"j+", "k+>A>T>b>u>", "TList&", "k4$6OVU*", "'PJcXI", "lhKut", "nv7{N", "iM=>1", "InnerException", ",q<}5", "QualifiedClassName", "8eUJn", "Q2',(", "|.S8;FBCZ", "_fUoT", "3-3;3Q3f3t3", "HeapCreate", "V1;hV", "KkZUP", "CFGUwr0", "FOnChange", "^lzl~m", "F[$\"cG", "+~hG{M|D'Z-HN", "e>'", ">*D~DW", "UPpy`", "!eJ'~", "TRttiDataMemberE", "Q\\xZO", ".x\"f$", "cyy\\*", "I/rA[", "MWsb*)Bo^d", "@k9m!", "ParentInfo", "v/{]6", "c''zM~", "? ?$?(?,?0?4?8?fVOB$B", ".&^\"YG", "V&R6qK", "vdGG%lm", "622KB7", "939;9C9K9S9[9c9k9s9{9", "'$amo*", "kH_{a", "=D%Hh", "ESafecallException", "cp869", "]0aE|", "%LazyLoadAttributes.MakeClosure$ActRecXFE", "}\\~\"<", "NK]vB>HNt", "\":z=(E", "@92,I", "d$/N?v3", "8cQF\\", "a00U&P", "n=rPKf", "{x\\`lm\"5", "8Tp\"I", "(>ETR", "V11^pj$j", "57NpO=", "_'El`@9zs", ";Y& ZR", "}{+hJ<", "`|>9?", "?j`0A", "K|3|W", "SafeArrayAccessData", "9&OoS", "4[}mO>", ",O#&e", "O9;0J}", "!V54h", "(0nJ=X", "1Jl\\S", "0F;H4", ":p!L^", "W%0|,^", "/&tv^", "FFieldType", "!>_ytY", "SizelCJ", "TVarData", "E|X", "'C?hm9r", ";raU9@#", "pvE*P", "~rAJz", "up8@-9-", "pM+x 1", "}\\!co", "pX#a-)", "=}}T~", "AppPublisherURL", "?F?}?", "5T ai", "878;8b8l8", "_ifBc\\_/(^ZF", "05`fd", "v0H,:", " 8Ssr", "cT/>.", "UE2sh", ".iLEo", "&{AU", "J2[L-5", ">$Bwp}`", "6B?x3p", "~kzGi", "uTmvb", "l_bor", "_u;i=4", "X?~T{", "FStackSize", "[{$Le", "HSSyi.", "#J01s", "NnBF(mWR", "M8D>A)l", "R0sb ", "OD8~.+", "X\\?7n", "s4}GDe", "Dp&pV", "7?`7B", "+B4h&", ":&:5:=:L:", "4 4$4(4,404L4c4g4", ";a_[! ", ",(U*}", "6'6/676?6G6O6q6", "=EoEq", "&NZu6|", "=5=>=", "NYW`i", "C'uB:!kF", "9naOq", "m|44r", "#}`]H", "IInterfaceComponentReference", "Collisions", "'TArray", "'2s9|", "LUn>1", "lf8x.@", "^m`8%AS|", "-*Z8M", "KGF#U", "ByteBool", "4<\"db", "{Wv~p|", "@#p~E[", "cV|Va", "9i^}s", "K(Z'v", ".04CL", "7b3t|", "#454A", ";DcB.", "I4!4 A9", "\\]2V6NI", "h`e'$he\\", "i4,H/y'", "6:&:nyl", "pUot*", "VUInt32", "A/_=g[(", "d#fLmw", "fL9JIE.", "A_S!)", "4*0Cpe", "]qJz$u", "cn\\.u(", "EM6dj5", "i#wGE!", "MovEBP_ESP_2_E5", "{Qd-j", "*TR6C", "&)\"U5", "w8+}k", "9 979;9?9Z9b9z9~9", " ?GmN", "f+1px", "TStream ", "t^_W%L", "~SF'U", "_$ ]*", "#wOgB", "ja:|X", ";-@[(1", "&UV'W", "bnOFK", "owsiC\\Qe", "RttiDataSize", ")d{l)6*-", "<\"U4q", "ax[XJ", "/ED9_", "Y>KDt", "[lA t", "u8,&+", "2Zeo.,7", "@`OlO", "Y:k\"npr", "6*c{XU", "vowy%", "R{wp1A", ">>>e>v>", "8*mcV", "2tNW?", "mp?pT8R", " >$>(>,>0>4><>", "R}u?2017", "do7N#", "qvI|?", "y(7u)", "TExternalThread `I", "B+~?e", "t:KTx", "o=L;.", "TypeKind", "-#.S]", "(;lOZI", "MbX&K", "A\"|%(", "vrbUp", "eJ8!O", "VjufF", "=8=H=P=X=`=d=h=l=p=t=x=|=", "vGc09^&&", "m-Y-C", "NYV;;'", "_ERtBw0", "e ggM", "jm&QbU", "zVMcW", "5R8'sOu*", " &M>,", ":TDictionaryH", "`?#d:h", "4`uk?", "REB7@", "a^n_W", "M1L'y", "D=B/p", "GW-g);# ", "AParameters", "FTypeToName", ":Hje1", "Y,l3i$", "AxA8y", "4,4=4O4e4}4", "L$`h!", "!hAMZ", "6,646<6D6H6L6P6T6X6\\6`6d6h6l6p6x6", "sUmTTx", "jDDU9C", " cABgE", "849m9", "iGlqhj.", "PxM1QD3", "vaBinary", "0Hk5x", "zs>!:]vPM+", "CON~|j~ 5", "|V[p\"", "*3e?h", "j_;Mg", "%5J^5X\\a)", "Argument out of range", " 6SdM", "5]Sw!", ";?L-m", "J/j@8GU", "]ZQh>", "$1*;Zn", "CY&*rY", "TRegGroups&", "vvKZ@", "t(vFrI", ">LP%)", "oIb~:", "81=Kh", "ID#lh@<", "}Bbn}hb", "K&<<0", "`W-H*", "mHQ(rc4", "Xh\"!?", "fp^jo", "8R@c0 ", "csisolatin3", "[YA(}", "13o[5", "VkJm:", "9!s_A", "A.R+a ", "Clear", "/B1IB", "MJV)S", "Zfg;?", "Blink", "L=8!#q", "tkRecord", "0iaxx", "7^+Bql", "=jid>", "7G7[7w7", "}EF};Y", "KrH\\wH", "y/''6", "3[HA*", "+:aN)", "bw:", "B;o-je", "1P.0TB", "h9{MUS", "%./0OPQ", "Bs}Uy", "gK?0|9U", "6DXjD", "", "PqDVD", "bLJjD.", "W,O+gK", "4BGH&[", "5)JM$c8", "W&\"3\"", "QK#=u", "o2P)=", "IyRX4Hd", "ccCdecl", ":X+sY", "@{/uRe", "6Vzqt", "+`n:e,", ":TFormatSettings.:3", "Znjq:", "*He3L2", "rW?aH", "procedure ", "TRttiIntfMethParameter6", "r&?lc", "(mJ]CY^", "zBWMr", "J#E>t+", "^=KZ6", "*SA3e", "#z!\"i", "jo*>a", "#A3RR", "b46S^\"nv", "CyjQth_", "wvYms", "T}f]\\", "%0{t7", ">^\\`0", "TMethodImplementation.TParamLoc", "L-h:N", "H8pL$J", "CreateFmtHelp", "(UB)iV", "@Byw?", ";zjbl", "yq&_e", "MRFL*", "csunicode", "_hn)q", "_PL-.", ":%:::H:^:t:", "W]G6>", "o'uxM\\k", "')/ /", "%MV8J", "IMB&7", "50LPh", "<9y9\"r", "`#6]LB", "'-MN=", "n9HUi@", "egfzEH", "GNo single cast observer with ID %d was added to the observer collectionFNo multi cast observer with ID %d was added to the observer collection$SHA2: Cannot update a finalized hash", "4(", "W[fyJ!", "tkVariant", "#{01z", "IEnumerable", "(F[1]", "*PZf:", "72;", "C8Yrz", ")hOn42", "3=duo", "_5NX%", "lQxA)", "GetCurrentThreadId", "Nv~cs%-", "7M,9R", "DTDictionary.TValueCollection;", "110q}", "[)#cy|", "8S10%", "wDZ%t", "+'(sR", "hYEo2", "Km QJ3@a", "8Nnqh", "|2uH%", ">5C>;]", "IUQYfb6", "1wPJ0R?", "HkkvB", "0'0~0", "KiPwT9", "TMultiWaitEventImpl&", "CLRm*", "\"'7_J", ".sv#fz\"", ";$)Vm.&", "{%Z[R8", "GetIndexedProperties", "}+C\\)IAAo3L", "EExternalException", "@#0ZG", "7-7<7D7T7z7~7", "IqqfBYx+", "Wtfn(", "|qJ`-n", "59J^#nB", "~.k\"N", "lmy|LM{", ",TEnumerator(", "GDKE+", "wf5`<", "ws+Rhx", "/fX(L", "iEK7B", "`tIPX", "#YxkE9", "ge\"0>m", "GetSystemTimes", "*,]sAPO", "2*282H2Z2p2~2", "s/o[(", "8eQ?e", "232;2S2W2u2y2", "tpHigher", "3$jqxU", "KELI(*", "FAsClass", "1?~E5", "}-K,Y", "? ?$?(?,?0?4?8?", "GE^&3\"U", "t3m(8", ".rdata", "zHb\\ns+", "yl(>C{", "`bGa/", "kFU1U", "[?#6:", "D1.qJ", "< <@<[<_,>:>M>c>t>", "rsh'G6W", "Qfz;pQ*!", "_Fi8g", "(`a,q@", "_PQV?", "0->VUFAO", "A3W?nM", "]}U0<", "UpdateAction", "VWord", "LockSemaphore", "A#S4\\K#", "tBO4c", "_\\>xz#", "l|H|1", "obd)(3", "I/EghL", "U2dRr", "ePY6Im", "K;j'0<6", ",Il5^", "1Yd(`", "WZ~!#", "0;IjQ%", ".rKGk", "`be-8", "}AJS0", "n[]PV8", "\".wp0u", "@?hkd", "}YNth", ")?B7S", "&y3p\"", "Jl|ENE", "nRIsU", ")&,A6", "ADefaultEncoding", "iso_8859-15:1998", "v9\\?!", "Y+).Zw", "kr?+cD", "8K|?>", "=Py9G", ".yk1V7j", "2tPl!C", "'[NuodA", "XUNW)", "j(Hsb", "]ZOV]", "B4eV`", "F62 t", "`", "$TEnumerableD_D", "`SR<)", "pn!+E{", "94:C:", " ?7&_", "$wX)\\", "euWz&", "r>3", ";0DGG", "Y!>/>A>S>[>i>x>", "IDATK_cS|", "y,6?]", "b50A-lv", "FNameToType", "\"_5US:", "V[{\"h", "GetCPInfoExW", "DE)R\"", "U# %B%", "O*k0A", "kXc&{", "g$^Nd|", "F}|2b", "_u27h", "\\~oTB", ":!:6:D:W:l:z:", "*RP!m", "exK,J", "ua_>]S", "-9'0D", "[N^*=R", "bupf:", "pj.JN", "{c.TEnumerator5", "{{b}z.", "6&~_k", "bh$, ux", "PvGAO", "Ii3r[K", "kG\\pS", "j<=ZR", "F`3nlpc", "jSIoeR*", "qPwJR&", "w{9lG", "c?5=g7&Ns", "NameIndex", " 3v(H", "OkmE.-", "SafeArrayGetUBound", "4 4,4?4R4`4h4}4", "(q6fF!", "+ki)g", "8-8P8d8w8", ",'xLi", "cEw<&", "W~WVj[", "7gVh9", "8@TList`1.Pack[1]$ActRec\\(J", "z9/M]", "%3]-M[?g", "c^?.D", "{1Yfw,`", "+rhw`y", "O~6hi", "\"y(585", ")2-px", "= =$=(=,=D=U=Y=p=w=", "Q%D]S", "gijhL", "}brB.Q!", ".wUXk", "455<5", ",-RLY", "UHjwx;", "P3Gm9N6", "U$J7s~O%/", "aUe]*", "2t9O I", "?fk!DEJ", "{jxk7sA", "Y[qe0", "TProcParam6", "BOg0a", "];>9~'R", "rjS|i", "pxs#W", "p+!)#q", "44?", "Qx9h-", "A-9z]", "OR''r", "7N>'`", ",i!e=", "_t;px", "&ueykg+", "#U:;a", "]@`o;3o", "FOnExecute", ";3UN P", "R']4!", "\\*PMG$", "iU8]#", "k3| 2?4", "PListPdI", "=$>4><>D>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "ENonPublicType", "T;*", "crz'1*", "5^5M\\", "&qtA%i", "NFT[]", "QTArray>", "Mr6}U%", "\\n$E{", "Visibility", "GetNames", "tCr^$f", "M*7}-A", "lpuk&", "9'9W9", "9(979?9M9`9o9w9", "jgGRf", "&Nc+$", "Z\"/>S", "E%JZ1", "]*mk-", "y.D}G", "tcG@Dkn", ")f>\"jM", "4XWBQ", "xf!~H", "Remove", "|THBn", "7,7:7B7P7`7v7", "Y^chWM", "}SS-iv>", "kAYDz", "i/#@o", "1c >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>", "I#e6,", "<,9GYGX8wtxC(", "U\\IXLjk|", "Lyq#V", "oT71n", "3o}@2", "hjq?n(", ".h5jN", "F3E/p[\\", "FPosition", "@{Np\\", "W4rca", "A0YN3`", "XuvM4", "TM*P?", "8PxJe", "B8w+{FG", "Y-(na", "~r#|m", "v 8#:#W", "a3BW!_c\"I0", "// NOP", "?$j5N", "ml9:Qf", "8A|Doi", "J1eGT", "LTK|L", "}F>Gy.}", "3!4.4?4V4d4t4", "1Q##.", "kMP7B", "qZ%W=", ">R\"Gw", "ucynO3", "B+B1S", "tkProcedure", "Wl6cI", ";5CQ0", "(da,:", "TU}UW", "$ty1/", "|&#vs:", "WD+N\\V%", "sC424f'", "8{B.i", "|s5S%", "7&6G[!", "RMJ{X", "$XI^}", "Bis%6)W", "X1j[o", "5H8^'", "=0wq:s", ")@MtmZ", "C%r2#", "50:{j", "5'l5h/", "r~{N.", "/V~mB%", "fHO-z", "Z~WW9", "6/6K6Y6l6", ".\\tY(", "%/K'$", "0)1g1", "\"eIoc", "%jwtn", ")^lV9", "dJ+vc", "xF7bH", "`.itext", "lA", "7[z<|*{", "()@aR1", "1MB(0", "_%sWP", "xoRi@}", "T[Wvx", "@6]I(", "`h00k", "/TASKS=\"comma separated list of task names\"", "g\\lx;C", "v57 kj", "%Mk\"V", "HuWSj", "i~oB[", "z'P;ga", "_,kRC", "ecma-114", "ExecuteTarget", "zM7{<", "ibm437", "s0\"&}", ";^+7f", "Q:C/,", "~aE[>", "7*727@7P7d7l7z7", "{foT'", "{e(1D", "*\\#!W", "TKX2Y", "k2V+Q?", "%#lv+y^", "LW,:#", "MHG`=#|", "868D8S8c8u8", "gzWwY", "a{\\M,I", ";!;);1;9;A;I;Q;Y;a;i;q;y;", "tH75u ", ":G:K:O:S:W:[:_:c:g:k:o:s:w:{:", "nPFNd", "vkz0 ", "w\\1n}", "_X=aj", ";8{r{", "@|[5$<>", "6 6>6a6", ")-i6%[", "N~q;w", "TNyH~", "ab yjT", "e`M&_Q", "r:]\"kH", "n0l0E", "l?nQ ", "zp`./", " R}p3z#'", "d1e>l", "OL2PO", "opaque_RemainLen", "T5n9R", "TRegGroups,", "mEbV\"G", "9OIy^", "=JuIv", "-c=|j", "3CrRf", "253\\3", "G=+_d", "asmo-708", "3c;Ab", "g=5m!", "ReadBoolean", ")8&}G", "windows-1254", ",q{g`", "Nb-GT", "|l?h*", "e6{:HA", "GB@&b", "Zf@uO", "&{j\\!", "(UHV-~", "z2nzZ", "n2s5B", "Lm&6,", "\\Zdrez`", "7?i]<", "[y5\"n", ":O+lw8", "Z>-]o", "Bs{|W=%^", "N\"(JQ", "TIdentToInt", "Q mhS", "31.HN", "J&gW>", "CIDAT", "ConvertStringSecurityDescriptorToSecurityDescriptorW", ";%;-;5;=;E;M;U;];e;m;u;};", "VarBstrFromBool", "=Y'm?", "I@0~a", "GE%52Th", "Kq?2<", "9m/[ ", "7` Vwkj'", "9];1l", "2M;$(F", "#W][H", "^,a$A", "~50so$~", "hB{1r", "OhF90", "VarDateFromStr", "16yz`", "/ WsW", "3,cMdFY_", "ps.oP", "yKan0I$", ";SZi1&I]", "H=&~G", "#VlBU", ".<[6I", "TRttiIntfMethod", "Z#R{)nes", "L\"n+R2;0", ";8DtAiG", "s;t$9", " K3S$", "\"`HN6", "d?v~\\", "zWK;:", "Sm}I6Q", "M%=?am", "/PMs79b>`", "FVjq@Erv", "|u~{P9", "EReadError", "HTDictionary.TKeyEnumerator;", "8g8t8", "c/I%OZ", "5vo*r", "363W3r3", "_)tke>", "InitDecryption", "[MHQrF", "xS~*(", ",-ZHT", "ZE6?D", "&MQ.Uv1", "|||%yyy", "h}&Q]c", ")Xz_w\"v", "WaitEvent", "Der':", "N,/`Q", "^S2u*", "iS.jq", "EK!7BZ", "B3(%=", "m|fAE", "f'#<5", "7n048", "fJ5\"6dU", "(TArray", "CreateFmt", "WV)79", "XOEVX", "7KUhR", "k;VgGH", "Q3:@a", "BaseType ", "AwJ];", "BKr6p", "\"7^JJ", "jvEs~_!G", "dlef(?", "zYLaNN", "TVmtFieldEntry", "ckP626", "OnNotify4sG", "skAnsiString", "<-<;3Q3b3u3", "Compressed block is corrupted", "BKPS[;IUf", "!K;nB", "'oDM/:\"", "/aQ@Y*", "g3L#3", "v~m_9", "W2DcB", "TRttiProperty", ",EoNE", "o?d&M", "~v8E]A=48R", "eOVMJ", "k&{J\\", "A7Z2 \\", "{CBsW", "JQ<_x", "ImplGetter", "ftComp", ":4:D:L:T:\\:`:d:h:l:p:t:x:|:", "#IComparer", "<,<;?", ":|*)Iw", "o96K,O", "@#g| ", "ICY\"o1", ">+>8>H>", "<\\=e=", "'KoJ", "-qwLr", "ZBsPV", "W$zgs", "9$Vmr|", "&xPzg", ";-QPoW", "BufSize", "sfo&h", "\"X1/Z", "4=>6PA5", "\\%O -s", ";j;q;", "DD(01", "vI=*M", "^: Nug", ";ED>Y>b>", ":%:4:D:H:L:T:\\:`:d:h:l:p:t:x:|:", "u~6}r", ";+;E;M;^;};", ".NpwL", ":%:,:6:M:v:", "3*3G3U3b3t3", "opaque_Properties", "N\\zvsO#eZU", "LnVvA", "llo~Fp*0", "WriteSignature", "K`epq", "8tOj/Uw7", "=$p/P>", "yz&{m*n", ">2^+/", "guIpH", "N^TR1", "-Np?Cu", "OqTiT", "/W8Qe", "~a fZ|p", "io>=I", "IlUYXO ", "*E>u*", "7%7:7N7d7", "jzbH<", "Right", "2J7M*", ">gU:M/", "s0sGN;n)", "|N:}b", "TMBCSEncoding", "v7m8)O", "? ?-?:H:l:", "9#:<:z:", "a@O2X", "Uhjy@", "-FgSH", "Zqm/]", "9gz.6Y", "jMdL$c", "I/.Zu", "%!0(K", "T,C[cu;", "X*^aU", "`N`$s8NC1", "w~FgGA", "sL[TV", "D( N\"h", " p`-f", "THLK;", "kG+'*=", "TDictionaryOwnerships", "i9e%)", "NA?bY", "8!8&868;8@8P8U8Z8j8", "'E*fO", "9,uND", "F{K=yn", "0C0|0", "8P}|]", "eg`(>", "frbbbG", "6#646}6", "EraEnd", "oEc>Un", "h*cJ:", "GetOpenArrayArg", "28Ohp", "(uTb=", "B}pCQ", "xUDv'", "h5eP0?", "prNone", "Q!i4e", "m)B\"pF7xg^M", ";7u#d", "J:-$>G", "&f\"[=", "`V*;5", "z0IS!", "+,a@#T", "7$777M7^7", "P'iok$", "RjOmo", "S2sD:", "FTerminated'", "IVVZf|", "aF]%>", "Z]-t5", "5n'XZ", "5&", "\\_@R~", "LkuVk+y", "euckr", "in[U4", "h`-dF", "}]W ]", "~LFu\"", "+1:sj", "\"@_FWs", " |~t3", "TList.arrayofT", "eH)]#", "LHGY9i", "\\=h&\\", ".4DM0c", ">'nAz", "I{~5Hv", "`EcGt", "D-K(!", "'txaA", "wCcl}'", "xu9,lP", "LibModule", "vw~EAaV", "FOnFindMethod", "dM|od", "PRecordTypeFieldt%C", "Index", "5hsGY", "7|E=r", "LOvc0", "eTpi6", "9TPIz", "dkInterface", "X*dIh", "Qv.pU", "F;]/y", "?M#Cc", ".6U>o\\@", "'m@~l", "oAR~-+", "+ifrv", "XRV?Xb", "*f'/fv", "TEnumerator", "ExceptObject", "]@{-4yr@G", "/,7.>kE", "bR]z$", "q$^Of", "=>i!I", "!FQ$7", "X{3_1L", "Ta3qZ2a", "56Uax", "6O7[7n7|7", "Uhi)B", ";>r3o", "\\7Cca", "OB|*'", "Instructs Setup to install in non administrative install mode.", "iZvqE", "3#343>3F3T3e3y3", "$y@FKy", "G8C2/B", "dyj/AH", "4 4(464D4", "-c|`y", "R\\E!IWu", "w->.O", "q>F/*", "TwzB+", "WriteVariant", "uk-e(]", "p]^0/UJ", ">`%AJ\"", "Zag#dJ>", "2\"1[~", "6 6(6,6064686<6@6D6H6L6P6T6b6j6|6", "Chars", "Y0H D", "f,x`K", "3L>Kn", "]U=;p)/", "4G83yp^", "IsObjectInstance", "%WDKyo", "rz7%u", "oQ)e`0", "WriteFile", "3p2r\"", "3#uWw4", "=-=A=I=W=i=w=", "rQ>$$", "(F_f0", "KP72WH", "Nksx1", "ko.L%", "Q-`Hg", "G7(bc", "CJT3.", "ComponentClass", "ckae7", "OMq cu", "fU/R&r", "Y-C|,s", "253B3", "CT9-P>bn", "_.N,X", "JwPX$]b", "EArgumentOutOfRangeException", "_s9RVx", " TArray", "'7>Gg", "A9C!0", "R;(.f", ",1)|E", ".L3&9", "UninstallLogMode", "|fI;q", "FAsDouble", "{c!2T", "}#%z1k", "hq: .", "~N*siF", "F\\f`Q", "&VfdN5", "SD)K/a", "b?[T]k", "[e|Mv", "*$5@8`n", "A3p\\p ", "/29/W", "zL;\"f", ":)Bu8", "Q,iF\\@&", ";nLSP", "Q@l~IT", "&db33", "$-bs\"yZ", "gk`|p", "TArrayTypeData", "iz6.c", "G~;ju", "2,>!:952", "EncryptionBaseNonce", "@><${Xz@Gi", "7ejT&", ".M=%m", "|*b1X", "T}w(,t", "sxP-H", ")}p;U", "),@5]P", "bTBl O", "]R~@l", "WGNMF", "D}GqA", "dGUD$", "#)N\\WbP", "{Q", "E0R_c(r", "?@>>{$", "7:8I9[9", "FClassList", "skc2?", "TimePMString", "bt2\\x", "*IuFI/L", "Yc&q'", "4(464F4\\4r4", "tsY<:", "OM &4K", "DTObjectDictionaryh", "Q`[z^/N", "He4~N", "Yv;2O", "})_\"cI'", "{%Aw~w", "[!gO:h{AI", "=9=c=", "Hr?g@;bM", "if64K", "4\\{Zq", "@|9fw", "r:3\"'", "E40R)", "4x2di[", "PFieldExEntry", "/,e6w", "O;;60nJo[", "0!R/{", "\\^bP`", "$+b&8", "e[wWX", ",RYy}", "'=x)r", " Ly;=", "KTDictionary.TValueCollection;", "cSS(3", "la+]-", ":%:3:;:I:X:", "\"rrZ{g", "5V& c", "&i2tc", "dv2xE", "5vdk,#h", "orR5 ", "bkvHY", "FtW.tfe", ";oynj", "8FFXKH", "dX*g[M", "wv9 S", "?$?5?W?d?u?", "To77`!", "8;9N9", "C[r>MO", "U?cf]", "'u%KDK", "M+HyX", "2]zT,", "9O[EV", "*?m?S", "f:>V\\.", "ProcAttrData", "`!\\kb", "&kG2TF", "NiceTime", "~QyJ*", "YkNCfxIXe`", "M`'k9Y", "'d.k$9", ")pG4T", "\\Lg]6t", "0,090A0N0T0d0q0w0", "a8`-9", "fqwAut", "#f)--`B", "dui0n", "Winapi.PsAPI", "n2NwS", "*I3Ox", "Q*F5U;", "Truncate", "FKeyCollection", "8?.|wq", "989Z9", "\\Q8w.", "zAKwIXIf", "ECF $qi", "5~TLF", "#F[Uc", "FindResourceW", "'8`u8di~", "+tHU}e", "rf'^[", "jLS(*\\#B", ": ;0;4;8;@;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "WWk}?", "LKL8\"", "~_Q=6", "0nShyo$", "uooP#A", ":.:2:P:T:o:s:", "{O\\0K", "AKdHHs", "-__p0", "}(ws8", "= XyC", "'6\\5-l", "/QWsi", "=4=R=", "TInternalEraInfoRecord", "rkB=D", "L##a~", "XM&e4S", "^U4==", "m8?@}zV@", ".]:Z9", "hHT6Z", "e8WLz", "8e*GsL", "m_ ;@0H", "%=>NZn2}", "`=O.0~", "dES)g", "J@F.y", "2.TEnumerator5", "[`+M(t", "i-O/n", "$>TCW", ".7jsmR", "(B.fN", "8K9X9", "R4g!M", "w6AU'", "K6f)S", "#cei9", "Zl&\"i", "; ;2;D;Y;l;p;w;", "_fqi3", "HG,i:", "(5Tk3", "MakeGlobalReference", "@jOP\"", "FormatMessageW", "=2$xF", "4jF}2", "3TDictionary,", "99>_!", ")MZP#(", ">TDictionary.TItemArray", "?m;j;@", "Q2X*Tk-", "Pr*pia`DR", "lP/m#", "7=;L{", "'>uik'", "mV%]R", "/c_E2", "=P=h=", "|0*u:", "/l|TEcg", "LJu=8", "KH 7Q", "Sf%4\"V", "2Y.9#", "t~4Fn", "?J]SI", ":X8kt3r", "ph-'A", "uninstalltool_setup.exe ", "UcX*o'm", ";-FaHz", "1#,OM+", "q& H;", "N&52n", "1)1=1E1V1d1l1z1", "p8qVa", "S+puS", "/8g_emT", "`#DU^", "cp1254", "a/65`", "0 `N}", "Position", ">?U^x", "VSeo", ",!dh}8", "orv]H", "3bYS1k", "ffx{e", "OicYAd", "$*P./R", "3#ojb", "dN%&(", "18G~x", "c\"mf<", "F%+35", "sp<8U5p", "(4.eg ", "TPropFixup", "{;nKm", "XXY:z", ": C=[", "PQk]?", "Shared.Struct", ";$;0;?;U;[;g;v;", "5'5/575?5G5O5W5_5g5o5w5", "Oic'^", "FQueueLock", "n`b6G", ">(?8?@?H?P?T?X?\\?`?d?h?l?p?t?x?|?", ")*:{C", ":0:=:N:p:}:", "GetTempPathW", "Property %s does not exist", "Bz@\"hu", "l?p3`\"R", "$2[WH", " L+(r|F'", "$0M0s0", "n7z*F", "rEWj9", "&1_em", "E_\"o|68xs", "Z0_^[", "5_A,l", "SmAKz#", "O,\"M8 ", "9TDictionary.TItem", "N]yZ[", "0;g7#", "/?wL&", "Muo|%", "; >1", "i\\sDr", "L`'9IV", "8]M]3", "GD)/4", "j\"n'zu", "PDL\"/", "ql@^*.&x(zd1", "87NL*|", "}5> Q", "D8`.d", "abcddddddddde", "'($yJ", "\"nS-xi]", "KJX[y[", "Mpt3B?c", "KBhyATG", "\\~=64", "FyL0Z1", "}q6+:", "S,]=N", "Yrlt#B6", "cnExtracting", "!%;NJ<", "~ngFc", "8#pPC", "a?TtM", "4[j)4", "A'zBo", "x\"/(2h", "^)o&", "=n[X@", "fU-wI", "of,C^", "Ki};+", "S<;;}", "5I|%3", "s>khF", "Dt5aS,D7", "S\\+9j", "'Ehh|", "U}5L/", " N^O ~&", "v*4W!", "MWL}2j", "XZZbee", "B'/:s", "O,#ra", "7{TaZ6", "Comparer8wD", "2\\I_xd", "*l?eT%", "=,=4=B=R=d=l=}=", "9&959G9a9o9~9", "NcJ8U", "CbO!{Z", "w*qpAR", "&j$\\c", "-3Eq3", "cCjma", "d]^s.", "Software\\Borland\\Locales", "?Cv#B", "5K.TEmptyFunc", "7TCollectionNotifyEvent", "^6shjT2D", "Eu`rWO", "Uh_\\I", "Wk,~>", "VUF\\N", "BBRAp", "K'zvO/", ">)???Y?", "wjjMB", "yj0s*", "hO?XTm", "Xs4U]", ".[\\V*0J@", "{h8~S`", "l0;!)", "CleanupInstance", "E]Pt'", "s*\"5;", "7NhA,~", "= {Je", "0TList.TEmptyFunc", "Operation", "Q#L5}", "$TEnumerator(", "ox3?R", "GM|([", "63777^7h7l7", "zUU&G9", "L,)S[", "C~FYH", "MWOXq", "F", "vuvhh", "s0Sti", "Y&&&XXX", "++9y7", "wrZ**", "3y^_~", "yAOBh", "F.J8Ke", "%AY/u*Z", "a|Q9>t>", "Pv5#T", "FS[9*?", "(z.&Ls8", "Owner", "HasExtendedInfo", "KUI\\K", "@nm7n", "trzYM<\"", "e3T>a", "ebksT", "]a|G]", "sV#:v", "[.arrayofT", "gOotXg\\n", "yL:\"\\|", "AhBGy", ":|}z\"9", "W5gs", "O%&6-", "jJskk", "+MT9i", "4Z Ha", "+A'CCtuw;rjq", ">V^k9", "n>c~P", "t}0 5", "FDecoderState", "i,O:l", "(vo{/", ";]TIO", "ComponentStyle", "+C+6^3", "V<(<}(", ">OV>(", "O=spN", "7>}Qp&", "u=U*vL", "Application Error1Format '%s' invalid or incompatible with argument", "wcU7{", "H/(@Bp 6", "PtrJ$d@1", "'wl~>", ";\";1;D;^;l;{;", "9f9w9", "-H~[ZO8", "CQ]u^", "t/KD'", ":@\\N?n", "=^y-~", ";UW-y", "Z_{(L", "TLibModule", "M3R(l", "u9{Pv.R", ";+;:;I;", "p+2z#", "/~q2t", "-|Ni,", "3Ti~N", "%2D1CrQ", "/l1z[~S*", "U%f%.D-", "b88ASC", "IsftL", "@fPu)", "}Enr* ", "wa@;B", "TRttiFieldE", "#FYvQr=\"", "1Pl\\G", "EVvkF.", "xT ;D", "5c[@d", "fXsRE", "&L:KWxh", "0$U{K", "+%ve)", "qO/W8", "x)X {", "^{zzC~", "Compare", "Z;|oRA/m", "~+P[j", "7 8)8", "8b26(@", "Handle", "Am6:'", "(F@U2", "GOQ}M", "8Hdjw<", "7KAh ", "#N(|j", "GetArg", "9H@)k", "Qeat_", "In\"-V", "yT)`u", "RegCurr", "(~#J'", "Upf{%;", "@1uMh", ".iFpH", "3(4H4P4w4", "uN;TR", "^/C}r", ".RQw$", "|O4W!\"", "pKO@LzGso", "2\"2V2", " SEDB", "MessageBoxA", "1XVx/?y\\", "gIO1*d", "ATf.TEnumerator", "JKv.TEnumerator", "8\\6Udns", "ms6Q[", "\"CD&L", "N}MFE", "+Mdkg", ")TList.arrayofT", "5*5;5F5N5l5~5", "UserTime", "}2`Ux`", "eSTd`n", "+Dd>5", "<}4S^U", "qahAk'", "bW>5Z", "0py@ 6", "TEnumerable'", "L4VI+9", "iFP^b", " raTg", "6G22v", "!9`UJpP8", "}%d4G", "OSLt1e", "FReachedEnd", " !\"#$", "5))UB#", "3,SGQ", ";{3vx", "x[5 '", "~8jhL", "2*6,f", "' W3{", "3~4\\5", ".F!K2", "FromHours", "-1@bt9^^", ">Ijaa", "siEZ|", "Uninstall Tool Setup ", "eVDs\\|", "J}IMp", "`,J1r", ";T7G, u,", ".dSq]Ca", ":P{)8", "2B/?O", "yj-9D", ":M,(/swQ", "~'YGy", "L2d`i", "\"7@N$}1*", "$0\\5R", "q)a!zl@", "EsK96", "R\\nbY", "0=0h0", "6#6+636;6C6K6S6[6", "~[KHY", "/[=?$", "`%#rB", "rhTG~Z%", "}4Fa[k", "!W3X.", ")5x2Z.", "Xxi1e[", "TRttiOrdinalType", "5h6u6", "6OM\\>", "Z!YL3", "\"}qk`", "jzJ", "u\"'hV", "k'B~4s", "8uv'I+`V", " %6~ LJt~V", "<\\hH6", "^ce$Z", "UhAHJ", "7.7<7N7]7e7t7", "G$w*Om", "v}H+S0", "&zL);`q", "ChangesEnvironment", "&.+ubNXSx", "*/bYc", "444z4", "CKe]=", ".U3JP!@", "2\\vMiD", "3$3(3,343<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "System, D", "m[;VmR", "Y~m0-", ".O,.r", "TEnumerable", "QnsRF", "0/1d1", "y:#i~", "9/9C9K9\\9j9r9", "W$F_#.", "SystemT", "1]iNU", "~&E5H", "*[e=u", "ParOff", "nP+Cdb^", "wSQ30q@", "|=n),a", "jKx>>", "66 ,T5.`", "h3{,)*{p", "dCm\\c#", "euc-cn", ";.VT;(Lo", "cAAy7", "x]p\"[pX17f", "a= JTv", "0tfNR", "tS9^%(", "9zaE5", ")Ts0:", "G~9#\"`", "[*r5(", "vm>5:ll-8#,", "I a>wN", "/Xf@w", "1$uM1", "XFjBF2", "3JTy*", "()QG*", "VW7Eh", "$amMwMn", "F<`y8", "N'", "6]w*;", "e2T`P=g?'r&L", "~X1=QT", "V-xsb%P", "dfF|D", "2Awp`", "jo((z", "ekB?Y", "F9I:(#", "]Sq3L", "hzoX&", "l&Ws\"vU-", "2v+", ")|-P]", "1=2%3)3-3135393=3", "8a5yr", " IqGC", "R6U[bW-", "w", "$#=dG1", "HB.nFR", "*0wbZ", "#TEnumerator(", "-H mJ", "ib>~)", "1$1(1I1M1n1r1", "avip[", "!C(vP", "0[E^P", "2#2;2C2K2S2[2c2k2s2{2", "Sar!V", "9f0X<", "z%z}h", "?DVs", "!)F`eI", "[F_^9", " qi/k", "%&'()*+,", "PInterfaceTable", "JeB+n", "*5x#9", "Z]_^[", "zhVUG", "{'IbsxO", "; kZJ", "6LCvNT", "5U,8e", "!e9#u'", "9Qi&_@1", "TS\"SR", "WVN4w", "{zUT>", "6GY)o ", "(Phyi", "6dC8K", ")hg\"g", "?!_ep", "`|J,EE2", "g >}hJQ", "o+o{k", ":;:?:f:p:t:", "T cQ\"", "R?Lo9", "Fy5BL", "lUv|r:e*", "finalizer", "oE4lq", "ergu0;", "mkClassProcedure", "#F.qz", "\"xvzH", "SetupLdrAndSetup.InstFunc", "uKbh|", "6(K/|l", "'QRZO/4", "wg#J7", "bKM?UU}", "ftCurr", "6-6C6T6e6m6~6", "ef ux", "FreeNotification", "R,^n+s", "d[wE2", "XTArray>", "fAZS.XI", "x$)%3", "-mu/[", "2jxLy", "gYEwI", "M|ELwS", "9qsca1DO", "ifHasGuid", "jb{AO@6", "77F@17", "ub(w3", "Q3\\MFC", "Z0hjiE", "DH_4a", "IuGR<", ":l133", "|(FIh", "7!7)71797k7", "8$8,8084888<8@8D8H8L8P8T8X8e8", "+EW!X", ">{,_c", "7,7A7T7u7", "> >(>0>8>@>H>P>X>`>h>p>x>", "sp!0Ku", "%TCollectionNotifyEvent", ")\"Adp", "6@k4>", "e?o6;", "07VO/;m;", "OC9yJW0>", "oFyr>Hm", "@sggg", "Y($L0(", ",DTU<", "rDdnC", "L6=~,:", "C[v+j", "bB[PK", "Operator", "FreeMem", "kZxyF4", "Go$Ec", ":8;h;", "aFqf+", "*U&BB", " TSetupPrivilegesRequiredOverride", "Va>U$", "$TEnumerator(", ")Y/f\\", "fNlW{", "RequestedVarType", "0+IZz", "Vp#vF}", "&\\n7f", "'(JBx", ":TListHelper.:4", "4&4.4<4L4\\4n4y4", "XH2&Z", "E[?9BPl", "8(808>8P8i8q8", "0tm/B", "+G\\~QM", "LtePiwI", "TReaderError", "tz\"#tiq", "Ri!H*HM", "2tcnZ", "k15$Z\"", "}INS7", "O%\"RE7", "^feem!", "*D_U~", "27r*R", "`xP/1", "5!@hW", "EInvalidPointer", "0C0J0N0T0X0^0i0o0s0", "3 3.3<3]3p3v3", "Wv'B'", "@L4B4F4J4", "N:ke2", "F]}r_", "Kb[wDG", "y]eB2e", "j0_pH", "BvtmH", "l7>1p", "Q(Lu\"", "gN(_b", "lRf%?", "tV]$WP#uw^", "}\"0q}", "CahcE", "SafeArrayPutElement", "O,}@^|", "FParams", "ZpXiY", "WM du", "40Ezzt", "CuJ\\P", "2.2%L!+", "WriteChar", "}W#ANK", "`sd1Fq", "OFR<\\", "URol3", "^J+l,Qn;", "tJrHJ", "[hu%~", "./335", ":p3^g", "_2z^t+", ";';.;9;I;~;", "l~7fV", "<#H5H", "j9n-97V", "XMToK", "&0id5", "FOnSetName", "WriteStr", "GMFkUU?", ";(;;;X;f;v;", "+i!0A", "kernel32.dll", "ZGpX66", "y1?iO", "dK", ",Pg3G", "#?L9[", "r#dB]", "/BxMT}", "&3KiE", "M`p[n", "i|X>i@", "=]y;_", "Tfaf+", "]>9gnV", "_I?u\"", "N][N@", "#Awq F", ");d%P;", "LoadResource", "QSVWf", "TRttiInstanceMethodEx6", "|@{h.G", "c/z p", "EpP~t", "i@d_Y~9", "\"u8vft", ":\\:g:", " mdvs", "-L-#Kl", "+G^hTU", "b/j]a", "6POmy", "ok~n9", "9^eF9", "L=AJ;", "Y#is8s", ",8BL/r3", "D% ;m", "\\fc!_", "FpmP3", "SF,%,c", "P8i(5", "@\"j}[", "$s%'z", "-%\\B{!", "]# fksi ", "Qt#_%", "IQ", "cmLZMA", "_b/<3Y", "}v4U<~", "^m.)6", "bD/7u", "/*Kivb", "^4[i@PLW", ":http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0{", "I`AUL", "0040[0e0i0", "l(?c[", "m!5qY", "FnPmo", "ob@]{B", "^D\"D^b", ".P0*P]6", "uMGOi", "eN_XK", "Observers", "o(Z+&", "`+ItK8", "1B=;/", "k@FWrd", "=~?Xy", "pfAddress", "|sDWHY", "dD-IF", "D%itqS", "csibm864", "p.=Rl", "PsI |", "KypHN:k", "MZ%XKM;pQ", "Collisions8", "Pz\\\\to", "1(QCeu", "t,s#N", "=c{Rx", "y0_Ke", "?b?s?", "2Y2^2f2", "ascii", "HdIfM", "stNhTZ", "TList&", "[P?cww", "]*=b.*", "8A.zy_tM", "uh_%3AK", "G88xh", "n2+08", "464:4X4h4p4x4", "Location", "-V)Vo", ":fZY=F", "oz0AO", "i?ZC!", "vSJB;", "^7G8,", "-R,PjH", "l]\\ttn9", "m/d/yy", "H|?@c", ">$#j/", "^^b!Z", "4\"8+.", "`e6cH", "Qw'D2", ",`S\\tO", "kP1VF", "y<\"iT/", "3xJicDI", "Cc)x\"s", "FMethod", ".d8@U(", "OB/Y_", "O5%I13", "ReadBufferData", "=,=?=K=\\=", "QhW\\S", "VqR=T", "q5D;r", "#Y'>v", " f ?8", ")]lHL", "\"sW:0", "2.;KG.", "~", "$]i>G", "<(s\\e", "Shared.SetupMessageIDs", "![cbWtH", "p'D?g", "z@:/)", "T6tUV", "\\lJVs", "PInterfaceEntry", "JWNf~", "!c.6/", "U!^Aw", "no?R9", "hYS|7e|E", "+TEnumeratortvG", "TUnitHashEntry", "L]-u)", "/dC?+", "uxEt*", "4Yk2b", ">ZrN\"", "Hvye/", "a/:|g~", ";9s)Z", "s)IVf", "1YkF'", "5F.1ze]", "qsMHgP", "AOwner", "2(2I2", "p;Igp4i", "k C[@", ">D!lI]E", "PwkPq", "avfdp", "H2[xx", "A8Us-", "AS:z*E", "17lFU", "6/6[6", "A1;Cd", "at'5K", "XKK6f e", "_qUd1w", "?2?:?H?`?", "9a,F'", "TRttiParameter3", "yUe:U", "hV,uP", "[5pTb", "4\"jrt", "%lW.M:", "A{ot7", "Di*v9:Y1", "jc&>SA", "7NSbF", "OTDictionary.TValueCollection;", "+!eEM$dk", "?usfD{", "j>\\|I", "$M>(qnpXwb", "FLookupRoot", "Jt4}}", "3 313D3R3h3{3", ">;q[~", "j.4vd", "@!Vix", "+e{F6J(", "s*=tr", "Dp$\\8XNd", "hXvbS", "N!Qr6\\", ",2X>`", "ecjtvx", ">5pSrEru[;|!", "eh,YW+=", "l6799", "?2-Gap", "By)^Y", "-uzI\\B3", "s6-]z", "StringBaseIndex", "8tjHRV8+", ">-?T?", "L^&t{6J", "T*%Ys", ")8", "m|}5V_5", "B&F#-", "ye4;z", ";Z;H\\", "4_CE4", "z b>X", "DeAzd", "ibm869", "yDgGK", "B[OW5o", "J'uO@", "RYBTT", "J#uX^", "e)S%u,", "`$yf ;,", "wh<`.bc", "4C4zv", "LanguageID", "!]LV'", "dupError", "TRttiContext", "J!kiB", "6S4'GDG", "a9\\\"j", ".TEnumerator5", "K-I[' g", "6cR8&", "&C}n`", "_T4*=.", "x'#D@.2", "p|kdN", "j<7n*", "l: \",W", "TRttiMember", "e@P5}", "4SK\"GT", "KR^-,", "t0Rp7", "-U_'g", "/9x\"Z", "yg2,+", "0I LWG#", "}\\X E", "fsNInf", "ZMxAJ", "95 !m.", "Invalid NULL variant operation%Invalid variant operation (%s%.8x)", "PExtendedd", "FOnError", "AppModifyPath", "?\"?5?C?U?j?v?~?", "K$9$;", "dI![c", "@%OGG", "ldUILanguage", "OT,>b", "5W[0x4", ";AdQ:", "0RpYR", "Invalid argument to date encode", "iso-ir-138", "ResStringRec", "*3\"!G", "XO!yH", "*l\\sE", "ZJlS0", "SafeDLLPath", "Za&^[O", "xY\"ON", "2c2k2", "50575d5k5", "CB'nl", "GetDeclaredMethods", "%_ArR5", ")`ay!", "T? E#", "DqA=3", "33\\$J", "P&u\"x", "WQ_eV", "fPj~Df", "SetValue", "838:8M8", "%wEpy", "l|c\"m", "k#C-+", "8|K_qg", "#QtHF", "R'{lJ", "BXM1=H!", "*(bag", "&gvF]", "UTZz5", "J&7$hx", "M;uIY", ";4<=<", "R:fnU", "S[L`]", "oV%E3DD", "$AlW|", ">H>[>k>", "gvmnb", "z,?x+", "VUnicodeString", "?;bwX", "dv{ew", "lmNew", "AKr/r", ",v~t?", "(;dJl", "", "\"2D_N", "088H2", "x!>C>P>a>", "m8\"Ud\"O7M,h", "csInline", "WTArray>", "tQ 3H", "U5A@EfK", ":C;5}", "C\"CmPsx", "p7(HX", "|* +H", "#lvf~", "\"rb?o", "L@qKx~", "|0BAL2", "0'0K0Q0`0o0u0", "r `%v", ".ParrayofT", "&.Y+t", "?:cZo", "M-OE[g", "T-5.R^", "`9Tlq", "4sGdz", "MZ^k-", "5'4KM3", ">#>Q>y>", "z~ o\\", "F!.Kf", "@]tPB", "*i\\|r", "aUj<)", "1TCollectionNotifyEvent", "?$?H?X?`?h?p?t?x?|?", "^5-FB", "=c:Kc1z", "^t)9L~", "c}7#GP", "YDLZ&", "tpIdle", "6#616A6T6o6}6", "*4`p4", "%>L>S>Z>a>h>o>v>}>", "#uUQ)b", " [0Cl", "sK/maAD", "*xd3]", "j`2yO^", "w/`JWb", "GJwL}", "ZKP2&", "jP]}(m2", "?:*}_6", "k2D>rj", "`k<#l0L", " zVUh", "NnN'B9&d", "Zhgr~", "8.8h8x8|8", "FHeaderProcessed", "7g`|s(", "Uh8V@", "n$)}{", "FSVWU", "!`wci", "-I!`FgA", "NormalizedLocaleName", "JC8_3}", "3)J[T", "<.,>;>N>h>v>", "7Dk5k", "NW^Yy", "FStub", "9&9r9", "jw9WA ", "~t,?E", "\"7.TEnumerator5", "8$8,84888<8@8D8H8L8P8T8X8\\8`8d8h8p8", "4-474;4`4p4x4", "P2,S&", "r,5$v3KYg", "&op_Equality", "$t^!<", "Xb.Em", "VarOr", "kuaqx", "Fol}E", "T'\\FB", "_Kx?/", "@*QrR", "Fy0(i+P", "|9$t2", "!}Rv6", "M1h6gu", "M2LT3", "og v1", "AEmNq", "SvKZMx{p8", "W{Y#qZp", "d/Sq}9T", ")0Fq^", "#TEnumerable'", "vaNil", "grG~;", "CTDictionary.TPairEnumerator", "T%Oor", "TList&", "80SJw", "@!.Zu", "csibm855", "o8'fw", "dJzIZg", "dB&wO", "7a869E9", ":o4Je", "8TPair", "-hpwH", "/)#D2", "s3wih", "ACompare", "vP%5j", "#Vv}`", "A%s}m", "<0T4t", "RecursionCount", "BQ&K5", "A^X7(", "!TList.arrayofT", "+2<~%", "03^sUltf", "?Vr3yi", "QQy$]", "BP^tb", "=>ps|", "ro]+JC", "QVB5y", "6p/aHS", "0!HAi}M", ":x!u%", "/8j9C9\"", "1'1+1L1\\1d1l1t1x1|1", "qXA~I", "CMH\\C~", "4h$_\"", "%_L?JY", "mi<2k", "3cVRc", "wm`Ww", "T+D?j", "VgF{$", "AK(:M", "15\"Fz", "5$535F5\\5k5s5", "2>2N2h2", "6^(NO", "N:pA1}", "PfTII.t", "\\-[X8", "*NE;t", "S#i'w", "bE&|0bW", "?!?)?1?9?A?I?Q?Y?a?i?q?y?", "1Z2,3D3", "GetCPUUsage", "SRz{xtb1", "]alrg", "]T6\\Ie./", ".t1:X", "'(+`X", "\"\"PGg", "UhIg@", "/Pg:`", "WWb0e&E:HV", "'7O!Z", "gfd^S", "bgR8CM", "ac80:", "iUQk/_%", "jZwrj", "A@3e6", "N C}|", "K A-p", "tPDq}", "t-y O", ".WPie", "%wP7V", "&&!rI", "F9E0F", "Y00iu*>", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGzlb", "DX_T(", "rc1ME", "^Mvf+", ":TLZMAInternalDecoderState.:1", ":4;`;", "uPZJt", "Ryr1<", "3LR>~", "0Rd[4 ", "FInstItems", "SYm$,", "B%umX", ":q:v:", "Zc,Le", "bbvHUM", "stbP9@S", "VxWa9", "|'6XN", ";x!84", "w_!+P^", "K!nD~J", "Gx9+b", "e[K.$", "6#606A6Y6g6}6", "ZmYH2", "{HCv0", "I17; g", "I+\"2@", "0vUk@", "OBe*6", "D`xN!", "dR4nY", "2ghmEp", "class ", "oa0}8S4+", "xy8Eb", "fL-LvyO#", "oW`wl", "tFE\\M", "Eo/;@", "XC]u0P", "]>i9.", "GetProcessHeap", "z.FZX", "8P9b9", "0 0.0?0T0f0n0", "NgW2DI", "Instance", "|&)q\"", "dqtlZ`", "NsRz\\", "[|kY+\"ti8q", "-\\iE^", "Yz6zsq5n", "AllocateAndInitializeSid", "5A~6d*", "0=-mfPW", "9 9$9(9,949k9z9", "='|4Z", "TArrayPropInfo", "+YhhY", "edppiV", ":!;);4;<;L;T;\\;d;h;l;p;t;x;|;", "Shared.VerInfoFunc", "8TEnumerator(", "RegQueryValueExW", "\"G_0h", "9I8cZ", "f|a\\Urn", "P~c|%6", "fsPositive", "1ii!M", "kndfT-", "4$494G4Z4o4}4", "q=,@H", ",s2~^", "!ev~<", "~/$Z$Eb", "-}ON/(", "OnKeyNotifypsH", "VarAnd", "N96\\c", "FFreeInstItems", "4A4`4w4", "IDATx", "_l8&W", "o4Oe(", "?(?0?>?P?^?f?t?", "jme_ ", ",h>lB", "5 5<5", "pGWj+1+", "SjtOs1", "Kyf-uM", "O%f'x|", "`|MeI", "AST/R)", "TFilerG", "0M?N?'", "VWideChar", "MN:0mZ ", "mkClassFunction", "> >D>d>", "FRevisionLevel", "?|X5Z", "d`;^l", "EFileError", "z`2sh", "Bgz:+R", "5L~>8", "d{8]6zPP", "{c3z/5", "4lokOy", "Bww7/", "GEo=?", "g\\~XK", "BCryptGenRandom", "t0\\A9", "?4[;;M", "RA015", "!4X$\\e", "J%Z[[", "[KyK$", "z#EA$1", ">N{bMf4g", "otSByte", "4B4Q4", "|,cW\\", "sIO:F", "YCcp~", "T'{^c", "vm{nG", "[,\\T:", "W,%$s", "0,0C0V0^0l0z0", "CH_?C(X6G", "YDuZK", "r>YriW", "I d4sM", "Ehsp5", ":d&\\L", "xK|PL$", "G(G%q=", "9.@xF5_K", "qS\"&`", "xK~S~", "AppSupportPhone", "F=Ho%", "I\"$O&", "TIG}9", "8I+zo", "gY$,Tu", "m('V`!P", "fy:*w{", "m:$n/", "y-M@0", "#Zr6l", "71\\vj", ":\\'eiq0", "ma.u;%", "$|Qrc?)m", "2+VM7", "zUZ^t", "uM%s:EQ", "zz$T=\\", "Ahed[|t", "Be]|M", "uHKNO", "X\\{Ch.", "}xJkz", "Pa,*,$%8", "iRKvp", " ", "YG{m6v", "^$ZL`", "'nS@s", "ld$_*", "km-U#l", "h1/#H^", "3TArray", "sBDc|", "+R:z$", "2%2,2C2G2K2f2n2", ";yv!p", "_JU:e2", "}7@?IP", "2G3c3q3'4.4", "'bceV|", "OAp={441", "D/Y Z", "bp^Z:", "c]8{P", "vPW.qy", "TB'", "-ab_o$l", "-WN|o", "WaitForSingleObject", "hP]YAw", "c@yJr", "3(343E3M3S3^3l3|3", "o\\=?", "Of!f=", "]7C\"Zs", "1JKud", "p|<{`v", "8Yc", "2%;1Nu", "tj-p`8", "T6IdE", "3DxSex", "AjDp6", "'W\\qC", "hEK$3", ":.:::B:S:a:w:", "1EjeZ", "EUL.|n", "}?i F", "dzGl.", "C/nB1\\", "h<~~T", "UninstallDisplayIcon", ".KjAv", "(S.(6", "Bx%tA", "eQ%!S", "W{%?D", "E.I{Q", "1`:oQ", "}>2bE", "MV\"}%T", ";q$81", "251124160459Z0?", "w>&ah", "i]{;3.", "EDivByZero", "VarCmp", "<#<;", "`xpK9", ";@.rI:0", "vbkRX>", "vAMcjcIxx", "FwW6u", "^NRwr", "N33\\d", "Spy]/;", "\\,Mj\\", "Mantissa", "gCi@|", "l_kJ+x", "jJF*B", "Nqbj!", "AI~1ZWk", "3#3>3B3^3", "h<>Hg", ".W&rF", "tg-Cyrl-TJ", "{GRO,", "veB7H", "s(2|-", "J@wGdG!", ";__", "/}a1~", "6-666o6", "S@ t4", "%IEnumerable", "Ku#S_W", "? ?$?(?,?0?4?8?)>1>@>H>]>e>{>", "TStreamProc", "ASWcFbz@q", "wk\")i", "{{c8`L", "0p1f*", "B\"z;Y", "IiE4~$", "=NDBx", "N;}b]Pz95", "@C4?\\", "TMemoryStream'", "2l:?8", "r%BUNKqPy", "[$-`i", "5 5.5>5P5g5u5", "EInsufficientRttiP", "xd516", "6AYD\\", "LockList", "##2 ?", "Ti0Z[", "|g]YjAV<", "]z-Wy", "<$]jP6", "'/c", "|hsp[", "u_(,j", "U?!Kr\\g", "GY+ew", "Y\\(pe", "PP{Vv", "`oh*g", " ", "LW124", "l[h-gqC", "_hNC#", ".Q_#_", "Stack overflow", "\"0t#+I", "GetMaxByteCount", "fKTiMw", "5bxAB.", "LoadLibraryW", "k*RAVk", "R|StZ", "Rvn=2y~W", "@/'y\\", "<%<9", "TSynchroObject'", "[|c,]", "Bp6]a", "JJH#^", "U0oP,u", "G&,R$", "ZS@RN*", "/aI2^", "=?~6<\\!#", "LUri\"", "5^/N9", "G1`ku", "k5p@R*", "P_~tf", "V307i", "]|4AB", "N zNI[#", "=xH1_xb", "%(SJ91", "F)(Mauc", "(A#jrQ", "rl[V&", "$ZXs?", "TPackageTypeInfo", "K&[T$", "uI_2tVW;", "TRttiMethod'", ">k?r?", "sQ`M6", "Y9Vzwt~%\\", ",]2]R", "?;AK3 ", "(-,r,", "sr-Cyrl-ME", "$qU8G", "=B2OTu", "!`ml[", ",{[._)", "t~aXkolr", "Ak1Wom", "C\"!Y\\Y%", "Qe{p>", "T6ha/", "5U??R", "s_(e|", "KTTx`", "%+j~\"", "|THd2", ",K+Gt", ":A'j4", "BQKJm5r", "tMd^N", "I[|;Bld", "m=/wqp", "<+c|1'", "N>_`~~", "iso_8859-15", "tpHighest", "{X(6c", "FoqSC", "Pqg/g", "IM?cF", "RC9G^", ",&LM}}", "(M\\Zg", ")&I", "hH%~1", "}a'09", ".Owner", "C84.l", "1%2Q2f2", "5Z;ix", "PN}w8", "Jj//(", "J,~j$ta", "t:By7Q;", "QgzfD", "II(PQ", "Uninstall Tool ", "RegEAX", "}ecm!", "K1?nT", "TFilerFlags", "\\.a|~", "sXW7\"", "pvrW]", "[sSC7", "1l]!p", "5kOKP", "P0ez!", "m;(d1", ">(8S.", "L=", "88kdt", "hddddddddddddddddddddddddddidddddd", "._z-f", "EW(Kq", "BksME", "0TList.ParrayofT", "ynO{X", "%A\\DW", "W4{i1", "B$J#_", "NmEO1}", "UnitHashArray", "\\7_;DO", "SsI1k$", "n^tO+Io", "tbu~we", "Z`O@l9", "<2<:8Q8W8f8y8", "(kz}6", ":/`N(/P", "l&VbX2", "eQ{8!", "\"\"J(wx", "<`7+B", "FindClose", "-B;lM", "s$N>]k$I#L", "@JzDs", "vHG!% ", "#`.I!", "z1q)nt", "xR$n>", "P&60$xv", "jg`o0", ",f(F/", "DispatchMessageW", "#C?(W", "bP=f3", "ve^p13", "e,5^s", "Dg!K&", "!,oEh", "BFGGY]]", "IeAfHn!p", "9 9$9(9,9094989<9@9D9H9P9X9~9", "EPrivilege,", "@f|He", "Xlbj{S7", "f+i&j]", "&$+]Q~", "4%4<4O4W4e4s4", "/k/;J", "9KH}6F", "E{X53", "o^byIy", "}:- w", "6_#TnoH", ":k.XsH 5", "FReturnType", "Z{cW", "m]>21", "crLessThan", "!hSdaK7t", "]2X)@]#", "ZkDZR", "Al5*J", "_me6H", "X]M", "A{}{l", "iU::c", "'U#Sj;", "hO=OS", ":LR',", "L-!jW;y", "_3[g6", "'\".PF", "tuEM|", "!fk3pw", "7l&I]", "dVsjBZk'", ":?we`", ",=nA^", "TNZ,.", "Parse", "[=4?sF", "3/4S4m4", "Wq#x/lY", "WEA}6", "Bv)IM", "{P_sT", "9gotQ", "NIH6Z]", " = procedure", "k|<8;?", "s0W]t{", ">c:uePn", "7TrW_>", "IsEmpty", ")WSNQ", "b]}bK", "wC0EK", "TPropSet", "Qmor`", "cCP7\\", "HasInfo", "h\\qf_", ">EO:x", "Z:k6+ ", "?ZrTwI", "I/aEr", "Uh0(I", "45PkW", "hgC>9", "~@(n(", "k{kVO", "pBj(7", "hK-[P", "-8zfo", "< <$<(<,<0<4<8<<<@@>t>", "j<.XMB", "~ Dx", "8 8$8(8,8084888F8N8`8r8", "rLIg8", "S`^^q", "TryCast", "nrF/V", "Ev&f]", "+/|(W", "\"p:QM.", "iTW&m", "IQRD`", "0=k5l", "[ur2{", "iAu}G", "8@I*/&", "US,FQ;", "1r]gR9", "y0}4c-", "p?5d&\\E", "V2}vZ]", ";t_s^", "&\"\\A%", "I1G#q", "I\"sw.", "cut($H", "TList", "w-Zly", "cjP.1", "4D4K4~4", "0+g\"t", "RW`L@W", "/Ha*-", "t'Mep3", "uXthH", "o[#uYf8", "cp864", "C@cG0", "6@7sk", "#EG)9>", "5$5,5_5u5", "c~E)>", "cHxlx~_", "SR|3iN~+", "?7e\"=z", "WpD]-", "GetInterfaceTable", "og);b", "System.RTLConsts", "0`?rt", "rVr7|", "oD(*g", "WriteDescendentRes", "FIgnoreChildren", "E%3KR", "xfg:ye", "@zP~u", "9,959n9", "&TList", "fqeg\\U", "j~hu:", "wV[b}", "QQQQQQQ", "TComponentStateItem", "WT[h|", "W:a~9", "@^$Hiw", "DD3gk", "J$N6M", "G1YK]", "~(=Jvg", "_!fz0H", "[Gl3V", "95T'g2", "T,a>3", "AProcedure", "i@.9%q", "}YHGM", "zc$DP", "m)V(j", "PPropDatal*C", "8TEnumerator", "q,l{k", "F*3I+", "%VO\\d", "R\"JH8A", "?nZDu", "q_;EO", "%F5xv", "AL08H0R", "InnoSetupLdrWindow", "QN=OR;", ">YbG[2Y", "[FM34", "F7+TO", "FFinder", "Wmv<:", "\\#9Og2PK", "|7D0w", "=7eH'", "T8uD]?", "LaIoIY", "?y0.o", "xMby_", "iV|k7", "FMaxCharSize", "n( .#bu\"", "|d>AG", "95JqH", "np\\4S", "},f .", "eB,Qq", "PList,", "UP<^@", "eL=pY[", "}OE[#g", "v\\\\Dx", "kzb)s_", "EHMlZR", "TRttiInstanceProperty3", ">)>:>P>a>u>", "^Hh,)", "string", "-h;Y:", "b2X=.^", "1*2]2d2{2", "Values<", "|[hLJ", "(-Q!dZ", "/\\7cR", "jS9yC]", "yQZX~", "6'6/676?6G6O6W6_6g6o6w6", "[z/L.", "4'yRa", "4(esPz+x", "c4I._`", "E\"n?6", "?}b-`m", "w3S657", "JZ|fR", "}iJFa/m", "$TDxb", "E]Dl<", "7'\\k~", "o9t#\"", "CF0KpefY", "2;2j2", "#C,eD", "IDPB%", "U$5+lN", "B}:^J", "ab4 [", "f/>Dd", "X*;e&", "aZr@,T", "=5cg@", "a/4Ty", "?UGKR1", "NQ%cX", "0F0a0", "R,>g'7m", "DKS h", "fsInf", "$`|)H", "TE/<@yX", "Unexpected Memory Leak", "(^yFb", "da2Tv", ":,;E;d;", "S8]0ojGG", "MQ*jsB", "7ZVfDj", "L~$ag", "sr$I-M'", "X&nKnX", "e>M+FqE", "qK'pV)", "t,<)6:", "485u@L", "kia@r", "GiW;0", "vq$o'", "Pa[(w", "]k^zl", "X%8", "742E\"1", "NG]:9D", ":':.:F:M:w:", "w}g)", "!TArray", "+il'`$", "$N{", "QO@pc", "H%5^ 7", "Yx ZK", "Te8~'=", "G1|&~", "j0:q.", "ACreateDisposition", "}H@w,q", "uO,I&Y@", "E$'!0", ";+%nI", "u;bJKS", "j;@>v", "tww?x", "TVarArrayBound", "cp874", "?:uXMd", "hPH~X\"U", ")?Fvzl", "\"[J)/", "JFpE}", "TInterfaceListEnumerator<", "fGEJ2", "^(&u!u", "/TCollectionNotifyEvent", "big-5", "y/gri", "QJ7/K", "S=erJ", "@zvpG", "zE{j7", "%-S3c", "E%>a>", "jC{0>o|/z", "[d[Cm", "[.CgW", "f`yn=K>o", "A%+U;", "[lTM/ou8<. ", " sI7'", "\\Y;ICX", "K?\\C0.", "hG6pg2", "ETq-\\A", "r7(1-", "v2:wg>E N", "aTEnumerable><", "J~[xD", ":8G&(", "I9j08", "SkPBj", "*'/3,", "U+9e3", "wA}fU", "TEncoding(", "H0]0}0", "}rn[~", "xsQUQ", "X_{0S", "JJ^H/", "&b&jg", "Xw&M2", "Vyq%[\\", "dT6)?", "!5C8>", "gNh$6", "Hyi:HBk", "aYLbT", "1D1o1", "m!6.x56", "MQ)~eTDc", "%u3cY", ")!Kyd", "/lwsG&", "72{z0", "T3\\Cn#j", ">~5n>Q", "TArray", "9|y\"l", "^exx{", "5Sab(", "+wdu[", "UhFyE", "<\\Z9v)g", "]Z[:C", "ProcSig", "RegComp", "FInitLock", ";J5#!", "Qwe Uk", "@Sz1M", "=NoyP", "TInstBucket", "opaque_Range", "UGm9J", "Mlq8'", "y\"Yi~", "x&f!U", " )+v8c", "8$848F8c8q8", "\\x~wQ", "? 41WK", "WiWu8", "J7Jh7", "HPPGENAttribute", "1&181M1g1", "o\\?5d", "~+f7f", "y|b4RU", "C[J-`\\", "5_uDU0", "nJS2^", "HiE=C", "\\Q$E?", "}3YMh", "o~TE|", "\\#MxZ+", "Q9D~qR", "=caL>V|?", "ffcO{", "P%PDj", "@no8Dv", "99S%ofNwR", "T?L4N", ")<,\"NG", "&`-7_", "y|3Py? I", "$,P[%", "o}AU)B!", "TpJ_6", "]ca^82?", "v!o>#HW3", "?ZVnS", "K[0RWT~", "P79=K", "]% 'e", "\\1@nr", ":#d#SA", "TLZMAInternalDecoderStateP", "ao/'S1", "\\`:", "nrg'|", "P{>.E", ")M**S", "H{LjmN", "\"uyL]", "#a.yS", "$vZ:a", "Q'O2E/$w$", "stcPreallocateOptimization", "\\aj?g", "EStreamError", ">rJtb", "bv~Ek", "7!EXn", "TPwzwY", "- 6=&", "Aa5ca", "zG|_j; ", "DS*PA", "_K3;X", "U[", "g;t_'", "QPa~a", "UJ$SA", "6 /;+U", "CastTo", "~foI=", "$)EZT", "N$&*V", "{,OA]", "2lPP;", "aj9Y5", "\"UMtx", " ~is!", "A)jt9n", "_ or^a", ".ctquosEeL", "1w:=x", "BaseFilename", "H'Wo\\~c@m", "0TCollectionNotifyEvent", "<}1g", ";.;<;D;U;b;j;|;", "A!$]=", "38-JD", "Y-jUGe", "Fbk7l~", "Dp `1J", "[d~P9", "Lc<#\",", "nlac&*", "rFOu\\", "if3\\`", "ojj}A", "]Uy6v9g", "@$UiM", "xLV/g", "iLoZ ", "g7.TEnumerator5", "~o1!-;[", "V_G6v", "3>3O3]3s3", "5.686<6D6H6P6T6\\6`6h6l6t6x6", "BWUNx", ":mm:ss", "+&@bi\\kK", "#1/;_c", "b~y+|", "Y}yi=}", "7#767\\7j7|7", ",H5*+", "R-N.f>", "5b>`o", "r=`n\"'", "Like the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been selected by default.", "-8=Nni", "j{L.4", ")3 }q", "\"5u|[", "#/JC{CG", "TList&", "opaque_DictionaryPos", "`'*T+", "N'q0L^", "xb).d", "#h+M$", "zBYBF", "$NE#q", "iASe-", "T5I$af", "IL\\@*", ";khf#", "nl}+G", "cqw45", "Idjh-rW", "OATaA", "gGj0:", "w;pmo4", "6Y$N0", "ro2ZP", "0(gmQ", "Bxf`Y", "KXGpk", "V#Tl+V", "Qvn5\"", "qq:VPoC", ":9;O;`;t;|;", "Q8FKu", "u|`x2", "RegisterWeakRef", "v0*;\\", ",!U.\\i", "TObject", "4)4;4K4S4a4t4", "{-Oi~N", "{hZSE", "_Construct", "PIntfMethodTable", "o3+MQ", "(omyvPx", "qsCCD\"", "'{PnJ", "%TEnumerable'", ";&\\>rS", "/jZbV", "UuPU0?2", "G4U|-", "TAsyncProcedureEvent", "\"{zAN", "TVmtFieldClassTab", "H\\'wI", "A@),mc", "6bF!O", "3<3L3P3T3\\3d3h3l3p3t3x3|3", "wSWN&D", "u{oU*N~u", "Dj`?(", "e+kXS", "GetTokenInformation", "7DP:XM:", "vI.tpX", "rmO^VM", "2=Myn", "FListObj", "%LEl{q", "5!5)5y5", "H@ xk", "8Kf_cZ", ",&'+7", "4Sm:0H", "Hek>f", "ga06U\"", "VWUUh", ";:;>;_;c;~;", "b c%u", "0 0.0=0N0Y0a0o0}0", "<-_RrZHW6", "702,+", "cJrg5vjl", "B!}pp", "a;6tRI", "9%:;e", "SystemhOH", "yE]$b", "H[/pBi", "jqTUV", "M`N)&", "u_I'Lat]", "=V59z", "UnitNames", "FIsSingleByte", "}R,.\\F", "wdt#CM", "X!m-~", "MethodAddress", "sfB=z", "EH?^=", "Cmmgr", "8?9UT", "~hZCz", "CreateUninstallRegKey", "8Td+l=", "#urQU", "B4Jw_F=1T", "z.nD\\", "TRttiManagedField8", ",@x?b@\"", "qIpPs", "29<&A", "`K*V&j", "_Ri)l", "':o R.^", "s|ys=&", "5,LU=", "'Qt)P", ")D~&k", "cqt>)", "uR4o'ou(", "\\4G{.FO", "|)9#Y", "I/FxG{", "HEQ5u", "].P~(Q", "Dp2Q'", "WI4[T_R", "]$0Kt", "qtk#n", "6k[DK", "Y@2j\\", "'IN}1", "8TDictionary.TItemArray", "hfvS\\", "n~j`9", "Qv{\\Y", ":,:C:V:g:z:", "RqyzB", "|r}\\&", "313F3h3v3", "'x0~.", "::14Y", "GE;I?<", "']SRR", "}e$A(", "4I\"2d", "M}feI", "1:=I|", "txvoJ", "KfcHl", "/ @C]", "]}b)9", "<\"k;=", "lug(5", "\"5nK265", "u3f;[", "*TList.TEnumeratorP", "-TPair", "7=~Zswm", "Rw0'R%%fBOu", "VOG3Z", "HJ;\"Z", "/GcyJ:", "Sf4S@o", "$?:cP", "$+gLxI", "_0WS7", "r iF@", "]pZ3llqBP", "ECompressDataError", "w=P,.", "e9^U&", ",dkJ'", "?pq2 ", "6j6awW", "L2xu5", "FCount", "1*101Y1", ";+<4<%=|=", "f_krr", "X~IhW", "v74R2Oe\\", "dwv0V", "z:H$i", "1G$]T", "EU@(&P", "\"=OBn'", "csibm857", "I+0DA)", "$Q*c9", "?jLl]*#", "/NOCANCEL", "j^{nV", "ynEZi", "EP[ao4", "zY=`oG", "_6#xMK", "Gf1P'", "EraInfo", "M!%I[", "5_@R,;", "i23AE`~", "6gf.eu", "V0]dEF", "Fe^\"~", "]Y~U;", "PxG1T", "?w6K'v", "1)Li+", "kB1t.", "AQq9;", "p0)sF", "\"tx#1M", "[M~y}", "2v9n4", " )(*\"", "Sectigo Limited1-0+", "^H5:fw", "/1q?0", "C@'fo", "S+Ki3\"!", "Assertion failed", " TListX", "BL]FZ", "Ufnqc", "ReadFile", "9E}M|", "7 717C7K7Y7f7x7", ";ONCL", "iso-8859-1", "FileVersion", "31%^' ", "n5;A9n6^", "TTypeKind", "$iBg>{", "MoveNext", "", "2,2<2D2L2T2X2\\2`2d2h2l2p2t2x2|2", "X7fXY", "=>?X?", "TValueDataImplZ", "RP}\\]", "sB9&k", "Spt;I", ":3c\"M", "#_>Q", "`54X;$", "wzTC>", "cPZXn", "*G:B2", "OaJ&V3", "0#0+030;0C0K0S0[0c0k0s0{0", "TThreadMethod", "DTDictionary.TValueCollection;", "AFrame", "kM=lK", "- 7Zr", "Exception in safecall method", "GetBufferEncoding", "DnGe,]", "*|pP7h", "3ki`-", "?,?4?", "hnoPo", "~JX:Xh", "?#~:/", "owD6c", "Reall", "$.EPCs", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "=y_M~", "u1zA_z", "*^Tof3", ";3>1f", "N\\Cm[", "xUp&E", "FAsUInt64", "$lgCZ", "+(xH3#a", "G`F'Y", "+zC)jL", "B98~R", "J{Xoy4", "CM'\"7", "$TComparer`", "<0<4.TValueEnumerator;", "6|8vMB", "6\"6&6*6.62666:6>6B6F6", "ZO9bO", "^A:r.", "<&.Qu", "N`Y\"", "tIG2va", ",_,a$fGv", "ekOoB{", "E~hCtS", "[DvU'V", "Q6K24", "c:N|u", "+8s~`J", "{0W,t", "oKsc7xf", ">S DR+", "6yq_]#", "')nqB", "?8HHW", "Z|z<.B", "ZB)B,1", "9\\/}[", "QSZ.h", "$Ow4-", "l]u2G2", "@IaYi", "q,t&\"", "C5uZ}~e|/o", "!k0x%", "-3ljb", "TPrivateHeap.THeapItem", "TC:nF-e\"}_", "h?z?_`", "[d5f^8", "StartIndex", "x=;-4", "Fb7}Y+2/R", "Y(V\"S3", "lK4@o", "y0+z_", "G+Tgz@R", "Q0Zi ", "y\\| A", "243`3", "uT\";7{V", "nMm`ThDS", "_ |/**", ";f#|U", "2%x\\}", "%=6f!", "n=YP-!", "TThreadProcedure", "VInteger", "Vk]!D", "Cm<\"[", "J;FDs", "XF=|29J", "= =1=E=V=c=k=|=", "@Gkv9", "Z-fH]", "hQ?:=", "LhK[?R{0", "N7hUi", "Uh%!E", "IsArray", "://\\T", "XAV!Y", "", "&)3S3", "O#vg8Ke", "b!ibc", "%TMethodImplementation.TInterceptFrame(", "+Jj(B", "i$P|F", "f3x;'<", "NG,4h", "5/HxI9?s0", ")g,`x[", "pJQ+W", "U<@\\ym", "Yo_I3", "_\"xWl7<", "9>e)*", "GpB\"@", "!-pjZ!u", "xj! v(B", "W=-]5*x ", "@>Jxa", "Sugn_l", "=tvDm ", "]})?]\"", "W_\\vI", "PY;%S", ")Wu1A", "\\AEk2", "x*%e%", "\"?p-b@", "yN2GK", "FCallback", "Uktbd", "RCiP^", "Lc6'D", "V##~FK", "zsiXh", "bs/N@S", "JTDictionary.TPairEnumerator;", ";Tq!~", "\\':Va+", "X[1*>T", "a~s0w", " @}`b", "J%ZZZhmmEUU4M[", "[\"{Lg", "!l9E)=", "0}*=s", "j6titWd bL", "!P1m8#", "iwEz;", "uz-Latn-UZ", "GE0!o", "tis620", "mkSafeProcedure", "|8'!8:0", "1", "vXq~2", "GYJ;d", "8+888", "FRecursionCount", "*ep4r", "HelpContext", "030<0f0", "g.ParrayofT", "IxN$7|;", ".TEnumerator", "_&$5^", "gi-oTmY", "!k'a%v", ",TEnumeratorh", "UU?]-9", "vq.8T", "SoF4l", "zdz=(", "LoadLibraryA", "wI%(:p", "22a8Z", "CH-_}", "0mJvp-D", ";$;,;4;<;D;L;T;\\;d;l;t;|;", "R2@)\"", "K~Mqx", "n7/t>", "GetHashCode", ".*j{@/N", "(H&S!R<", "c.b_E", "o7g2t\"/", "Q7Z+#", "(nr??", "%wZvu", "k,[2y", "Subtract", "P~77`Fyc", "\\K|_'", "\\{z>M's1", "{@A+m", "$TEnumerable'", "Y-^Wt", "^ZpxH", "I64li", ")mGIr", "H%^_]", "faWrite", " /LCZ", "0\"080H0j0n0", "~B}/UF", "J$L#j", "a5<\"%", ",W0(L", "+RVy\"", "])U)F", "G)peywr", "j-O3[", "g1EJ'", "5*585L5]5v5", "1=ykCa\\", "nVX:d", "OCp/d", "w4$.G", "T!>Ma", "'X\\X2", "zQ=bD-", "=sFsFeX", "\"3)3I5Y5b5h5x5", "dm8^W", "Rul/,", "-dm1G", "\"h?X{,%OgG[", "k}_$JB", "xEC", "#>,@V", "}t7N,", "}{~9'", "6S ?R9", "!&P@r9", "O*~{N", "W|aD=", "NVgUg", "#vR_U", "\"|NMO", "WaitFor", "3'3/3=3K3d3l3z3", "2W)\\-", "oES-Z", "@a !|", "RIq4O6R>", ":d|:.", "7+737A7R7n7", "7H8q8", "1&$Q\"H", "SortList", "Wcc||T}", "hDi41", "#B\\ZB", "K3W@7", "W]~40", " ", "#Dw(LN", "@BTk~", "h\\<6d", "w3{K>x", "S*z|/?zH", "ul6", "vW=AW", "@Qr5VZ", "https://sectigo.com/CPS0", "J5'_N!.o", "%_v4p", "!IEqualityComparer", "%!{\\x4", "Sm(9F", "c:'MC", "r%'Ho", "'tK?>)w", "Specifies the password to use.", "ki=w,", "/LOGCLOSEAPPLICATIONS", ":wi%r", "x1*`(", "TPointerList", " =#Jrz<", "v(6'7)", "~$b@z", "?\"Y9X", "8G8V8", "W,kvd", "<#=h=q=", "DzaV&H", "^z3 {", "D N'e", "^RA!t", ">u;'c", "%Q,=K", "7$2 @", "~J\\3;", "TListp", "LcQMf", ")]h_Bp", ".!p1;", "gB@~}", "-]3oY3I", "1`/A{", ">4dHZA", "^a,(5t", "c)n_=*", "4O[@o", "Lb70K", "l 1Ci", "CU\".[", "VerSetConditionMask", "Pe4|[s", "_47:,?C", "Q%v`]N", "smj-SE,smj,se", "8\"8^8", "\\2G{\\r", "Grvq%", ";4;I;W;n;", "*Y]{L", ";(;8;I;Q;[;h;y;", "[g;)L,", "O2\"9B", "PbJlIc", "]fd-Gq", "<36Zk", "?#?1?@?j?n?", "~)YH=", "nv9\"m", "*1#J$", "GetThreadPriority", "HeapDestroy", "*lZ7#", "M>&`w", "tXb#?}s", "DXbE5^", "GetItem", "`Zly}", "JSD$|", "_TLT5", "gRG/f", "*=8^o7C", "1\"141J1X1g1x1", "4!4;4B4I4S4W4[4v4~4", "e#S;U", "opaque_Buffer", "T41wo", "JS4Rl", "W4gds5", "IQHL`X", "System.SyncObjs", "+h:zo ", "zL* r~e.@Xwu", "90949O9S9o9", "K;%+$h^", "wYbU)", "RX@{u]", "D#\"5(", "T=#Zq}D", "\\f^$s", "-'p&9", "9TDictionary.TKeyEnumerator;", "nJ.Ie~", "1}hvM", "~`}`s", "b!,B|", "%;>u;", "Y.TGYQh", "g4<~o", "z_j%Q", "cImX ", ";A;x;", "6,i0V", "\";9b]z", "\"iv)M", "Hc%lI", "Vv%Ubw4", "R8^", "#JURI", "pboms", "n3M!{", "&SO2oBY", "cn-big5", "cnAdding", "KJj,E[<", "`r&.p<", "QTArray>", "kG*.X#", "E)Q\\?", "tis-620", "7[q.a", "\"_xj5y", "CI/4v", "c:0t*", ",l*^+", "jIg5:", "5s,ytcJ", "MPm\\~", "MDoIOH", ">+><>\\>m>", "(P8E4~", "+;oG_", "oU#8,@", "NewInstance", "9\"979E9Y9o9", "xY#/<", "Windows Server 2012 R2", "X=r> ", "]vLPl", "MCRtp", "~L]yw", "E.oI", " J+~e", "8>VMC", "WakeAllConditionVariable", "RegisterClassAlias", "*+WXl(", "fjHMt;", "1z@r&", "'v8=^(", "fQA2", "N=-=p", "S$j)mw", "afDefined", "pCsCGG", "WriteListEnd", "]TEnumerator>(", ">", "Bh<-j&", "Va=\\;", "i)sD7;}", "VNa|%", "Z@Mb{", "UhCtJ", "hTf:%", "xGqA3", "4b65e+", "a2b{\\2J", "srRC#", " Wo01", "Ah7Jc", "VoZ<<", "Y#/X5", "SuF6=", "J;X+b", "^zjiB", ">*/}q({", "6Z45j", "FSuspended", "sb:Cz", "ca}^s", ";@9x7xP", "iso-8859-7", "}f-f.c", "sZ{}T", "7[.mV", ">", "NiQkLy`l[FJ", "v9D#\"", "QaW`R", "uX4bw", "'`KgP", "VariantCopy", "CreateEmpty", "Pa7(a", "[5`l@|N", "3VmvW", "`|>wZ", "`Ji\"`", "q;w\".", "->i4clr", "r)Mvu_", "364:4a4k4o4", "46QTu;y", "hU!R_", "en$V(", ">tXEo", "Bj\"BO", "hoyt", "\\TEnumerable>'", "8u.Z!", " ^J$`", "93K\"x", "L%sN2<", "[!cbB", "lHt+)4", "", "3-3@3V3k3y3", "{2]JJ", "n27'NK", "hcuBi", "%y\"E&", "gf%+IE", "nO~Pf", "q]W{'", ",%xik", "Puv +", "u[Zs9", "]7@GW", "TRttiInstanceMethodClassic", "6q6mTb", "`g=r_=;^", "f\"oomB", "c@tQg", "N6By$", "Uq10H", ".xX@[k", "XnH/Q", "pp?Ps", "4r4dSh", "?+3kw", "WET9Je", "2['\\fe", "!0v8i", "I:!#)TG", "p~>SpA}", "Oe#%T", "{<&An", "j0EvX=", "qdN+b~", "fps7FT/", "fRp#L\"", "proDialog", "R#cLhpd", "4IW}C", "6E", "/lxM", "doq_B", "ibm819", " k=Z)<", "tTAh`", "y>bkc", "Vw,ua", "QkD`n", "TY4$r", ">_ 88", ";qb#0", ",}3(3", "7c8p9w9", "z(xdtPU", "Dy#|Q", "NumUninstallDeleteEntries", "[~4a?;", "Result", "pw5%o", "p:|wc{j", "9_7+P5/", "DwcY`", "DispatchKind", "UhkRI", "#yC@,Dp76", "Uh;JH", "^0fbo", "nva`$", "5'l`{", "637}7", "7JL']", "N`xb9", "0/m5'", "7\"-kS", "6e>G]K", "5!>wDF", ">X?g?", "hp}\\l", "*]~P<", ":rl/\\\"", " 54", "IsRecord", "-8?.B", "|En\\Y", "}mZEv", "VWi'f", "R/}6]", "a,Q%uH+", "BTDictionary.TKeyEnumerator", "M|3,V", "[GF&D", "fO^h9YO?", "QH&;[", "Active", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<", "&-,|c", "DKhQP", "qDGq~", "J>9_.", "^C!-'", "$NWN5", "$<|ar]a", "\\izk]", "I9a\\@", "T`.1r", "pVi{$", "FData", "pyAfx", "z8w(i", "|^7{;", " Hi[M/W", ":*:D:_:o:", "ih3.0", "hl+b|", "Th/q==(", "EPropWriteOnly", "5,\\` S", "RegDouble", "(r/+A", "4V=Wk", "9eh4s/", "\\Edt<)5", "~Zf~>K", "]EV*E", "y;nUh", "2!2/2>2T2i2w2", "Z2vO_)9j", "West Yorkshire1", "iso8859-1", "TIntfFlags", "D&-ax]", "#ln9L", ",(p)B", "8%.\"*M", "<\"<*<", "U0^&s", "ReadIndex", "d7-3>", "MTEnumerator>(", "nRP35", "kz-) ", ".[#L}U", "X(),]K", "6Ac^y", "tkClassRef", "UVC>u", "=U$\"zk", "TiN3:c", "p,j", "<-<1kclw", "6#7h7", "w+tNe", "8 8$8(8,8084888<8@8D8H8L8P8T8X8e8", "-.2_D", "OY8$j", "K]dkp#", "skWideString", "#@LpxR", "jW]_rDi", "TCriticalSectionD", "XZ:$E", "=)=G=Q=[=`=q=", "DecimalSeparator", "[:GjQR`", "+R9(}", "kvLr4", "!8mob", "ie%.f", "#)2nX", "iFY ]v", "ee=k(", "TComponentState", ":8V3[", ":TPropData.:1", "[yZg ", "|`H,o", "}~R5.", "VPWideChar", "dTb?=", "m<)%*U", "vqjw=;", "2:2B2J2R2Z2b2j2r2z2", "pe?/^", "iso-ir-127", ")\"WEi.(", "^sVI%", ";0;A;E;d;t;|;", "cfl>F%", "UNMl\"", "M^4%<", "pABYL", "Jujy", "7\\e%<", "1*Ar@", "\"HrDP", "4$4(4/4B4V4k4", "maccroatian", "KTN\\3", "Uhm>I", "3R3g3u3", ",D@;~", "Ln$,o", "Mkz}~", "tJ~q9", "The setup files are corrupted. Please obtain a new copy of the program.", "iso-8859-5", "IComparer", ".[&AtG", "sIeEB=", "WN&,x", "26%F*", "? ?(?S?a?w?", ")T\"5f", "Aoj,7", "%YRO\"", "kh`q?Q", "ibm861", "Gbl|n", "TList&", "FromArray", "DGvr@", "X7|YR", "*NE'&", "kQ68&", "^%N~{", "$j5Bc", "-*P", "b{^kT", "H0B0C", ";m!&L", "~T?7c", "jvL0yKX", "@d'uy3", "pJK%@", "bm+=B*!", "[s{Lu2)WW-", "4risthv", "R4|)i", "q/zUC", "1rN_.", "position", "+n)>1>9>A>I>Q>Y>a>i>q>y>", "\" Mrf", ";#;1;@;N;^;f;t;", "W]>^B0", ";-;C;S;h;w;", "p`2L&", "gcO:q", "Z0T@W", "s^yRun", "&2k5y", "+il,k/", "TList`cG", "1F|w[tQ", "OUaS)J", "T_5lM", "0TEnumerator", "#1o1{", "3&qrD", "J}K=a", "F2ke:Zl", "H60si]XN", "&=I-?", "_eWjW", "`m*>e3G", "494g4", "@H!BI", "BeginUpdate", "T.]G_&p1y", "M=.t(c'L", "IyW)EFm", "TmG'GH", "|WpE_", "TIr=/", "b~RyY>", "8'9P9{9", "Z225Z%DwQ", "`K^@(P", "@0Tq=", "TC--_;X", "6vm$O", "/ieZt.", "S\"e#M", "yu]CD", "oZ,`u", ")eBI_c", "dupIgnore", "p[7#F", "B+{<{", "POW[Er", "3ne:}b", "AAction", "f*yr+25", "CompareStringW", "XFM*Z", "M].&?S", "%72y\"VR", "8.8;8L8n8{8", "u)r{`", "/]%A~", "drTAN", " 9vl:H ", "tml^W%", "=0=<=@=D=H=P=X=\\=`=d=h=l=p=t=x=|=", "];kI\\", ";uc`T", "ib*{\"", "XltoAx", "0|%>}", "NM~Q$", "{cGJB", "!vw`%3", ";@ibI+", "nBqhq", "}vXMD", "2t>wYT", "@): E]o", "+{\\^6", "#TEnumerator", "", "2{Y", "1%141", "", "D\\;^;", "Ee{Bi", "i7#^0", "[.fus", "jWN1d", ",X?QU0", "OTDictionary.TValueEnumerator;", ".2:Av", "TCompressedBlockReaderQ", "~2Vk)", "FCkRj", "DOE~W", "4Z36F", ".>Kxl", "TB~f{[F:", ":G;};", "r&`qa<", "a[th8", "N_9(B(ejpB", "; _Pm", "ao][z", "i!y_<", "UY{AP", "C\\+oin", "= =$=(=,=0=4=8=<=J=\\=u=", "?J.1F ", "#F\\.|", "LoadFromFile", "KG5w=", "gJX882", "e[s1^", "Sf$et", "2 2(2,2024282<2@2D2H2L2P2T2X2\\2i2z2", "EiyTw8", "{ZRQ6", "9\"9*989F9Z9b9s9", "WH8vs=", "3[9p'", "hA-^Kz", "+-:^\\", "=g^jal%", ">(?A?", "7l=B=:/U", "WriteBoolean", "3^NH`", "'`q~Q", "T~U[Fqs", "e`4", "?$?,?4?y", "J6Hpp1L", "}&Zgu", ",TEnumerable|", "csisolatin6", "*/.l/", "8J^S>", "9!9(9/999Y9{9", "q0 VR", "-8=&{", "1Ees6N", "TIntConst", "#|[8F;?u", "TInterfaceTable", "Aliases", "&8jQ]", "<0r4W", "P2{eI", ";EX]R", "O3B^S|", "VTLCE", "M:/haY", "708?8k8", "9WlmTQ", "W\"Pm-:", "'zp A", "CuY];.", "0\"0*020:0B0J0R0Z0b0j0r0z0", "E'Q2V", "yT[Nc", "|A95^", "XL,--", "RefCount", "h:^,L", "&5dO!", "T 09!", "s.>MJ", "Fo!hy", "SysAllocStringLen", "CN\\ s", "X?_~wx", "TFieldsCache.TFields", "<$=/=8=H=P=X=`=d=h=l=p=t=x=|=", "3O4d4r4", "T!s+{", "r}fgx", "TVmtMethodExEntry", "ghrK:", "7Btx*7C", "*TEnumerable'", "SmOh)", "hoQ 4", "HXp!^", "TEnumerator", "s=~}'*k", "0v\"Yu", "4iu}\"", "@Jsk+", ":^{+)E^wU;", "c#_')", "%v1_1", "%=7;F", "HCCC/*", "QsYhw", "%OoJ,", "; ;$;(;,;0;4;A;R;i;q;", "\"ze=5", "fh&Z", "B?)8v1", "HG`2ny", "Jm\\n9", "FSection", "6(xuFe", ";-;@;D;K;^;r;", "~^bI%", "l6=?e9,", "|vv7 b", "k%]WiRQ", "vgC@?", "~_rFh", "#VG)7", "K45!4", "YNRU] ", "&U\\[s", "f;s-M", "TPropSetV", "8rvy[r", "J@UA+", ".x(Jw", "(4z:cW", "$rM\\:", "`(`t^", "AYvBgC", "5DDCX", "vXuU`", "iso_8859-7:1987", "aXKsb", "7S*A3 ", "G:f+{", "l^HEc", ")YD@q", "gxu|yG", "BeginRead", "ht!;'", "%%nTO", "a5'x)/", "DO4a1", "o>TfO", "sM f G", "=j^ov", " P{w|(P", "DafYN8D", "<1.TEmptyFunc", "2\"2*222:2B2J2R2Z2b2j2r2z2", "B{]6 wd", "U95#A", ":KGv/", "0!010D0V0^0l0{0", "!Z}#U", "DecompressInto", ">?,! ", "\"+FB*", "Saxsd", "VxR6WD", "`A3C1k", "0da =", "zpWb0", "^Av9g", "Eb\\Cq", "%ZuP.", "XJ]l$C", "9FJ]=", "]{pT;", "CRy@!1", "M5;bOaJ-", ",5Lf6", "#%N/g", "vuccP", "4*494]4g4s4}4", "'l!;[<#", "_+l+B", "!Gx3|", "X#6TBC", "Q~s.dUYm", "E'u{pKv", "SSqp|", "MMTuj", "JG '?", "h=f8=ch", "#5'\\\\", "#2[~-", "w8m@_", "gr^lp", "!k;vz", "fYIm_", "*LM1v", "!BF|U", "3fQ/2", ">L<>1O+", "xg*Z0", "i8jf=", " TdQAqz", "@[]KJx", "I<{UKs Y", "0S#A^", "]S+oK", "_^|Vh", "YT>5H", "TTime", "Oj-MpZ6", "&#*bZ", "u9 (=^", ".4`:7", "`G^Ir", "kRi?/", "9GQ[k:", "(=*L?", "HasData", "VY_/2>1N2", "mKF-]", "5~owA\"", "7a?w#", "R 7rL", "lA\"6<", "otUWord", ">K>R>b>i>", "AsyncResult", "'ei}Z", "yS?CJm>", "DExS(=", "sd_X|", "#Sectigo Public Time Stamping CA R36", "{#nTf", "p>9X_", "FBaseAddress", "-F Lu", "xcXxf", "(A;OICI;FA;;;SY)", "]%8o8/", "X&U~hv", "Swb(:", "N)(Pz", "/x11s", "sd/RN", "5$Lz[f ", "Uu^D|", "Yi?e6", "1v,}w_tt", "N1'#O", "QZx1PO", "N)ZRn", ".TItem", "<)<7.TEnumerator5", ">^wym", "$Rh<}c0", "9e:~F", ">vU}Y", "E\\P5o", "IsPublicTypeD/@", "nM12*v(D!$", "Z+=$?", "Jg\"T{2", "B8+Wt", "b-;yn", "fdCreateAlways", "a&!zM;&", ":P;&<*<.<2<6<:<>%", "7:9UGn", "Uu$?v", "616?6L6^6k6s6", "\"C9u.", "[4Lg5", "|U12*", "-<}X]", "=T=X=", " Exh7%", "b}1xUVe", "\\TArray>", "{dp(mM", "I3L'a", "]SbE6", "H-!Xh3", "a^jyQ", "%XF{x", ":mD:_", "#+*Zq", "nlyoW", "OJil<#x", "HeVdR", "2!2)21292A2I2]2r2", "SpinWait", "\\?!/y", "|}N5i", ".$Zfxd", "oOv7<", "hYbMx", "wmU+KX", "O85N0", "Wjuq:", "q%=rw", "QT.$[", "DWq<[", "0*0D0R0b0t0", "1\"8#(", "}AtTz", "Windows 8.1", "=FIMz|'g-:4", "rC3y\\", "V7m\\~", "\"+_TF", "(R^0!", "zl&i2", "3ekwv", "y,50`m", "K^XsA", "d&\"o(", "yuw.w", "_qUe-", "c(|$!~", "z&z&Z", "?.X4(", "' Ex>", "3,3<3D3L3T3X3\\3`3d3h3l3p3t3x3|3", "ZxUpqu>-]", "*xOAy2~", "h\"+^z", "O5CL$", "V7*|D\\ipz~", "?S Ke\\", "ufxu)", "1zI54", "og$N(", ">&?I?a?", "l|o+L", "!s4n1", "M7nTR!S", ">)?W?", "qDQ@tK{", "~%AX:", "'=a>Xr", "_[.-c", "2)#q_", "LanguageName", "h_PlE", "`iQ(Bc{d", "R&Ddx<)", "&pIQh", "", "FileDescription", "OsC6a", "TStreamC", "\"2%fPR", "tTSos:-If", "8(rLc", "^34|c", "*j/sR&kb", "4w2*E", "8 818t8", "8$8I8P8q8", "0qvQQ", "`WL@?z", "wuggs", "U$rGN", "{.#zsE<", "`/V?&", "_AZjIo", "`};.m", "2zEWI", "UBJ.7", ">;?O?^?t?", "V`)VI", "4-0N)", "R)^q*", "ZCKNm$", "q-KNG)x", "wA(\"S", "4P5F@;", "b", "StFrm", "FInterfaceList", "wX|7o", "p#WMk", "xl@O]", "2R:/_", "4$424E4a4r4", "6%7Y7", ",k}jTmr", "fQX\"/", "@H(Yd[", "f?$+;", "\"5wn<", "g&nq", "BQR\"q+U", ">6(l@/", "UMAI1H!u", "VTEnumerable>", "SafeArrayCreate", "h:6+ ", "HNOa9", "M!d-,", "sc`sY", "rT&w?", ";c):#", "B_8a~", "}3k2p", "nhBXG", "vaInt16", "5!5<5@5\\5", "u~v.=A", ",{D0P", "xQ/f,", "QTArray>", "&MV,;L", "909H9[9s9{9", ":,:4:<:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:", "tuJUnmm,", "c+~)r", "W23$-O", "X\\@Fn", "(WMF.>", "oO[S-E", "56^Z{C", ")!sr9", "r^Ra:C", "J:U8;9", "Q2@;^", "$6\\=+", "MaxInt64Value", "{m%'S", "favqdH", "1UzE(", "UnsafeAttribute@!@", "b'us-ascii", "@vfC[", "RecSize", "8C8J8Q8X8_8f8m8t8{8", "NumTypeEntries", "a+g3F:oM", "bs-Cyrl-BA", "[-,BW", "ManagedFields", "q}4^k", "]uun]V", ")_`0T", "&3!Eb", "D>QKB", ";h@&`z", "Listh", ";-;7;;;X;h;p;x;", "fT\"UZ", "aj>,Dx", "E$HXo", "9>XXW", "qNY?.", "+Nc}l", "Ve^;#T", "FRr$:<", "FGG9v", "U};5}#6", "U@? _", "bpze|", "Jg`kgv!", "%&[_Tdw", "=@/XM", "-n>2^", "Compression.Base", "$,F8a", "%tLx0", "BaseType", "TypeData", "8d@th", "wMq't", "+2=\"DT", "_6rlJf", ":6!(1", "5jA&9", "Uh`]J", "g2Y,y", "`NBSp", ")gT\"g '", ";@\\=<~", "HuBdy", "\\uj6n", "InGroup", "1SpjF=x2", "qps-plocm,ar", "?q^8{", "[\\|5m", "1NA-eZ", "Ndx92", ".xPBTPDo", "ACozD", "xs=/*yZy}", "4;4m4", "#TEnumerator", "r!<$*", "Cm+$9", "u|6\"Y", "EPUy%", "vsxic", ")e~?Ie", " 0]_U", "7R7\\7m7}7", "RO]sG", "j\\\",U9", "Oha>h", "c5DSVBa=", "sr-Cyrl-RS", "sccPasswordTest", "k^vr1{", "Software\\Borland\\Delphi\\Locales", "aDwmHv", "Xk@#+U", "\"d)?3", "#vj n", "0=(Yy", "prAdmin", "gT..!", "=c_{b", "D$hPQ", "!Xt5R", " 0n.<68", "-Yz0B", ";mi2u", "XX.e]Q0", "a\\_tX", "FOnGetDeltaStreams", "?#J+2[", "6%N:YG", "Y79g|", "]4qOl", "ErWd@", "Index2", "iFl\\!", "5=|&#!q", "8^ksl", "-AP)[K", ")g;NJ", ">TList.TEnumerator", "Ifr^j", "Thm?D", "f/2(7", "-]0'V0", "L~l2u", "2 2$2(2,2024282T2k2o2", "k,^2u_", "otULong", "'w%>)", "blMB(]3", "gxdF`", "lzma1smalldecompressor: Compressed data is corrupted (%d)", "p?t,@K", "0,g_I", "j-+|Wm", ">ZbVL", "$9V2+", "August", "7jJb.%", "dg^/.", "$\\j8i", "an`Kgdl", "9]?\"$", "}Aik/", "D)5q8", "HcIG:Hq", "Hj< %", "vC~u:", "kx$ch", "K+IuDr", ";mXHZ", "C{|_L", "RVlpm", "8 xE ", "gy#y([", "Instructs Setup to initially check the Don't create a Start Menu folder check box.", "r\"e`}g", "Z]fNMo", "]zTZ8\"", "0-@63", "{'=/A@", "p(FCOu", "XDW;a", " fy>x", "RfR9j#", "zae/1", "1 1$1(1P1r1v1", "N[O~x", "TAsyncConstArrayProc", "%yW^<", "TMethodImplementation&", "IFDQzue", "(TList.ParrayofT", "<,Z*^", "p=gc\\", "7&787Q7b7p7x7", "c6l[~", "VariantChangeTypeEx", "80j i", ";';4;I;Z;n;", "35v d<", "PqmIAGs", "^j/y;", "crEqual", "Qg5>gNY", "Dx7@0", ">AON(7_", "Xsu+9", "NFUVI", "_d]zD", "\"vnOe", "0Z\"", "=9]rJ", ";!;8;M;U;", "-M[A[", "F=c,D", "gZnbkrc. ", "~IBuON", "~ mZc", "I4k8`", "kN%,m", "9#949I9W9m9", "I1FM%!", ">i8@4", ",vX&R", "jn6jj", "A9? 5L", ">FC6w", "WR!:K", "u,mog", "EIntError", "uT[dU", "\"?-Xk", "/C7d<", "J>&*y", ";TDictionary.TValueEnumerator", "GY07%", "FWaiters", "1&Q;'", "VWideString", "5TU?ps", "cu ;g", "F\"eA4", "Jb\"n0", "?nx `", ";L/X3", "`S@1CV", "VarI4FromStr", ":sI\\=", "bY;O8!t", "G5%+`H", "t{01%", "aj-D4r", "\"83", ">_!&$", "C9Y.TKeyCollection", "TMonitor.TWaitingThread", "\"wSLQ", "9,9:9J9\\9y9", "U1sv;", ".(,]N`", ":-:c:n:", "aDx.]9", "YZXtm1", "C0 ;I", "9", "iso8859-8", "j2Lu`r", "e}wP%", "E33.94V[", "l:|Ls", "^<9\\y", "0]f^{", "Invalid variant type", "H]YyW", "-g!&:", "2I6E^c", ")B2;@", "0aG=31<", "`B[TS", "J2:U!", "3lm=<", "\\b=:^", "|Gh~^", "69kDlL", "0*0@0N0^0p0", "ComparerdSH", ",[xAJx", "6C|+f", "4t}C]xZG", "3$393S3k3", "M`-y.", "o!#jT30", "lskZ!", "}ZI0t", "d?9Ml", "*g!7M", "TListEnumerator<", "Nmdh5l", "u\\h\\f", "SO122bI", "; ;$;(;,;0;4;A", "-'~Q\"A", " >$rHZ", "Wl|B~", "1mvo{", ": OV;", "Pulse", "8yDUT^s", "TypeIndex", "^5hu9", "='9gL", "tpmk;A", "Ju'oj3", "~D.2c", "Xo\"O?", "()aNh2", "3xK8rZ", " u|f),", "u#3x=\\64M", "k[HrH", "3$3,3<3K3_3p3x3", "8wSB%", "w/Y i0", "_mQ~R", "A7zt>", "_^[YY]", "9b-=s", "IQxk\\", "4Ohsq{", ":L{6<", "9\";8v", "\"b1kAS", "UhGvE", "}dPL|", "%'\\V*m", "ETDictionary.TItemArray", "*)jP>", "2Fl8I", "`Lz8:&", "Z(^J9", "Y7n)R", "~lB}N", "cp1361", "r$}ER", "nuLq3", "ZP>JI", "&]`C^", "IJd9$", "Q.-uE", "ff7}r", "uqA'3r", "~ZJ5Z", "qR02di", "^1xz\\", ":CjQY!", "e%'R'K?EW", "ZTpE?", "r,MQp", "hEdv4", "6:x]Tp", "tkEnumeration", "iQr^0", ":>\\38", "M3}!06", "}S&?&D", "luR@,", "~5~b:", "T 2?H1", "XryG_", "kv%p&", ",s(kn? ", "J1a#\\c", "EWriteError", "HRESULT", "[+;z&!", "*EBB'", "uq~[c", "9@dr ", "N;hT{", "h8N`X", ">%tUw", "|*CJF:[V", "]+1R'k", "Kk},F", ":>!8k", "*{S$U", "O4MK=", "l3G7v$", "VaM(Zj`P", ")5S=Hg~H6", "l6<5i", "4)QYze", "8sd;V", "3)303B3F3J3N3R3V3", "twJ0:*", "mywy-", "/:", "JQ'V!", "sf^D`2ib6", "_v/m5", "bE !'z{&eO", "0=0O0X0o0", "y~-e.`j0-D", "E$@Qj", "7@7P7X7`7h7l7p7t7x7|7", "mIb,oc", "@DOq$", "CJ'1}", ">Q>U>|>", "!TList.TEnumeratorX", "L[:4V", "QEp2=", "4p.U3", "WQ 8O]", ".`9{U", "4q?mZ", "f;*F\\U", "!v~P@", "Y$1-.", ",IUk@", "s}C~K*L9w", "SafeArrayGetLBound", "7\"7*787F7Z7b7s7", "0g^^Xr", ":5:J:X:j:", "P!x1}O", "lS'scV", "y-[Q=z", "o?-sq", "cnExtracted", "j@mvp", "+N4RD-", "LastIndexOf", "N PGX", ",%BOE", "8i SPV", "!0PqI'", "R8`UX", ",$YXZ", "#2|I}l5K", "9d&B!", "| r*DC", " ;n!:", ".{bM^", "SQFn1!", "[]5I&", "=\\=bv", "iP*OT", "ifUnused1", ":2WuN", "TComponent.Create@$ActRec\\", "csFreeNotification", "Uh7\"J", "PKV?$9", "8iAmy", ";zqD?", "p.;3`QG", "/_V,T", "o@AtZ", "u\\'W=", "Ee < ", "e^YE|", "pf[=W", "5{65Yewa", "NK^HcLg3B", ")}mT,", "Leave", "?6^lSE", "+6b#[", "021?1Q1n1", "nS\\mnf", "G4LG v", "|85Lz", "')9&e", "gsq8i*B", "y}-~8g}r", "GD/aB", "G\\otGv", ",9F(Jx", "H~~vaa", "!+0O", "Y`Dp+", "OrY!wd", "e;eo\"", "ComponentName", "5M.aH", "dQjj3S", "#W`UJ", "UeX4D4l4w4", "1K4|#[", "]TDD(", "jGV_kO", "N9?42", "qUI9\"S", "FOnKeyNotify", "%?( +", "%;OE(", "Dn4$FB", "))),...C...M+++B***+", "z1}F{", "*p&5T", "QUh'2", "r!P>r", "u8/jn", "80sQX", "Reserved", "oleaut32.dll", "] XkL", "?_p ^G2L)", "8]9w9", ">WaG=", " F_S:", "SP0;{", "-1ZHE", "~44jy\\", "= BxT", "UYG^y", "#GP,AKC", "_O[l;9", "TRttiStringKind", "TStrongRandom: BCryptGenRandom failed (0x%x)", "6x", "T'>I-", "W;)kO", "$p2HO", "k;]EC", "lC\\W;X`", "EGPZ4", "d?/ry", "gjt[6", "q_V~!c", "-*Z`l", "znQYu", "HI*!ftt[", "a4 V#", "+r&Ju@U", "ClassInfo", ".\\o C#", "f} o@", "[++&]", "\"U>~N|", ",m3HL", "`n>X_", "JsKwM", "/kR4a", "VAj);", "S%w_J", "dc9|C", "AddParameter", "u*YT)", ".+W(wk", "2 2$2,24282<2@2D2H2L2P2T2X2\\2`2", "\\17Y.", "PR!#O", "!WguB", "H S9H", "uN]o[b", "j5?,$", "n4,N,]", "&gab=dB", "NNF4O", "Mj[,2", "< <0<8=-7", "SI=\"(h", "VPovB", "4Fowd", "yDfc@", "o6P19", ".DRk`E,`", "\\R", "TCustomDecompressorClass", "7W#'jd", "b,WA ", "Tez;9B", "]TEnumerable>", "DictionarySize", "TProcedureParam", "ViM\\}", "5\",nb", "Ukxz=", "H^D)AJ", "Yi)7n", "`LSn1", "VLongWord", "629x8", "<6@qR", "^x|jm", "ADelay", "=/>=>K>Y>g>t>", "n|CnL", "SYg@b", "8s,VH4", ":OZ9b", "f3OnO", "e}a+!", "MovEBP_ESP_1_89", "tIQ.uXa", "CfNez", "r9?\";", "\"c[`cO", "GetDriveTypeW", "\\MhD(P", "5~XM$", "Ht ?9", ";30>6", "EHt\\9", "C7z@i", "7&ogu", "WizardSizePercentX", ";_.lk)J", "?%^jS", "=ry;M", "H6M\"[", ")xJa=Z", "]Y'C}F", "7TArray>", "G~=&(", "rOK[7", "AEiq\"", "/a1DV", "~Eg)B", "n78p$%", "}{n9+L", "TComponentStyleItem", "eg6EY", "F-gIJ", "9]n0e", "b;HKz", "hj?f%vM", "$c2/G", "I!=@/", "LookupRoot", "=G q~", "Saturday", ">chN2", "gV/Cz", "7[s8f", "%s[%d]", "6>6L6", "+R}_QR", "$];r&", "ahL;P-", "rg xE|XwV", "V^].4", "U1]pe", "HTDictionary.TKeyCollection;", "!XyMz/", ".8FRd", "c&-3J", "PInstItem", "jmQhslf", "iso_8859-9", "dC=>o", "86,1&", "L~.O ", "t5$sx", "\"S;&Q", "JHx(g", "?,?8?", "x~i-T 5", "N{oO?sB", "I%nFx|", ".(xv5", "UnaryOp", "frW8<", "6Waq0x", "aLqmS", ",", "`F\"y?", "4I6h6", "6SXSN", "8$GJ#H&", "Us<$~=}%", "Uh{~I", "eK4cgL", "/6aYu", "#\"Q!-[", "^tFXp", "*TEnumerator(", "UN;zg", "FInBufferAvail", "sv+fN", "|^tAS", "g\"8.K", "H97dcz,r", "9X", "RTF`E", "Dc@5c", "I3]5L", "^:R\"t", "l6rF}", "z[f[wu", "YVvJ9", "TComponentv^8", "5A@0uU", "ws8cq", "GetBytes", "[K:wC", "8 8p8", "z|hQh", "J'-o\\", " \\z[`", "vH!/kJh", "M[0GO", "Az?\\/Y", "C([<4d", "MQ]jo1a%L", "~TjoI;X+", "cspc8codepage437", "~{it5", "+.% s", "v`ddNlZn", "PiA+>B", "acFam", "[J/Oo/$", "Z xw1", "2p$+8", "Ae`8x%", "N(iw(", "9Ii$v", "L+>5u;", "An68F", "\"@FLd", "VaAVp", "JeTKP", "shRt,DV", "~LU1R#$]B:", "TRttiObject", ")ZnTKG", "*$]b(g", "ik>Xq", "+|Mln", "? ?$?(?,?0?4?8?e", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;a;v;", "sy(n1[", "@|}K'", "EVariantArrayLockedErrorx", "po jP", "091&2G2X4g4n4", "Ky%4o", "7/7J7l7", "I\\V+D", "EN!S@", "iso-ir-149", "TS\\ 3Z", ",^E,]", "TPoolToken&", "+Bqn\\", "K?(r-", "6'6:6H6W6_6m6|6", "8~J5Ib<", "=1=;=`=p=x=", ">u4;f", "i|]Pf", "x}P 3~;D9", "{O*MP", "ih;ZPeB<", "&Yw.A", "Odq'A", "Nx-gW", "+* nG", "435C5M5f5", "Exponent", "X?&ye%J", "I+T)`", "FAttributeGetter", "1$|!,", ",[V*C", "{-}dL", "i[N|5", "k[kKA\\", "TRttiInstanceProperty", "7&8>8G8R;Y;", "=$=,=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=p=", "mb[\\CpH", "*fd\\+=w(7", "^pKh8", "So|,T", ";TDictionary.TValueCollection", "\"`09i", "U8s/X", "System.Math", "=S{IL", "ss1_>gC", ":zsz`", "]gD%0", "m4?@-K", "3 3$3(3,3034383<3@3D3H3L3P3d3p3t3", "}9an.L[", "vRtV=.", "\"]L8t", "dWPJK", "p6", "]~]g\"", "X<6s,WHo2", "Fb*\")", "HandleU", "|!rax", "N8'rI", "+F2)@'", "xO)}C&", "m+K{)", "7:Om(wd", "GFu/Breo(:#", "GetPackages", "C'*kL", "7\"U70k", "{\\~p6", "X7(V+", "~0FsdMf", "S0`,N", "(;^A@0", ",t%*>=>P>^>p>", "AsBoolean", "StartGroup", "=6w9y`\"*", "kb>>IkH;", "Se9z@", "YORE/", ",!7lmg", "-@ Ax", "/@e(2", "af[%3$", "cp775", "!#i\\~", "&6?iO", "!;}|uJ", "h@yAu", "Zxdcg", "oIxD>", "9);0;Q;X;", "\\%^Bs", "I7vr^", "N+bR1a", "4jEXwG", "}>L6LM", "9Yc%onXY10", "Item1", "2{40r", "$9^5^'", "lZc_FGIK", "m(2#4", "X`K''U", "+C537x$", "c6?Bwk", "~sI8%", "Go#~Ls", "Thursday", "`+CsW/", "C.TKeyEnumeratorxtH", "1mt`A", "iFuBtw", ":=:A:h:r:", "Je%?%~dQ", "4!eCj", "R+IR*Ev", "MDAIA", "Z7t'g(q", "UH++;", "0;OiF^@", "s:.v'S", "|RE6x", "%{fn>l8", "q[yK_'3J9", "7F7^7n7x7", "yz<')?:P", "<26\"R_", "s6,\\8", "y^ift", "E.RD(", "[v0m)", "w6H7 ", "4<'.;", "SW|L=I", "GJ]c(", "BPiPi", "cspc862latinhebrew", "eaV/$", "yhh(+;", "opaque_BufferLim", "#,v:\\", "wo/RQ,", "[A6Tc", "(y.VD", "|WI,Y", "~ma4B", "jx5ki", "4(4L4P4w4~4", "bOC~/", "@j`V4", "FromMilliseconds", "doOwnsKeys", "98r>w", ")9=${;", "SVWUj", "qO.5~", "XFLF3", "3O)`o", "OnlyBelowVersion", "wc6n{", "'E+t*Qg(", "RSiQ6", "\"C]#1mx", "P3T8P", " index ", "Handle,sD", "R!L3Jlc", "Cw^|b2;}", "e'K0#", "}Rd+=", "YUMB>o", "SeVf4V", "Collection", "iso-8859-11", "RXumt,", "oizmFB", "34dKQc", "7{da8", "gGQUl", "jEwvw", "tNui{", "JS>@^>F", "8lK:}", "[$-'Y", "B*vm;", "!RG+`", "", "+P^%=", "FEvent", "II\"SIBm", "OFmVn", "6 6$6,64686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "TMBCSEncoding&", "pq6? !", "g|b>O", "0 1+141D1L1T1\\1`1d1h1l1p1t1x1|1", ")4S$1", "CompType", "GV;8Q\"", "3y'P3", ",HgO,", "VariantClear", "d#s?D", " ^YkW", "", "rKyRAT", "h:VOj", "vU7(s", "o@%u]l", "OZK;y/", "w@+Oh", "iso8859-13", "YJ5H&", "jqyz5", "E4($y", "i1I3f", "\\Q,iB", "Z-Kn%", "YHz$|w", "p9OB1", "Cr\"3R", "|vS2o@", "6646~", "_>yXsE", "SWaG8Vs/", "euctw", "Gi8&N", "j8Io%C", "WfaB9q", "!PHB!Zg", "?`cbO", "M_;gw", "VMI@%", "1jsxe<", ";3;D;R;k;", "@)m4I", "}\"nm!=Y", "[V)D@", "r}@-gu", "4Ncc-s", "XnEs[Y=", "YJ6E5", "u+=T8", "w{n{><", "f[X!)", "Fc?7T", "g(*/8", "j%AHK", "f-PXmg", ")b-W_;", "#wm#L", "?}p>ez", "].VNt", "(G\\As", "cAZ8.*", "_.]gl", "(TRttiPool.GetPackageList.DoUpdate$ActRec`", "GG~it", " AMPM", "nt2BL", ":` Op", "qJoQ ", ">\\9;W", "@EM~8RP", "FValueCollection", ",cyil", "Vyio|@", "(s#VU", "]SAL4h", "qeDUO", "fg`eF", "y-7gV", "EVariantUnexpectedError", "= =$=(=,=0=4=8=<=@=H=P=X=", "~t8\\q", "EntryCount", "TEnumerator(", "-IComparer", "'", "L]m6b<)R", "o]~Sj", "u eHT", "h_fvR", "\\p'ZE", "?)?:?J?f?u?", "~-YqJ", "nOK^<", ";@R1z~", "ProductName", "lTr)O", "slk6H[1", ";7HuB", "@qEK?", "YR=W,1", "U7c2[", ">kdv`;", "]u4+B", "6XJ0,", "O:o?U", "_1X_B", "5A[;}", "eD<9p", "SJ9Hd", "251124160456Z0?", "J|1y3", "mF;%s]", ">Jkke/U", "2@2a2", "{TeQC", "\\P=FP*", "Ib,PPq", ";#x'T", "i<~U+", "6RQC`e", "Lw7]b", ":T]S%", ":H:f_", " g:F>K", "}&&qe", "/#mOQ", "TObservers", "-+VPzr", ".fi[U", "Operation aborted(Exception %s in module %s at %p.", "?xw-a6", "W^m),", "\"[GSS", "\"\\ } 0q", "-+ k[", "obX1R", "ia]=Z", ",A&G7>", ">Bs\"g", "CTCollectionNotifyEvent", "_7^NT", "*FJk,yR[", "2I9| ", "Les8xAV", "t>qsX", "2aF:TF", "KF&#r", "\"IComparer", "2TList.TEnumerator5", "W4\\lA$0lB", "om, w", "}4vb')", "I1s@\"g", "Ju8cV", "UF-39", "sA~#\\", "%2QW,c", "\\DAsz", ";{g,r", "p:M$r", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "Entry", "Vl1.>", "aB47~U", "ET2W(", "G7OfoW#w", "<$<@5", "=;(1hX)", "TRttiManagedField\\", "H^6^5", "]z=3_", "*RT}Bd", ")TList.ParrayofT", "l6S~'", "ZXFX{", "w&uZ!", "$#(tb_", "7Lw*\\12'", "Tx Qg", "~FKXLOh", "}L36m", "J DMX", "8A(4Z", "5.6C6T6i6w6", "#wf_CCw;", "Ok.bF", "cEE0;", " PN&*_", "3{t$|a", "8NOGQ8l", "C,K^O", "b`*T(.", ":W#sV%", "BX\"^b", "l[BJsY", "I3TVa", "75q<-", "%Y_9O#'s", "@gaGZG", "ym4&F", "7hDJq", "_=RolIT`", "K<7mQzf({", "&`r*x", "Ipr*RD", "pPp!q", "LO/pz", "-7B{Y", "$=Qd2", "/w i}*G", "UHWj_", "eCFytR", "\\\\Mu7", "immett", "_2s#C", "CJKw[", "kSXP]", "%0>v{B", "Address", "}x[eM", "ui#]k", "YE0BG", "ji5:G^;", "pLMm*", "D7%Zm", "ABuffer", "EInvalidPointerx~A", "TsG'", "+GN!(", "L&J?g", "\"", "Mt?aJ", "y |ny", "4+vYw!", "<,<<.TPairEnumerator", "grZ_M", "vX%>C", "f!oBEk", "m]2%|", "nx:WrYlN5", "T", "::xEn&", "9'959D9[9n9", "GF5B<~L", ";ed*3_!", "DzUFc", "~?au1yL]", " d>%JB", "TRttiInterfaceType=", "lgshS", "cs*y[", "0]bqKYh", "m1'_ ", "L0p,H", "uv/0%h", "aNToN", "F1V\\a", "t0W1[\"1", "_DXJC", "OnChange", "9M2)r9>", "ZFlDt", "Hu564", "a>m$z", "0!020G0U0k0", "m!_GC?", "[Gck9$", "z'aO\\?", "L|HrA", "aChZA5", "7Q=M6{", "uNn4^Q", "qC0uy", "Wv|p9", "7X ,D;", ")p5;}", "1.TKeyCollection;", "F9gBo", "pIa(t", "2 2(2,2024282<2@2D2H2L2P2T2X2\\2`2m2~2", "K%,YY(o", "nt(VpD", "=,=@=D=d=t=|=", "]V\"~%", "L6Mel", ")ywG~r", "or7C0", "\\^Qs!", "*gJqx", "]Ufq", "yx]8X", "}f#4f", "u4'N~8", ")uxkl", "E$ci;b", "Xakd5T", "d3TO+\\", "`=yqv", "y'Zw}}", "CreateResFmt", ")A?j<", "ehN(J<", "}pQ(F", "{+G%dJ;k", "5*9FB", "s]x3G", "vi]yN<$", "$t#^|", "eDVi})EW", "]6]V ", "-zk1r", ":]`R6", "u8CoWn", "8)8G8R8", "4%5Ri<", "aJ3$l", "Ro~|4p", "D{cd\\", "p`7)_)", ")", "[i-dj|m", "gIs Jaw", "v}j2{:M`", "c|8z[:", "Lh7DtVi", "8v!ZY", "Ng^9Fj", "LNN2>>N6", "j_,k%", "}\\L{#", "eihJO", "eEl}g#Qb", "haZVz", "_1p)T", "~ElT0c0", ";V)@!", "zh-HK,zh-Hant,zh", "(qgB:", ";c2p]", "z4sQ.", "P(Ms%", "xR!I){", "8f#+-Z:", "|V.U6", "_`<@/SE", "PC@u ;`", "hGB1:", "~J2wvW", "|gN<3T%", ")crof", "J.5Nvg", "TThread", "\\eH$ ", "8'9c9r9", "yRAI4I", "Wc\\-2duC", "ECnO2", " @/FD", "]x_B,", "TStrongRandom: Failed to get address of BCryptGenRandom", "707@7D7H7P7X7\\7`7d7h7l7p7t7x7|7", "Fb XHe", "GetDataSize", "iso-8859-3", "ls-9;", "~:ur`", "2TList", "AUg):4", "nXlkX@", "`ql9l", "6~pKA", "&JeHW9xG", "i:\"]$", "ExtractAt", "XnEH'#", "o(V/9", "Vuy\\xp", "?+2-Mx", ",u-N(", "'T&sY", "IK|RG,", "SJqEi", "B{$10", "DXmP_", "+ E>a", "\"w,!p", "lwLGB", "YfDxQ", "n;H$%", "Destroying", "\\Y7%-z", "a%DeUdz", "2 232B2X2g2o2}2", "BN*0L", "|INt:|TP", "zm/%vp", "Y[mXad=<2", "<}=(P", "oRBtH", "DeleteCriticalSection", ">0>A>O>W>e>{>", "8d.TEmptyFunc", "!TArray", "qS7r!", "AOpenArray", "~\\YCw|", "|R&o&", "~4cbKb", "U5;rsN", "UAL[A^w", "001P1_1o1", "macromania", "L#9bR", "x/sd3", "yf:jrzR", "?\"?0?>?J?X?", "0S2_hx", "?0^}n", ">Y:#B", "OaVGAnZ", "H`jpI", "s5F:6|", ")cy5g", "0X]9f", "I.&}0;5h", "rfiVh", "%ER.,J", "UYOGS", "System.VarUtils", "Mh:f\\(y", ":>*87X", "?G-Ef-X", "S1.KSD", "4gF5J3Y;`", "FHandleToObject", "t4N8pD", "2`>)sC", "Ld,Q\\m", "7S)zs!v", "C;d[_@", "]vs6u ", ",&:@):", "@Ea.!", "*00;Y", "Td@Rj", "v&fJ4", "Y'*%`3", "~djD~", "c[\\DZ", "hmTOp", "r_ih0", "iXn,H", "[rvj4", "2D4;Qeg", ";\";t;", "$uF3n#|", ")=nb ", "+x(zI", "Ucnh+", "FOGU/|K", "fr0fq", "Y$jge", ":88 5", "lewx }o", "4oxo,", "SC]xX", "j9]tS", ",.spSL", "K+IC[", "&qokE", "16#CG", "=d5#Qx@*", "2Y3,9<'", "TDateTime", " cT!&", "E*|h3|", "&,o5V", ">3>?>M>", ".}^4H", "9b\\~l", " +|O#", "{bli(3", "'ez@h_", "Translation", "AppPublisher", " *RT1'", "/7woQ", "?!?I?z?", "c[:og", "Bounds", "tw)!A", ":~yqN", "gz-Xgb", "6326d", "*I1V]", "4sajr", "= XbJ4c", "Y@bCOSD", "wM>}=", "{^='$%V", "xF%y}>1", "dkjg8D", "^nOf$I", "\"P U#", "b$+'?", "z\\0EX", "4U;!,w", "v7(=_", "km|tD:Yj", "O+]=DC", "=/;O\"", "{x|{v", "Qj=D_", "~>(LJ|", "y sC}", "^_FpJ", ">_yZ%", "`=]=t", "&Xk9k", "#D!,11!Oy", "2&2-242;2B2I2`2d2h2", "455C5H5S5Y5^5i5o5t5", "@e/Fh", "152x2", "\\# k,", "OGCAJV", ",0Qyhe,n", "/p.^<", "Spare", "2dr%`.", ".I:O2(G", "*}Fd&", "7D*7?", "[P6bM\\", "6b9z0m", "FWaitQueue", "H'zXs", "1lmE:", "TTypeInfoFieldAccessor", "\"eG\\p", "HP=gh", "w@*|=", "$rUX|C\"", "W3@", "L_eg)V", "TRttiIntfMethParameter", "TOrphanPackage&", "5I*`S|", "qAn>@", "-yS@$", "=J)QcW", "B+/cp", " h4tm", "JE_iF", "aW1M&s", ":M\\pE", "bLVvr", "Ssp!g", "=!=7=;=E=M=U=", "kJY;=", "?>RlV", "Pi_)$#", "i'[Sry", "gqKL=", "DV%qg", "7-;B=n", ">l3K^J", "Ftg8i%k ", "AFK", "i%>,_", ".@!AA", "XT@K$_<", "O5RGs", "#Kdp|", "4cvmcg", "r'/E^", "V@`", "UV!.TValueEnumerator|", "'pT>.", "`,ZoO", "BuildUp", "U,Q. ", "kq`rf", "s-Ikg", "Gq=]4.O", "yX][^+_", "-(g7q", "SetSpinCount", "TEnumerator(", "4|S?r", "tkFloat", "|qgfG#", "qQSTPM1", "jZ]Fc", "0:VnR", "SAj1Og", "H Ira", "VDate", "NaA{y", "y:490", "_J*y;=3r", "SD4pH", "EInvalidCast", ";TDictionary.TValueCollection;", "qer?TLj", "^=C8F", "h4q0Kkw", ":+X'@", ")2=J3", "wUE0a", "1!?N@", "Sk-%9Uk", "bk`UR", "?'?9?G?U?d?l?z?", "&@k;!", "Pb_Q'9", "RemoveItem", "90$IE", "zd.N5`", "Qfcj^", "H&hzqd", "AR~Jt", "+`!~:", "ProcessLocksList", "#IEnumerable", "?\"?*?8?J?Y?a?o?", "W>&Mn", "^)8}#E", "D|\"F!", "ikg;`~", "wu~`>", "ufin(", "InfoBeforeText", "&TListl", "y3tzV", "o0Vn(", "040B0Q0a0s0", "lA@oe`", "$>Mj7A", "bWN\\<", "@-NB[", "7w7$b", "Qe=wa", "X4 48", "MQNJVZ", "uWyuE", "z\"Dm*36", "FCapacity", "&3u?k=f>", "?/?E?X?`?n?|?", "_'5wq", "}}nv:m3", "@jPv2s", "V=^Wi6", "a|jAf`g", "/RDdb", "TRttiInterfaceTyped", "_IMr|z", "FResultFP", "*r}17", "K/\"K:", "[gQqQ", "F!>$0", "kdcJ$", "yOO8N2", "pdvzz", "OMIPy", "Fg/>%$2?", "(TList.ParrayofT", "P-X2v", "\\PDz5", "--_L'A", "/@IT].", "w4Y.u92", "= =$=(=,=0=D=S=W=x=", "kIY?X", "#IEnumerable", "fv65p", "&`*wW", "EVariantInvalidArgError", "7^m[)=", "qoQ [4", "3NnT[", "/ALLUSERS", "\\\\*bFY", "yiZ*<", "$.`Ow", "&jOD^", "%System.Classes", "%E!3^z", "G~z(C", ":!:8:M:[:r:", " -({", "8[j3,", "%%%QIt4", "eprL`", "GjJmn", "57 (c", "& UR#MH=", "TSetNameEvent", "<9U", "W3F5R", "oi8jVH", "ih|RsnI", "aKzTP", "O)]`B", "<2MII", "1q$.DJ", "R7] D", "l@3e/", "Windows 7", ";1;>;O;Y;a;o;", "kqF+se]D", "e#}Fj", "{vL1\"", "5!535I5Z5m5~5", "84$FHS", "KT;/zk", "6Os>J\"-:x", ",%2@(", "=ue# ", "zA6L!$B", "K45T9._k", "/v4ze", "Lx)]UVO\\2", "9+aKD", "zS&J>", "Ph,j3", "|KIqPN", "uR9f>v", "uqyJw", "\\tr>]}", "/TList.ParrayofT", "H\"QbF", "B!%_127\\Bn~", "*L_[dA,", ",M~o75\\", "Hi,lZZH", "(cb3.", "y?MF<", "=tj}u", "\\@^gW.", ";z]8s", "m1*->!", "GetClasses", "84rFJh", "Q <>Ld", "*ISmr)", "TThreadLocalCounterd", "d]Cb8b^", "Th2gG", "2&gOc", ".zjV?", "11Yv:", "yaf$NF", "^7xjxX", "(vvj(nQiX}", "#%6mx", "^ku&@", "~G)M@", "2'+ };tIi", "~q+lx", "M}fX ", "tO1C;C", "EHashException.TEnumerator5", "b<\\I=", "sILpk", "/Ghj(", "1dP),", "Ot{bGY*", "|JJo5W", "ix[Km", "=7cvs", "", "gb2312", ": :$:(:,:0:8:S:b:j:x:", "h[)<$x", "'N22W", "?*_S;N3L", "(aC]X'", "0e%8Q5", "lwU7C", "k>ve6", "pg[|gF", "w'm2(G", "G#b=$", "$7wwW", "R'w}AY", "c^EeM", "cQz1w", "LpZU ", "Lr+W1", "0by6s", "SVkjk", ";,;+-", "3\"333;3G3O3Z3i3u3", "j=3aS", "E+5r(", "eP7Ef", "U,naI", "{aCeq'", "IJF2+", "u\\oLe", "2YSA|n", "6O7-O", "'~$d6T", "FbxSn", "=U>~?", "#Pc4Ot", "H#H?2<", "2dUQ)", ".fXS@", ")bZYq", "+}DI%{J", "a%vZgEA", ":%:3:B:U:o:}:", "pf91K#X", ",2[+H", "Uleg_", "KY>j?][", "262b2n2y2", "{u$B'V", "om6[B", "iLG1i", "nG&Lf", "WaitForAll", "IbgEx", "\"u0?/f", "kdUn!", "&H8HkA`", "_\"Xf]O", "0!~.[", "Z!Glne~", "AThreadID", "ebyzu", "g-@'X", "sNcY#bB", "rXsO'", "3Qy^%'", "'O}tpM", "T5WWm", "@AJf`", "cR19gUH", "q\\ ?#", "TBasicActionLink7", "m]gi?", "9W;1_", "Registered", "XXvQV", "x+_c7", "emOpm", "Ab'i=", "=rhlX]]", "^Z;S]", "op2~cq4", "+?5z4", ")qd8Q", "\"l):T", "J=D%|WJY(", "goEg<", "vN6]'", "rB\\09~", "f4:5;", "Bhwh`", "~5/ya", "YH_nK`4v9", "B~vk^", "=F(o3", "B6", "F8/5#S", "ckvU]", "XCP0n", "~y\\;&'", "*Xu&U", "HK]\\z<", "2'3+3/333A3O3[3h3", "/LANG=language", "IsObserving", "\\s^|:& ]", "f;K-*.g", "uKs)&", "TDirection", "!Gp]H", "0Zp2O", "vn", "Asp2J3", "\\Or\"l", "r'0)o", "St+)2=", "?@?]?u?", "PD~8%", "ly\"XkI#", "]2n-Q", "VAnsiString", "G!O{06", "tkString", "!N Zch", "Jj-M &m", "<0[_%", "t<[O@", ">-?:?N?]?t?", "ZDD[;k", "7wUWKV", "T*5X>J,z", "Ji?e|", " cR^`", "m.QM)", "O>D=VN", "xGsJl", "0]%8/", "9!:h:l:p:t:x:|:", "_szjI!", "|iOAT", "0JYZq", "5}F)B~", "'hM3/", "GQ&c{", ",lT b", "Unh==", "{\\07-", "WelcomeFontSize", "YRt'y", "#Lh\"C", "1+1<1^1k1|1", "x^CKU@`", "g$P<*f4", "FActionComponent", "*^o\\r", "S65D}j", ". %s range is 0..%d", "AppName", ":*vP]+", "6`[oc9B", "TPropSetK", "TArray", "rfHSC", "FPropName", "]FH|w'", "P 9>J0", "pv\"A`", "j7TT&", "v!|P&", "&IEnumerable", "Q5r@g", "E]_*3d", "sb_b&", "j`WgT", "!@{U|", "*TList.TEmptyFunc", "~QG`|UW6DH", "10K?vr)%Mg", "St>K;", "#bxYb@", "jhNcg|", "8.p-,", "y<#h(", "a/]\\R", "UI6~<", "QGpKp", "{j!\\d;", "SKW+b2", "?hMz;", "DKgQE:3S>", "oytMe", "`.data", "mkD*om5", "^yJ'U", "(~r&-", "+?bp*b", "ggJ}D", "pfArray", "=${pH", "A1_d`p", "Bda~6", "#q_3Q", "vXH0\";", "9c=C4X", "u^5V<", "59]7D", "Pus+!<", "$tFeK7", "QELwd", "@{xD", "g$i.&D6", "Uai9T=\\D/|a", "3&6*t", "F&.A%F", "@%O])", "q@h", "}i)PT", "IeL{l", "CWXF+", "'hEL>", "YXYW)", "d^\"$]\\", "z\"=&*C7", "$(|!K", "xyeE+f", "*(>Q^222", "`a!v8", "q@0gm", "<*=9=", "2_;xw:", ".Ns>0Kkh", "h^=|v", "q[zo]", "7B8m8", ">%>3>@>V>Z>q>{>", "#}:%}", " IEqualityComparer", "w#\\:5N", "a#AcZ", "uZ5>|", "S5i%z-", "w?i@$E'_MiV", "%ef:!", "QRTzGP", "Yr0c.r(", "U\\+t}", "f5da^@", "/)Z4M,", "Ur>s7", "jw?*_", "Ip5M!", "]}Rk/6", "\\LqcxZ", "Duplicates", "B;@o/", "TFieldExEntry", "YtD@A", "Dp,,wu^", "t{\"A5;c", "1)1H1T1X1\\1`1h1p1t1x1|1", "uKGVH]F", "EncodingName", "HXP~+s", "08AG&g`", "zL8|e", "I0G0E", "r_].WQ", ",d*.7L", "CCi(]", "$Cg^,", "fJg;1", "k{ _1", "3xnj4", "5; Q~", "/RESTARTEXITCODE=exit code", ".t+RO", "{@~M2", ",!-#2!", "kr:~t", "oS;s~", "\\S~l8L", "l?.=C", "#8x^e", "SI*og", "W9n=/", "ky_Te<", "\"D{)u", "1$121:1H1Z1l1t1", "YdSzt=", "ocZ>Y", "FDecompressor", "vaUTF8String", "D.FXs)", "PRTLCriticalSectionDebug", "tm=[)", "=<>f>", ".8!.\\", "y3Bn$J", "}m]:fuL:t", "<<:D", "czSdwu", "BF^j7", "n({dZ", "Vig+d", "WEH_k", "S]3u{y", "g>uxQ", "?Zrnjc", "N[}\"-", ">x&|E", "2I:be*X", ">d}4c", "hI2T[S", "H`aw[", "Qq^s?H", "NTDLL.DLL", "TRttiRecordType@", "5$n3J", "_SF?C", "WcEg=", "j!0nF-B", "W~i[M", "Dsse0", "tsG!G", "0 0$0(0,040P0e0t0", "3Ionw?", "S5_K?", "SmQax", "7O%eqN", "vR {P", "8&8.868>8F8N8V8^8f8n8v8~8", "TElementAlias", "+i6DZ&", "m0D\"K", "9http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#", "iz(6%O", "YhG&4", "3TDictionary&", "%rzGG", "^pZP%Q[", "7E_2]", "{)b-te", "#c$zK", ":*;1;@;", ",XXWj", "$L/VQ", "IsSet$", "(>'YOo%", ".H8 [", "FBufEnd", "Sectigo Limited1,0*", "0Wpfn#", "4l2Z \\", "V8!=q", "3(J~#", "'y`)ZXa", "1%131B1Y1l1}1", "Yl\"Uh0", "C^_H%~#q", "QuD6-", "5.=,h~", "HashCode", "0Q0W0", "v+Q$0z", "jU_Mgjy+", "fc((&", "jRn|I", "}en<3", "OA1=.", "QlEY[", "Xr=_>6", "tz/;QeY", "H<3a!", "`X1gd(^", "UHoJAQN", "5yRcw", "Aextn", "8H9OC", "&Vt)x", "w$Cpz1b", "k8^~<", ":;;;;;;;;<<<<<<<<<<<<<<<<<<<<<<<<<", "TCallConv", "j\\us%x9(", ")YHIH", "SA_3\\e", "%K/qm.wl", "gg=a`\"", "TZBsy?", "r~qBAx", "_O&f{", "AddClass", "-~!JY", ":$:,:4:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:", "u@K}G", "{/]KGx0", "1\"/C =Au", "Yf2&u^", "T~lH,", ";_rgo", "(&as PD", "]6u>", "\\eX=ufP", "A[G[O", "\"-!7~", "FH1L$", "!k1|R;", "VarBstrFromCy", "=1l (J", "bhRQ\\L\"", ":P\\%F", "7ALO@&", ":Zte&", "AGroupClass", "T[}yK", "@;<9ec", "le}^Q", ")0]n\"", "\"*xZ5f3", "0t4.Ru", "ER|y&", "lX\\AB", "TXNjqsM", "dZ}QN", "Ww7[6P", "k!b^B", "NlR[/", "BTDictionary.TKeyCollection", "C+wfX", "$Togn", "aV?7E+", "(EpE;1#", "FAsMethod", "[71,6", "'Jxa,", "*@y01", "PeekMessageW", "]qg|_", "vaLString", "0(080", "bOLQ6", "=)/o&I", "V]`-O[", "3{q6\"k", "TRttiArrayType;", "ks'ZC", "Convert", "Uh&$I", "n!\"b^n", "5]_u4z", "`+:a!", "?L^=Y", ";_WWn", "[NV(s$", "TPropIntfFixupC", "X\"/oK", "smj-NO,smj,se", "-ppjG", "KGJl<@%", "r_m2>", "_hX*o]f", "x36.#", "irS]6{", "~Nwl.$[:Z", "}v],T*P", "NameList", "!Z12sP", "*Bm>)", "MB$t:", "C\"VJmB2", "FHelpContext", "Uhz&B", "i5gyF", "Z02F,", "VShortInt", "!<)s\\v=", "kfJ_~", "yZCMQ", "_4F3b", "73777S7v7~7", "ucs-2", "{X!X.Nb", "TMethodImplementationCallback", "WJ$8u", "kWinapi.PsAPI", "3TList.ParrayofTdvD", "}eqR&-q", " VuT9", "?]sjb4", "VTEnumerable>", "S!RyP", ".wgo,", "Uo2u\\", "3L3S3|3", "UBU?TJ", "p)RB*", "@=AX/", "l(!u.u", "yFc$X", "1 1$111H1d1}1", "7{J/u", "i0T)U`", "D_>u^", "mn-MN,mn-Cyrl,mn", "&IEnumerable", "Y${b\"T>@!", "6;;I,", "GetModuleHandleW", ">m{$d", ".TItem", "#CbY-a6", "Y%+2+", "IdleTime", "=->I> ?_?~?", "!hYX'", "opaque_GlobalPos", "9_[cB", "XRIk 8", "yR-AX", "'hKuL", "1#2-2P2`2h2p2x2|2", "8G7D;", " ", "be|n:", "{Fg{Hl", "~'p;-6]", "~{eB7", ">mZK(", "h=L=Z=i=q=", "6ZdA(", "']Ml@m", "~h84k", "1zjga", "FTicks", "xP1=Z", "KX5D~", "r/Eqs", "kJr |", "dgCe^", "Grqj\\p", "ZUH}r", "r%?kC", "0H3~z@NN", "pl>i9", "|h6t;I", "ja+!7", ":aNR7C", "t>#]M9-", "5 595H5\\5n5", "0(0B0F0]0d0k0r0y0", "4*4>4F4W4e4m4{4", "h\"o0g", "*EjDD'", ";;o;9K", "V(ypo", "8\"808S8b8", "u@Hu3]", "?Oke8i", "UYDZWr", "U iQ2", "7OLG,1", "9L~oa3", "~>u=>", "Wof`3C", "X2P1^", "o)+6v#g", "uaa2U7", "M!*ys", "@a;#o", "3P$_y,", "; O])", "'<2[M", "I/^#O", "RaiseError", "pon8F", "&<&4W", "151=1N1`1h1v1", "'h?:#Q", "j!Dk(0", "hh4f1", "8\"8*888J8\\8j8y8", "`1fhR", "#|)9M", "u+9ZP8u", "7@~2O?", "j aL3", "jD3nu", "bmoz4E", "7 7$7(7,7074787<7@7H7P7X7`7h7p7x7", "RV A$", "4fu;/5<", "MA1x!", "{{IF_", ";0s&q,]", "DK*BM", "TBasicAction6", "S!F}U", ".t_bt", "2*U[GMB", ";&;<;M;`;u;", "GetDateFormatW", ">->?>\\>j>}>", "-u(*(", "Uh8o@", "skcLT", "w5aU", "41v$D", "& WA3", "1pzo{", "TValueType", "c)@[.k", "` H:.:A", "4F5N5V5^5f5s5x5", "F,&p)", "N|S)i", "GetTickCount64", "22)K|", "8\"8*828:8B8J8R8Z8b8j8r8z8", "H >7n", "Obszt", "tX)?<;b", "~Iy", "T.{P)d", "*5z#s", "K)7AL", "+CpNk", "`@?l1", "tF[sV", "8zi!'", "_zmA'j", ">/e5!q/a7", "]I8ep", "fdTruncateExisting", "'Rz.l", "}HEKK", "SvIFh", "VZ%r|a{I", "? ?(?0?8?@?H?P?X?`?h?p?x?", "AHandle", "?9&ua", "uo>n3", ">>-J\\G", ":-GD{", "#", ":PD.U", "G~-O2", "z%?e^X", "73|K\\", "V^mah", "LoadFromStream", "9pvI^6", "2YK8|", "gz:4d", "bi}~v'", "L~K+~f", "I/io?", "Rw_&H", "282S2m2", "Hl27v", "^xU\\Xz~", "hu]hw", "AO@l\"o", "\"icZb", "\"!'6\"!", "YvKHy", "iso-ir-58", "QEq-", "x^zk^", "(}^XqV", "=2Z .=", ")OON*U", "._PJ7>", "O$Dd_g", "JC}: q`", "G37L>", "trUA]", "R/ t", "S,qL6", "eF $c", "jvh \"", "=VrYj", "] QU(", "Xerna", "0E^Xn^", "}{;\"m ", "x~#P1)", "~%E(x", "zW\"4Q", "KP&Zq", ">w`D_", "bJ 3~o", "~XTm_", "7-7D7Y7g7z7", "Uh\\0J", "ITDictionary.TKeyCollection", ":wBc=", "Z5yRH", "HasAttribute", "ReadSignature", "f%2T`", "O)k3-", "6)6<6J6]6l6~6", "|cEP:", "2e@\\J", "S-1-5-18", "?/?>?E?M?W?", "N x)}", "TFieldsCache&", "CWdavQ", "TReaderProc", "HO;R-", "040;0B0L0o0", "Lu?Q>-", "l-&GD", "5.f 0", "hed#g4", "Z~p9z", "jAzCes", "gJND]x", "zA-'bJW", "fAJ]l", ">[?n?", "csisolatin4", "]>Z?b", "!Rb;~-", "3kLkf ", "Ownerships", "8sA_fc", "Qz\\$Zx", "SJ=Je", "FAsUWord", "ToC3X", "vv$xhrcV1", "YoU!?", "d>_q", "k*!jR", "-7WIs", "TAsyncFunctionEvent", ",E4=L", "cni#}B", "YhV +H)", ")#|PJu/efk", "AClass", "mo61X", "0\"070E0U0i0", "!~PSAQs", "+,q>X", "y8p:FoP", "D;`e^", "aGJG%", "`R{l'", " O7oW", "20n=B", "!cO6>C>R>e>i>x>", "*AEfB", "9x\\9di", ".J\"}!", "FInBuffer", "V2X*g", "M]<_B", "WriteDescendent", "@.zSm", "S6p1S", "7?iirN+", "$WizardSmallImageBackColorDynamicDark", "`/@Omh", "IFinalizer", "0:0j0w0,1?1", "%YAO-", "g;(N_Y", "Vw4]6", ")P7DX", "OPG4G", "'aW@?", "t,?Y;#F=:", "FOnTerminate", "m~dQ>Y:o", "O;_][", "PDs:y", "#(v^v", "C)J1^", "P=~IP", "VsQzZH=h", "TInterfacedObject1", "GetProperties", "2Pvoy", "UJo:V", "F<}eq", "N/\"%$", "NTxNE", "6=<|L7", "k=n(Xg", "PTypeTable", "tlu\"_a", "OjqA-", ")>r|c", "$[tP'%", "~Bp]M", "zh-SG,zh-Hans,zh", "\"WvGn-", "D5|F[", "8NdOf", "rdH%?", "ExCB1u", "CreateWithExistingHandle", "l5,Y.)", "5aOJZ)z", "J$dauv", "1,v6jr", "aAyq~W", "PList\\", "hR[ou", "#$W}L-3", "oShared.SetupEntFunc", "8'A8y", "JD*Ww", "fZ~;#3", "Hz>yk", "[^l7Z", "Timeout", "!T-!&", "fn}>%", "HdGhM", "9G&1=", "N4{f90Ff", "r{lyF", "d=.AU", "<0<>.TEmptyFunc", "8Wehp", "|)7s=", "mkClassConstructor", "okD>)F9", "`E)DtX", "\\nQdX", "WA-8\"8", "\\/V4<^", "#??'r$", "Handle4-G", "TFilex", "ReadValue", "xR{9h", "T.&.f", "n{\"eu", "VoALw", ":]]dm", "Tp\\3z", "FS_(\\", "w3k/g", "$55\\H", "3(3d3o3x3", "\\zB{H>v", "zH`3i", "CompareStringOrdinal", "0@0J0N0l0|0", "W0gRi", "av\"g!", "+", "7%7;7P7^7u7", "8S<>Rs9", "2CRb=", "RegECX", "`d2\\}?", "soBeginning", "Y>VS9", "{GHsZ", "0,050", "B3Xr`", "&spnI%", "n 5i?", "!SC-'", ">1}}|", "GOn*\\y", "spv0W8", "6&7-7S7r7", "zB@$8", "oB%p:", "A9<*_", ")i=y5", "h3VqkH=", "&op_UnaryNegation", "b1LP ", "-:XUv", "?yZ5}", "Count", "TCo`D", "PrevSystemTimes", "cmej,]6", "3Wb>5", "ihOG;u5", "LookupPrivilegeValueW", "@&-Z2", ">=k[I;^t", ".TEnumeratorh", "|IIf$", "&TList.arrayofT", "=&'EK", "z9r2D", "EiqM(", "o~srb", "n;D u", "#O4$0*H", "DefaultUserInfoOrg", "CTDictionary.TPairEnumerator;", "!R$hx", "UP >D>H>V>d>", "Cj!qu", "4x6|6", "c|2>}", "OWo>H^", "5@AN)", "<8=?=;>B>", "gLU9x\"", "t3Z?7", "Mxa:@", "M9{_;$EN", "D%XsUF!z", ":WPxY", "pp@pF3O3]3e3s3", "./szy", "F.}p51O", "BP'xz", "U^PU>", "ChangesAssociations", "NsJi3", ";I/ +:", "FsmwGj", "=M/_J", "MTG^Qp", "1*=o6", "eaVZ5]", "t#}Nl}9", "-i/'@w", "#XVHU", "NJ!v ", "[*0Q+", "?bEjj", "V$|H3my<-", "{mP#W", "31484X4", "'3/uO", "jwct-", "J]'a!R", "%0|}.GY", "~:[21", "w-[hy", "voF lh", "7>7I7P7`7h7p7x7|7", "}$$|)}", "2+25292X2d2h2l2p2x2", "@Q@!p", "|XMG+", "o)-sAKUg~", "&,-0f^", "@=o/ ", "gr 4a", "mpGD?", "E!QM:", "*mEGM", "sar9/", "Oy\\<2", ";I=]\"", "$6E{j", "$]R#YaaLv#", "SOX;=", "5#BPr+Lc", "Acquire", "`alorv0", "Mv}4n", "6\\M;Cj", "h)*{74f", "(h|Ue", "+h|p;", "ND,]V??", "1=^Nr", "/~Ly-(n", "F26*p", "B'^O?", "^M_'i", "~3$C}m", "l,*DV#", "r8KFRT", "PI|-@", "Smallint", "N+Q}Z", "vonF\\", "Z cNJ", "L\")AR'", "ntj'L", ";(;6;E;X;~;", "5clR_", "a|S]`r", "Lw?hi", ">\">0>B>S>[>i>x>", "lHxjH", ":h3~b", "fyXLZj#", "B -])", "k.1kF\\", "?FZI7", "JH*9OV", "f*ZQ3", "dzG)r", "%'|id", "ut2lO", "A28@>", "7,7A7[7s7", "n^=D8Mo", "GetReferenceToRawArrayElement", "%Ccq?", "VHCKrz6", "Windows", "WOt,*i", "v,vnp;", "0$020D0Y0e0m0~0", "i?&9_", "Sunday", "FBuffer", "&e%NB", "G=i69q", "oy?`!m*", "K [)S", "fb=W'a3", "CcI@q", "^xr$!", "!Kw'Z", "~3D|(h=p", "rio96", "8>iEp", "VInterface", ")TList.TEmptyFunc", "V:|OsTV", "FParamType", "gzosd", "u'!j/b", "Uh\\LE", "U|R{^", "yH6jw", "696@6", ",rhr(", "W}QDe", "Sectigo Limited100.", ") _Zp", "0YP('#", "&2YW%", "KEf\\~", "I!<`j", "lXAtDn\\", "/v\\X|", "~p*6&", ">uC\"<", ")L_}F$f", "macturkish", "l!K]r", "1R*;S", "GgEc!", "bsR91", "4+~2 ", "e;1$I", "WU;)[", "/Silent", "@aJQ|", "k6[%~", "GetCharCount", "TRttiInt64Type", "MethodName", "81n,(", "9Wan:", "~g$2\\", "P=LUOt", "1TList.TEmptyFunc", "1.1C1Z1p1", "&!a5kYk", "AN.lfR\\t", "?mbW[r/", "!#8NZ@", "q(^Ls", " p26N", "K~z~i", "O5$\\5", "86iH&z", "4pSWF", ",YK}?D", "ReadBuffer", "`F/Td", "/c5W\\'", "/D;=hGk", "[ExceptObject=nil]", "FDesignInfo", "EraCount", "9VOgj:", ";~n^,", "&oyOVB", "MaU'Q`", "(HhTF", "iso_8859-10:1992", "?sl4@|L", "D HK][", "I1CL;!", "4)3Fp", "=6H^`y_2", "QrMzJzD", "{?CI.", " *dFm", "|JNwuA", "\"?f?:", "VmtSize", "e!wj7", "H=[69", "a?WnVJte", ",&~f@", "9>zze&", "t8", "g!pJ]f", "!g1SL", "F@5'?I", ">0>8>F>U>e>w>", "YB2_q", ":/s|%", "KO/h=", "63;@\"K", "TFindComponentInstanceEvent", "}DreM", "%`XiY)", "9k54G", "\"UY-?", "3$3,3034383<3@3D3H3L3P3T3X3f3x3", ". -3nA", "aRs=js", "?l-\\Y(", "y0C@: ", "<{5bZ", "GNY_{'", "RSC.T\"", "{!QTT", ">:U!_g", "a00M7", "M9m\\@", "P.rhg ", "V8\\tC", "8http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y", "XkBM4", "9bnG:", "/(^q ", "nO!tE", "stOCg'&_", "9 9$9(9,9094989<9@9X9h9l9", "mkClassDestructor", "}L5rh", "e.s^.", "d+w++", "[9$gN", "4+4a4", "T@h_rE", "989L9P9g9q9u9", "\\$YJo", "FLockEvent", "FA1WwQ", "VC>qD", "[e!Q[", "\\}^c;", "xU4B[", "/2F~~5w", "NGM';", "cOj~D", "zTAl9", "ymGxt", "8h'pC", ".6bF:e", "7Gk-9", "Flr=u)", "c8[bV", "dLkb<", "Empty", "<,Z\\T8", "k}=f b[", "mU/nRXr", "jq`GG", "QM$Qh@", "\"7|cl", "^v0ml", ";T&", "0$080N0a0i0w0", ")[FWV", "<#<+<3<;", "9%939B9U9o9}9", "(0dLr", "p<0Y^", "gsLqX", "jA?W!", "|2j4+", "eIh:1*", "\"Ns76T", "@bG~P ", "xO(IJV", "Parameter count mismatch&", "SetDefaultDllDirectories", "7kas#", "000L0d0", "FWriterID", "o=>)D", "1>d:9z", "[4fVI", "YXDQ /]\\", "!Jrg{3", ":#:(:", "ger*4", "|+4yAY", "}v*bF", "|.T}t", "L)DuV", "xN9_t", "=6s\\,", "818e8s8", "SYcw5Z", "^*R*T", "cK>VDT", "UhJo5", "%O=:Q", "?S>[\\", "#L{r!", "ZgK}Upfc", "^a`.E", "*=tF)", "N],`Hl", ";;D(I", "\\_KJk_D", "E X~y", "5\"Q$?", "`m5rb", "^1Mpa59", "w8h,k", " TList", "orh}eI", "pys8Z", "F+8-]x", "S..kC", "cgPgq", "6y2C)ZKhAk", "QTEok", "5 /n/", "ByRef ", "M[Uj\"", "VirtualIndex", "6(60686@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "I/PM-", "}+H]z", "h|s4%", ":G*eW", "?>T5c-", "Qe!<0/", "\\Z(!O", "Ydm'v", "Jimoe) b", "FWE@%", "UXO8_", "D4z$&", "FByRefParam", "W_!y!", "%)^` Lz", "*A{FQ", ">.TKeyCollection;", "tH@@k", "qZl},", "1{z,k", "O+4L9", "x#>f;", ".,$ e`", "v<|AH", "20S w\\(", "P6f)w", "7#Yhl", "csSubComponent", "utf-8", "M7h)0", "LNF5|", "RegOpenKeyExW", "J%FGG1M", "{'<_KE", "[Aa&5", ")lpdb", "W04BqS", "WU^G4", "]}A(N", "D=Ohf", "e*d4Q5O6", "Y#6Ln", "0&,Y|", "P?V|Y", "|qck.1", ";dl|>", "vux\\Xk", "a#8~0", ":#:7:K:x:", "dJ'WW", "?qN&'", "YU.Er?", "Z-]{/", "Ve~Y-8=", "GYDO)", "s<#p[", "0joh)z", "9T9X9\\9t9", "}s,a%", "XgmDN", "iX|.G8", "x-W&^", ":^^xa", "B* va", "]^rq>", ",h7bd0?", " Oz;rB-", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "TSpecialCryptContextType", ";(kA 9", "x'1}(J", "1$141G1Z1h1z1", "ScP+vt", "=~u\\WK", "'x-&R|", "$Wl79", "'!D0I", "m)[T*", "t?Htb", "u0`#I", "7*eif", "Gd67b", "-6u%b", "q!TC[$", "@,^6N", "TuiR|z", "TInstHashMapX", "8o]mJ", "sr-Cyrl-BA", "\\TPr'", "Wy[M~", "TEnumerator", "ejQDS", "y,QW$;", "\"eZ%b", "64Us}", "4Jk4H", "lVtg ", "Bw6_oA", "3ux{]", ">0NbT", "$%kb6", "gC:)I", "Ke\\Ta", "~BR3D", "{HK4[xc", ";J_Cr", "Q&RSa", "IntfParent", "Uh'oB", "{fIck", "^{2Y>*", "!>X%~", "[Q:7yE", "AZ/}W", "FVirtualIndex", "/mXcom", "8m>#[", "=WF_Z'", "ZP-mk", "l`9d]", "K]Osr", "Fl$;m8o", "9,:0:W:^:e:l:s:z:", "4\"KW'", "/Gu)\\D", "%\\MA)", "YA\\^Q", "Y6r{|", "iso-8859-9", "~v[8Tk", "-{}{1", "H~l%?U", "9eQ:V@", "m0~;S7", "RNM[8", "9@:U:c:{:", "TEnumerator(", "+9g]|E", "Wd1xL", "3?6ab-", "OM-qO", "!sa?\\RT", "L fgNB", "FComponents", "Ev8Gy", "KGkI&", "G;#!", "nb-NO,nb,no", "FromMinutes", "k(vO$E", "+5-zKXo", "5'5/5@5H5T5\\5b5h5r5~5", "EIntfCastError", "[/MkjZn>", "iso_8859-5", "r!xyV8@", ":1#k_", "S`{tb", "MUw]q", "C36F,E", "FContextToken", "fNFLL", "F#8>wr", "8.Ub3t", "GytfvEAN", "y-%A;", "+X7hB", "v;/L5", "6!6%6D6T6X6\\6d6l6p6t6x6|6", "9IkX-%r", "0L{$r?", "VY+.2", "839Vr", "`^Y*[t", "D!o^\"", "ccStdCall", "2V2\\2w2", "/%+~<,i", "1hb *", "%NSkm5h.", "ForceQueue", "[1F'/", "qf_;y", "090X0", "K*9B ", "LLL]x.", "Y#5vY", "zA>brf", "d7Be!", "Ka`3P", "b%WKr", "YY?_w", ">(n[w", "z'Gy;", "h4DWWR9&", "f8TRht`Y", "/l%Y^>", "7 7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "3WUUaU", "k:_E>", "ccS|9b7%", "C.=/6", "iit|h!-", "&TEnumerable", "SQI*D", "Fdsx1", ".s=;9A", "WS\\Gl^", "fSOFw", "=7i@<+;", "]\"$ne8u", "o&_)N", "PBpIn", "aOw5C8", ".@WOuV", "&TComparison", "TR$$F", "1b1`m", "M:Ri+ZL", "Hy0%2", "s}:6w", "~l'sT", "5Puw4", "q4R89", "v?`#,", "\\N.9:!", "xPBKDF2", "}K6+T", "G\"hFr<", "+KNJ:", "4U^)+", "TModuleInfo", "V?Twe", "T5s;Lt\"[", "Sz,uA", "nhBhBDA2", "/MJk`", "5TDictionary.TItemArray", "w(c}C", "Iv}>J-", "aWlcj", "oQNqM3", "^?A]8", "+*dwb", "Ah&\"7", "0S1u1", "ClLLG", "smK+T", "u(5\\T", "X>wNQh", "FieldOffset", "&/xS8", "5I~@xym}", "U/0$6", "CAo;?", "Dyh0`i)j", "/TEnumerable$uD", "EN]XA)", "uD>C$", ":Z3)o", "(fT`bFbbj", "DTDictionary.TValueEnumerator;", "_\".LN", "N3A.z", "667M7", "0^UR[", "OFq(m", "\\:\"-5", "W!Mrx", "+COi%", "zJE[o", "iso-ir-144", "~/ot r", "y}\\nWF", "k11).", "bsa#UJ", "I:/F'V", "ly=5l", "2<5Ss", "L@)<.", "$jZA#4", "191W1b1", "62H6tK", "u+|@:", "l=k]T", "Cb{CA", "PtH]uT", "&eM@.", "cyrillic", "UX3k/", "G94BO", "lL[mv", "ZCMdJU", "&oNrM/", "x\"W_u", ":jPH#", "StaticSynchronize", "9R|9-", "`S|*B", "7P8wV4", "C1,%L", "h(`DL1", "ArxSa", "W8);e", "s%+gC", "^Qd*[", "0123456789ABCDEF", "{`OQn", "UhV#B", "&+Jii1", "($l&{h", "eN)}%", "Yo!1B~", "6;r&Z", "YR)UZ", "2/Dd|", "-t.9e", "&WzL)", "j_675", "ftM1I'?j", "c2Wo$u", "f-su:Q9 *v,~", "nO0W-", "WWPM=", "EH?ik", "'n2/w", ".`q&:", "TApplication", "E(2B2F2J2N2R2V2Z2^2b2f2j2n2r2v2", "hKhwL", "GMM`:A", "AbfJ=", "9`l)c", "R4uV!", "HH!az", "Ifdj6", " Pkfr", ".s6Bh_", "(24*e", "L~W9(A6", "?/$+f", "v.(", " C_72", "{]g>\\", "ResultType", "6yYr{", "dumad0", "Unknown", "^%^Et1W", "gUX(y.]", "9w9NU-", "R\\gma", "Re'U=", "TCustomVariantType&", "?snUt", "_xd>h", "]6F~F:5cayo", "ThrowOuterException", "qaoWCLx", "<>4af", "kv:*}", "nq1#Te", "Ei>^x", "FOrlh", "C?m)H>z(,", "}3;21", "Uw/ofE", "volatile bool FTerminated", "YCy\"=", "kJ*a*", ">HS,-m", ",3lU\\Y2x%s3", "/=G\\C%.", "604eg", "#4pM'e358'", "JxWGp", "`I#T3N", "1f$3if A", "!+\"F<", "U'p,:", "grlm+", "Mr~G_", "H_fq`Q", "4+H|s>@", "AsClass", "M`z}0]", ".\",f4", "p+}U%", "TClassd", "_Xg!GQA", "O3;HBX", "|%<&@", "P9Wf,", "c-#by", "Z) Vc", "!N'>|", "&8}g(", "e>h:N", "585F5\\5n5", "\\V\\p&", "ttDFH", "i;!.W", "O\\\"!,", "6$6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6v6~6", "D*|ai+", "8>9#:C:x:", "6J]Aks=I", "WA@^)\\G", "Validated", "\\HZ&y)q", "Ywi&w", "23(ty", ",>#'m", "vWgR[", "FAsULong", "3jC{_", " oJk0", "#K$a7w", "Q%]Hq!sJ", "1(/ D!:", "LjK0fa8", "6E?= ", "Fbm[D", "Nic$'l~", "TEnumerator", "\\d[y;", "8d~i8", "T$4#D$8#T$<3", "YtZ0(M", "/SuppressMsgBoxes", "|VTJ;", "FfF`.", "Kk2d,:", "1_]@g9", "a=\"cA", "Uh|-I", "qiKUeeW_", "<$<4<<ANw", "dYo(&", "_f)|3", "zdzL`Z", "cseucpkdfmtjapanese", "uW]'v", "@^!&7", "UlD9n", "r!d(v", "t&w^^", "TStringComparer", "sFtvS", "W1h4G", "n_KaC", ".2<+L", "U/E&T]", "^>[.Vb", "DTDictionary.TValueCollectionx", "9K[ B", "rA!~j", "YW.^X", "Version", "\\Aa&}<", "Ae,d=", "gW'd/", ">9WtRU", "'{P`U", "C(L&y8", "GetDeclaredIndexedProperties", "#n'4PO", "x$6kF", "8.9F9O9", "nrt%b`56", ";|[EX", "I}^V8", "OnGf/", "Xk|{}", "FIen&}", "Oiozf", "4)4Ax", "^hr* ", "h7hE9", "C(ia_", "$@K^rp", "Q|CJq-", " \\+Is", "t?:6r", "w1a!n", "FZQP*K", "'8dPN", "~HsLY", "GetTempPath2W", "VN~[b", "^FNln+!Ru", "p7i)Z", "", "$u.\\t", "Ceaa.q", "SHw< ", "jrk:x", "89=oC", "u*#:}", "<:ye)F", "Mj@|d)", "i^O3)", "f4:)g", "qJ:P$", "TLi8=", ")jX0&<", "IbjMK", "vUB!4a", "Fqhue", "cmLZMA2", "8.Xp:", "%[#K,", "WizardSizePercentY", "Z`J5<", "RetAddr", "Y<$HT", "Pz*G\"", "hA{\"x", "NmDy1", "lzma1smalldecompressor: %s", ";!;%;?;F;M;T;[;e;i;m;", "l1~A5", "=?__T", ";';?;N;V;h;", "F@ 0`&", "N'5oA", "!= z/$", "48ER '", "it_xtYz9", "Sl2B*", "a:^ZiTr", "_VjTx", ".s{I9", "y?uMW>e", "bC^`;", "P66V:h", "Gv//3", "k#K[-W7", ":+WVU", "2Psqu#", "/U+#7", "w;PX=", "TAttrData", ",zC", ">BD\\LlQO\\", "8! ?i", "macukraine", "d+;bb", "&CKzC", "X?j}]", "_/Tm2", "FindInstItem", "H(Bofc", "cGO/1U", "xG~(A", ")T3cR", "Hto&6%", ")U7cd", ";yY`9 ", "6T6e6x6", "h\\r@6j", ";.;I;W;f;w;", "PVngC", "L8cO>", "FIsMoved", "E?l4F{", "tB%v&", ";ZN%N", "&owP1", "N*m,#Y", "9Z(y,LZ", "}BcUdt1", ">o~;X", ">y2au", "QB>(l", "^T=zq", ",7VP&", ",TList.TEnumerator", "dtF][", "2+2h2", "SrkUK", "3+3:3J3\\3v3", "GP.i)Q", "Y`a0/", "tdy? ", "!v0+zaO9Mte7", "GCn{5", "':3k4t", "vZTD@", "0-0A0T0c0u0", "n&v~&", "-dSQ-", "LR.x~", "(|`0F", "xe9]6", "lK,L(", "UUimm", "[I`s(", "v@|C&L", "\":q3=$l", "8 8$8(858H8c8k8s8{8", "{h{>^c", "9^fnM", "?V;t}i", "VolatileAttribute", "1gtwe", "!!-Q\\", "4 #@H", "mqX", "zmA4L", "Vfn`]", "jkdlmn", "@EdGy#", "@]CL[", "O+AO*", "F0#%M4{", "!vcSq8", "?=~u5", "OnFindMethodx", "`s:6}", "t\\WF%K2%", "bYTdqjSi", "j'10ci", "3-3d3", "s.tSb", "[Zb:b", "ibdSW", ".Zuk6", ";;\\vH", "Qh+U>", ".YD}I", "h8KO~", "FCodePage", "XJaJK", "ct/*'m[", ":E%g/H", "E8&W1", "FIgNl]", "AsUInt64", "k>1G", "ha-Latn-NG", "pcF5~", "~25nh4", "aCh?1t", "t-Rf;", "s9VX_", "Ul ]=!", "\\m8XZV<", "EEwYh", "n_e2A`", "8'858H8_8m8", ":KniW", "?a8wF{", "O:VNtI", "k7=)[", "}T.5S", "0Q ADf", "TList", ".efN[Y", "ibm866", "Ci<2UU", "D:PAI", "N+ehD", "On:N!r", "3/3=3M3_3v3", "k./hd", "Tw#*W", "BJx\"U@", ".(Y$WS\\XR;", "rl-:d=^", "+%958w", "2(~/4", ".DEFAULT\\Control Panel\\International", "'(E&\\", "Qw'N_", "TRttiClassRefType", "KQ>YW", "Or_g{", "rX{#Pi", "#_r~1", "bFS!m", "TxA#[", "1|4$@", "RkwD>", "2A 9*V", "/+qh+", "CreatorBackTraceIndex", "iso8859-4", "WriteResourceHeader", "?*2mA", "4GTgM", "UwH-<", "RemoveObserver", "~)D\\d", " T5e]", "GetNativeSystemInfo", "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<", "ji1@+", "v;) n", ";DV*u", ":%;4;<;L;", "qNIdT", "}<=/_", "W)\"~{", "yFz74", "cGz&j", ")+gMd", "DP(4|", "WizardImageAlphaFormat", "PathFunc", "{}f&7Le", "9V}]k", "n'\"|n", "4'4A4I4Q4Y4a4i4q4y4", ":$:,:4:<:D:L:T:\\:d:l:t:|:", ">8PJ~", "U$TTL", "cUv_\\", "mu@>m", ":gkc+.", "9;:?:C:G:K:O:S:W:[:_:c:g:k:o:s:w:{:", "~~.DT", ";4_sg", "k,s_~", "6 7)7", "-{SwE", "ClassRefAttrData", "|lLnA", "Xr?,R", "j`+I4:", "v;{a{e7", "Ry@Nc7 ", ":%@S.", "XVg]d", "~#/}G", "t!Ht:", "B(\\0LI", "}[)w_\"", "? ?4?F?_?v?", ":VY#=", "t`@Du!@F", "CloseHandle", "YZ]_^[", "0<_C^", "L$i^_#", "ToShortUTF8String", "PPropInfoEx", "2 2$2(2,2@2D2H2L2X2\\2h2l2p2t2x2|2", "B'j'j*(", "Yk>Tz", "O>Dy;R", "kCdJ`", "m@8#K", "n(sUr", "I3VF=U", "aEsn&8", "0;1J1l1", "5Gxiam", "#%XTJ", "061=1p1", "}^|YR", "I/s/>", "Xi>n ", "ObNAJ", "`\\N6'", "vO@H:", "7A>E1O5", "Ac5;|r", "=*jJ,*", "Kx?G(*8", "~Go%_", "ulkLY ", "*IComparer", "Q16R$9", "\"PrivilegesRequiredOverridesAllowed", "Be9ZqV", "Xi%]i", "Kpb5@{,G", ")B8 /", "\"J128B", "\\\"[ZnG", ")e`{T", "5#5+535;5C5K5S5[5c5k5s5{5", "TaX2h", "xjg|/", "n{y$:", "QrbQ/", "?U4AA", "t>n~f", "g;?*#", "C7Z5\"", "#E4h7", "{E_#aG", "PBVRn", "4l4F}", "(u?0R", "rRa8C", "-Ile%", "[6%j/", "Cp6l%", "\\HolnU}c", "S@$@34", "!CWcO7", "*M\">V", "Started", "5D6m6", "zh-CN,zh-Hans,zh", "XSxTh", "8LUCBm", "0Au/P", "w\\\">`E;RV", "?VTFq", "V_}E0", "683E'", "ZQgz&", "ff-} ", "*Lh0T", "l{n3A", "U43lY[", "*f;oON", "-);C'YB", "Q(eI|M", "j~_!Q", "0^n^T", "51'fx]", "1P!JV", "\"6|:c;x", "BFvxA[", ":,:4:<:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "(d{^;t?", "EComponentError", "U:VMAQ/x", "9oyy_", ">,>>>F>T>c>y>", "iKCXh", "iso-2022-kr", "9P%qf", "J4MN|", "PyzZU", "L]m'm", "3)3-3L3X3\\3`3d3l3t3x3|3", "t5Qd9", "A{5AP", "c!*~S", "V;IjF", "DeclaringUnitName", "eK.5=x", "GetLocaleInfoW", "aWc", "\\^xTF", "kSqP-", "9|pK;?{", "p0n0G", "(_3/E", "+,2|,", "Fcsf0", "3YXwJ", "PAttrData", "K9H\\-9a", "6~&c6", "~3W6'", "B=&Y2}!", "Bj*[4", " VcIK", "utzW{L9Kv", "l~()[", "sr.O8^uV", "_?X?B", "3?FB}X", ">n^vv", "i*-fnW", "wco'qi", "=!*t3", "$@xVN", "jR6o`", "ePRy[", "yV,&-", "#*leb", "R~W\"F", "h3~\"y", "tkInt64", "a}!R/", "|?i\"Q", "2U0/$", "d`x%L", "x`UC5", "1Ro8%?", "e40vv+", "6Z{ug", "=5===Q=X=u=}=", "$AG=.", "\"f:/;:", "s{$r+", "OUnsignedFunc", "BnVlm", "v0+b`", ".y 5l", "'y,`4", "w4[n4%", "vg8b7", "^xhdF", "hAk^#", ";u!|8", ">n%4k", "toU:f", ">r'.TValueCollection", "s[dCK", "MyNR-l", "%hJ:HT", "TMultiWaitEvent.TWaiterFlag", "1'Ac4.", "!NIE[&", "GetSystemDefaultUILanguage", "Ef?F5X", ">$>(>/>B>V>k>", "N$'?3", "|5R9[", "f[ u]", "$M?FF", "8(!jw", "I.&5:5", "5Wy-Q!", "6d!WE ", "utpQB", ".3D(c", "{/Oe'", "Fc\"jV", "> >$>", "KZYv?j", "la8s/ ", "niz%6", "6gS3u", "m\\.Dp", "yQq$7", "_L. a", "628`8", "(_ N3iL", "%-{xo", "T`O(<", "i;h1x", "ZzfgT", "TComponentEnumerator:", ":m6Ju", "y8I d_", "@;YV-", "[m_OeF", "5\"5I5R5", "OnReferenceNameL", "9j4oH", "wcS[,SZ[", "CharUpperW", ";XEK>", "d [,z9", "QNLa?", ">/>?>G>U>h>x>", "^tfB+4", "foG*>?", "_Rhjr", "E:`V3", "CopyFrom", "6u<\\cX", "3Fz9Hn", "FTotalMethodCount", ".yUp`", ".^(Fa", "GtOYQ", "^O61_", "%D=I|`f", "Pkk*xV", "_{\"{c", "se_O2", " |}{<", "8LFAsD", "&TArray", ">*>:>M>_>g>u>", "=2:iM|", "ILP8V\"|L", "z9GOm", "eG7nO", "%&'()*+", "e|l+I-", "m.qrsVz", "(,XTLH", "Y", "~F*h|", ";chvK", ",IYS<", "+TList.TEmptyFunc", "{?U}wOw", "p;Cz_", "B>n|| ", "5n-ee", "Qs})7", "8 8$8(8,80888q8", "|B>_9", "~]s~>", "qqxV9r", "y%Anu", ".<^!~]", "ZsI.E", "1 1.1=1P1c1q1", "Unused1", "\"QQz@", "R|)U9", "8Y)rh", "6 6L6P6w6", "'rOk@G", ">SvsY", "r5e`:x", "K\\Dbdy", "* 7{z5", ">5?J?X?p?", "3%yN|", "z0fQH", "0p/}i", "=T>6???H?z?", "1[(P/", "'v5>e=", "Minutes", "dXME0", "jiPoh", "mkDestructor", "D*fwL", "y!/eX", "8X4r6", "r$-nG[", "hij@klmn-opqArstu", "TRttiIntfMethod6", " xB&X ", "ZO@.(", "ReadCollection", "TEnumerable", "D8CN0", "iYIL/", "IComparer", "TPropSetV", "Gxau=", "*K[EY", "9Smh5", "T~9n>(", "6$6(6,6064686<6@6D6H6L6P6T6X6e6{6", "='d", "zQVtL", "J@n3'<", "c~K>H", "`<'Ys", "1oC8:.l%", "W1!0_", "\"kyk\"", "<&=ax=", "4j^Uq", "RfHp(O", "xh l0", "ayJm&", "Im\\x|b", "0'0=0", "(pL.v", "+}6CL", ":`klx", "^OQPQ", "System0", "G4aij", "*cQt^zl", "TEnumerable", ":x#uNs", "RY(%L?a", "$~gaLp", "t'z4M", "0U[Zt", "BA44p", "< <(<0<4<8<<<@v", "-Miulp7", "M=rb8", "l7D6%", "uetEc5", "FfqTM", "5(w(W", "\\#t]h", "\\1IvH=", "%_'{,i", "ReadIdent", "EInOutErrorA", "IFs6c", "System.Generics.Collectionsd", "V\"4J|)", "@8z4c", "9\":P:g:", "]'pz[", "Z[I9^<(", "HY[@:", "Af963", "!$55.~", "8u3YV", "(']8l", "5a]lP", "TComponent.Create@$ActRec", "+TEnumerable", ".,#SXw", "HYC)C", "ContentionCount", "TStream", "T(yY_", "f/ir!L{]I", "x09aqf", "|jo%,g", "Og9j/Bg", "_@bZP", "\\cXsZk", "TCollectionEnumerator", "R5+`?", "8j&Fj4", "=P>n>", "TtPU|", "Ch", "|-\"0k", "q,tK[M", "[y.,}C ", "#pVdc", "4+US`", "#Sectigo Public Time Stamping CA R360", ".];tr", "-9ooj", "oLE>r", "5s,(g", "+8PA!", "3*?1(", "_3_Q[", "i7N8Tz", "5/5B5P5d5q5y5", "BJdPO", "q\"W8Ro", "*6Vjn", "~n2T\"", "<)Yxn", "Nx71/!", "VG`J[o", "5#pyS", "^'t?[", "fij{h", "f3*[F", "2Tpu*", "u7'&#x", "TRttiInstanceType", "9{-(G", "bX]oS^", "i02k_", "gA2SS", " \\scx", "67ZI^", "YwCdEs", "&1Ima", "U.qv.", "maccentraleurope", "Ka+(~", "Pr?IiR", "}~Wac", "IsInstanceOf", "z-Hp{", "bD2Fk", "Zw!XY", "fAWg}", "WizardDarkStyle", "JS93o", "v`'$E", "PX2AkG", "EPrivilege", "25/28", "Prevents Setup from restarting the system following a successful installation, or after a Preparing to Install failure that requests a restart.", "<\\r-}", "BCIgu", "n8FF:", "Z!#Xn", "q%X3 ", "j7YDi", "l{&^\\", "9b-0k", ";T3%g", ",I3G^db", "8CONY4S", "e|<&=0", "C~m<@I ", "!G1/&", "Fi*q_", "E rh>D", "6k0W ", "7}Meoxu", "id&`L", "uP_B", "EVariantInvalidNullOpError", "PYi[)", "-\"JP/", "*P~YKf", "euccn", "Q*;'J", "v(P;#+", "f-G3XYz", "r:CEBZ", "k8V{F", ".UHmJa", "Np93B", ".#pKn", "FCond", " ??A!r", "xJ}GiVc", "<;}v%", "s`r6S", "\"/;7U6Z", "Z_#D)", "s,f;J", "S)b1 ", "Rt-GE", "K`4:=Q", "B\\ci5", "tBnlvLs", "AhUZ3", "Kr0S`n", "1#2L2w2", "7\"\"=I", "irtv>", "zY,$y", "%:}'m]h", "n3 0~", ",j*Y8", "I6.1y.'", "VcL>N`", "La$Xf", ";G2z=g", "uBLA)", "n0?iO+", "'1|TG}", "ShortDateFormat", "BK2A;(", ".Sn2P", "<0<@t${", ")g{Px", "s,3P;", "?uqNS", " MdO#+", "7.7<7N7h7v7", "}yQn\\", "TRttiInstanceFieldEx6", "iC R;", ",uUat|S", ")Q~3)", "2S3u3", "o*L;.", "HEl$/", "f^0/C", "z9lSs", "} c[w($", "NnaCe", "m9X,j", "NJhtN", "l,Nf[@c", "{vMZap", "Uy&/9+", "\"!Va@", "4a,`r", "pZa`{", "!i\\%-", "4x|{p", "AQ*R81W", "-+@afx", "&py*1", "CreateHelp", "rB`fs", "6", "6Q6~6", "y)\"%:", "H;!f", "ZzYx<", "/TList.arrayofT", "{*SrI>", "]WqwF#", "qps-ploc,en", "h!F|F", "3}_%e\\", "N+u;z", "TResStringRec", "EAg?>_d", "& j4B~", "=aJai", "WKm&oe", "z\\\";A", "NumComponentEntries", "474?4M4[4", "ClassNameIs", "FInBytesLeft", "TRttiClassRefTypeX", "]qn}i>", "_ XU&", "?nIpf", "DP6u;F", "Uh(UI", "2xd:H^", "#ks5E", "e |H}])V", ".Cddp\"", "<$s9o", "J$x0=S", ">6C?U,D", "B&'gM", "Array ", "+TEnumerator(", "O2z3m", "s|862", "FWaitRecycle", "0wt10lmyB", "8!S3S,/.", "+\"#h+", "MpD:sRql", "?2U]V", "LaQSYo", "System.Generics.CollectionshOH", "!YT`T", "K@fQJm0LmM", "oeG.9", ")KE\"R", "[{`wY", "SeekToEnd", "Q>utr", "fGH$K", "#g|(&", "o&5CP", "U{Prw", "4PZ1~", "vCqBF", "(7<:Z", "~-{#3", "Uh#sB", "4ZCP+^", "F:)3r5T_", "vBgCXU>", "/~~]$", "R,Ql4I3-&(", "}.\\-UOv", "FOpenArray", "}1{$@", "System.Generics.Collections", "1!191A1I1Q1Y1a1i1q1y1", "41-us", "Lf&mJiT`gV';", "?+lq{", "UTynBOCB", "PropertyType", "TVmtMethodEntryTail", "`re^|", "BXh\\i", "^`\".kX", "/3{'H`", "TPersistent'", "SwitchToThread", "LE,3K", ";&Hu4", "csisolatinhebrew", ";8$=q.F/", "3`Dh%", "}2OQt\"X", "OnUpdate", ";a#VN_", "5tXmZ", "$TMultiReadExclusiveWriteSynchronizer&", "KOOAe", "ir]sfY", "F:I=g", "8x'Id", ">6wYW8", "!iW=6", ":FSkN", "A`mN0s", "", "Q4siirab2", "zv0s<", "}Qu25", "`h:~B", "ZgQ9n", "PCYP^T", "p%\"Hy", "j/P!e", "k51/@", "wQ\\/s", "rcpE*;_", "p\\zN[/", "4sR>G9\\", "O.mJ?", ">ZMMd'", "7\"t^T8", "LsJ(\"", "TList&", "u\\ui=", "v@NUrW@", "7+SEM}", "AFlag", "/([^K", "H>7B;", "W.sd8", "]b#kW", "^g:cH", "?g-fr", ")p1p\\~", "3zWtnG", "7~how", "FPropInfo", "5P{;9", "(fW<-,", "75``i", "878A8V8j8", "kkerJ|Zz4", "%OdF\\", "H3>!z", "POl wy", "UhsPI", ";t}D_", "Ofjwo", "System.Generics.CollectionsX", "~\\hFF", "R-9Gc", "N]d7vV", "1;*pSvu", "7z]u?u%", "4Xv~DP", "121:1L1W1`1j1", ".@kp^", "tK+)Q", ";@\"5)n", "9F:J:N:R:`:n:z:", "AaUAe|", "Current", "QAC{\\n\\", "TP#v,", "YykSK", "Vl8R%", "n8.$f", "&!6Co", "Q?;Ix", "_yP:z", "T:tDg", "siTy!J", "0O;z/", "kMt9'", ",BHC$I", "cNd*`", "S!f_~", "=hSF)", "y:=d.", "jk=LbD1c", "LoadStringW", "t`s4XI", "mdC@B", "p1(q`P", "iQ#~T", "K>L=_", "N+M4DK", "Z7>!q", "v;p:o ", ">o:}.", "E/5Twk", "CT6L@", "Vhzsm", "oYfr^", ")MsD&", "E9v_o", "ASelfTypeHandle", ">1>9>G>V>l>z>", "PZ%upm", "B0@0>", "@GwW9", "x7~5b", "q9(Q'=", "GetThreadPreferredUILanguages", "8Qbb*", "}\\$=]", "CreateFileW", "2) @>pM", "EStreamErrorl", "7\"7&7*7.72767:7>7B7F7J7N7R7V7Z7^7b7", "L0H", "+*9#c*", ">VNw*", "7&7Ei", "LJ9Mr?)S", "h%L(K", "QE5qMK", "&v_y/", "2>2s2", "z5s@\\%L", "iD81hl[", "DDq=\\", "bq8#8", "/SILENT, /VERYSILENT", ";TList.arrayofT", "FMessage", "w-Ge'$", "Uh6 E", "?UUUUUU", "uB[TCE", "9TDictionary.TItem", "9$'Hw", "mWkav", "LOOS/", "57EOG6", "\\n:mK9", "Y)%h_*", "J*5yv", "(/4h5\"", "Overrides the default folder name.", "TPropSet", "VariantChangeType", "Uh{fE", "ZGDHc", "G5", "&nx%;", "wCfWj}", "!/_T[", "os)Lao", "File access denied", "wdbD++u", ">ewd)Df", ",el?j", ",QXMO", "Jk`L ", "4Kb+j", "x6+k]", "pz VN", "f+V[f,]J", "RB^ xWw", "9http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z", "7co+K", "~?Nr|", "qjE.J`", "BQ|3y", "hG_T9", "tis620.2533-0", ">'}*}", "@0&<%", "43nw'", "+/x\\W", "6j[X_", ")[+f[", "TRttiType8", "H#x7H\\{", "z@1P/", "=BUVlN", "'D;[M6a", "Items", "T.H}z", "QtDZy", "2NN|?", "2/QZ6[", "aZKno87", "Ti>Pp", "TReader(", "hfgr&", "11151O1Y1]1|1", "2*hPZ", "}*ynJ", "|Zh#(", "fe4k]", "o0J|t+", "@F&!A", "FLu&28e", "pnyQv", "'Rxxv", "p~sVS", "0 mL|", ")SC7!", "ToByteArray", "' jQi", "RxY7o]", ":vko8", "FTagCounter", "-}Gr&", "oWH", ";wG!XS", "ShortMonthNames", "F\"*M7", "]nSyo", "^XSeTa:", "d]%` ", "{7K=_", "\\kwF@", "I>x2KF", "TKa|J3", "+TList.TEnumerator5", "-CKHv", "gu L4", "qAoxn", "OCDze%", "XYjMcVoC", "TReadComponentsProc", "9,9:9F9T9d9h9l9t9|9", "UJ-)>9K", "Q|a%h", "4&424@4[4c4q4}4", "+DwZ^", "Kwr(o\\", "`n4xv,", "vhkPl0", "w}#|4", ":TFormatSettings.:20", "!o!=$", "q$?g>$", "bL*.D", "12eYQ1", "eL9cU[+./N0", "rgh];fw}", "laAnd", "Y1<5r(", "` k$9", "O~@Jfv", "ZoqW|", "Ndg;)", "kx3k<", "rgo!7'", "\\xzy/", "IKSG8", "kBG7? )|", "J](UC", "IBT&N", "X~jvqC1", "0#050Y0h0z0", "cuK~A", "=_O`/", "='>H>T>b>q>", "PRnP\\", "rYf;5", "\"TArray", "1`kv%", "i~7_B", "06F0o", "X5I ", "TFilelCJ", "!|+UzI", "Kjoe*", ".2F2@b", "x1^Af1", "fe/B", "%[{!(R", "P2VuTi|", "aCTt%", "9H1*Tga]", "Y/RGm", "Reverse", "sHCT1q|A", ")'`bp", "#IMD-`", "vqh6%", "<'O`W-", "3z:>-FK", "xQN;a", "X%8b7", "\"rSlp", "\\vD<~", "GQ@~<", "Invalid property value List capacity out of bounds (%d)", ",edY~", "Bk-h7", "_5)8d", "\\jw5?", "h7?Y8G", "ARight", "CZ\"o6!", "X$R}m", "R\",8x", "euc-kr", "5>BFZ(A", "UC*n)", "n-T0x[", "ReadListEnd", "p__w$tO", "JkPy^", "/+6I9", "g7IwD", "2lhX0", ")Op6\\%A3", "^;AK|", "LocaleName", "B%|Vo", "7'797L7k7o7", "iso8859-6", "EListError", ">B.U[ySi", "pR<5:", "%T_>g", "P/+?#", "We=NC", "TThread.TSynchronizeRecord ", "InitCommonControls", "-1178", "7J!uSC", "*vs.\\", "88u$o", "viwW^", "AKlS_", "3)3;3U3c3r3", ">-?", "?T'>O", "TMethod", "\"Ve\"0", "(>9>N>a>s>", "CDqi9", "![P2KA", "n=[E[~", "@>4#&", ",tdBHu", ")4>2V", "!@'(P", "WCharToMBFlags", "7VqM8", "aVEm.", "tHx,)", "xG.;\\@", "v>e'J", "xNn@i", "(]INV", "?[:ycg", "/TList.arrayofT", "x D_;`", "ByteIndex", "?J?{?", "_Nfo)", "TWaitResult", "MI\"?K", "}zAWBz", "j\"B[Y]", "|:Fo[vsB", "HWu%Q", "=&=*=H=a=", "^oz(P", "@:UPM", "s+ddk", "PShortString", "oSY%*", "dqw/i", "1|wSH", "^Fw.T", "icRC8k", "WF19;", "'Z1h f", "GM)=h", "^HIw!", "](@g1_", "wdsLight", "+)y$,", "T;wIJ", "PmfJ=1", "%:1l-4", "bBL-$2", "+o_SIF#", "OOENg", "{1 {d", "PihsYG", ">778T", ",D+a{[", "$c&rp", "Nc>Zwc", "EK8$H", "agH[pE", "cp862", ">XmO{", "ZVwxE$brq", "zgsKt1P>", ";;:YF5", "Q4Jwn\\", "f_W4&", "_b%,\\", " 5O5X", "=z('G", "32-bit Edition", "2D2N2p2", "AqsA+", "q_NU3", "'t#.o", "/T^V4%", "o,P*hz", "&({-7", "gL*jF", "$uE$c", "v7VHk", "rN8l:n", "fC?|GI", "Sp+=\\", "+7;E?9", "/u3Q0", "pOSkl=", "'UQ)K$", "`xV#^", "Im13L", "K\\<4jz", "f;8W,a", "x,sEjXj", "_3u%,", "g&@ry", "a_+!g\\NAe", "sReJY", "L;^~B'", ";x", "^/8m.@", "B)E7;f", "MXeeY", "*gYe@", "6T6f6o6", "*!ztO", "ZC7fK", "5<>C$U", "&KWo-", "k2Meuq", "yp8j-", "7\\H&Q", "PListh", "4}/e4", "|nO_af", "jjjjjjjj", "oM\"%8", "Bz{?D", "&FF{+", "X w&?j", "Ot0MQe", "cat4x!T", "_q$!r", "@*D_$", "e8k4,M", "HLr\"0h", ":}}}V", "eLs7^", "INRr.", "w]#L>", "LQKsSu", "RAwee", "PthDm", "F|8WiTX", "xb594:k", "5#5+595G5[5c5t5", "B", "GW.{]", ",,Q ?", "ptB\\$`", "@Cq;R", "szG@%", "J.Pnb", "08n74", "ListL2H", "lO3?G.", "9^.N,", "?JGvPp@>w", " ;-]8", ";$;h;", "_V)B7", "8AqKu", "8 8$8L8\\8d8l8t8x8|8", "b`Icm!", ".Y)|%-", "ct,M6", "UaElCEQL\"", "6+L^M", ";cC*|6", "E+s<[", "&F7XI", ")y|Zh:o", "/ytOH", "dbkFCallWrapperAddr", "]ML.{", "rkX=9", "TArray", ">%{~.ParrayofT", "`tYGi", ":4LAS", "V~apY'", "OTl#]", "FReadMethData", "+33%[", "?WXY\"", "gb_2312-80", "=f?}?", "i=r|*", "a|nucF", "Ie-JE", "Aj|WTZ", "yQWP!e,", "{\\Bm0d", "bUX-B", "ZUeIa", "[$A<~", "qNP*Y<$", ":s\"\"k", "4]~8=H\\R", "cbsKw", "%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)", "cLgWvW", "_tV4yR^=", "\\Y7rI", "IXgu{", "{#*{8", "[dBR2", "%q]m$", ">p_-5", "pN!-~^.", "mzI)r", "I1{=p", "windows-936", "be=K'", "ACm;B", "|C3\"J", "Ul$m7|", "w\\33=W", "xPoLv/", "2K#x'`cbHi", "MocQL", "&E[gO", "G4aqI", "s,uxA", "NqCkc", "Btsf0^", "p6^{^", "bmE0nr", "+v>Ko", "eP\"+0u<", "$TAY.W", "L)p47", "GyfS#", "Td`Wr", "YF4nG*", "Va$cP", "\\ greC", "RuW:r", "FProcedure", "&Oe)S", "%@mOJs(2", "B}Lz*Fe", "f}``Z", "X%{zYz", "NdNQB", "amp,t1", "zA(%sj", "[^h5N", "e)Zr8!", "'@1OY", "]#}:Jo", ".XUla", "WXpQx8", "on29C", "txN],", "NZ`78", "]qA;W?", "cosQ4g", "t?,6Z", "I QN=[", "q}zD\"", "BA2C{", ".3A}7", "dd jvV", "AWPe7", "I[Wxq", "S2~6r", "Execution", "csisolatin5", "bMI7~Z", "C8H(e?", "IIuaj", "Tc]Z4", "7{&0bQEj#", "}Y*?e9", "-?%V$", "D<[JTH", ";DV-]", "323@3P3c3v3", ".BeG+", "EVariantOverflowError", "VTEnumerator>", "GuC9=", "8 8$8(8,8084888<8@8D8H8L8P8T8a8z8", "608g8o8z8", "TRttiEnumerationType3", "YLeUq", "(#Ed7-", "4*I:B", "MinInt64Value", ":zf{5", "eT&.ZG", ";sinK", "NextValue", "\\{EU?", "/0ipx", "UVj6L", "^@F):W", "@jCrO", ".mALm", "TPersistentClass", "5Qzb>", "_7D=k", "w.v^Y", "`]T;E", "", "oPn#.", "#f`x/", "4\"6QK05", "\\-sWE", "V@UgO1p", "mQ0%2", "WzL)G", ".a0uW", "tE\"sO#r", ">oHVmt", ";n3**", "TComponentEnumerator", "TStringComparer'", "Z_eI9", "\"%l6t", "", "*^jkm}", "g*b/,R%", "+NN(:J", "$sJd#", "CodeAddress", "IDZ[.;", "Pi5SX", "GP|\\g", "`J:i0", "|.qUu", "},mPT", "1(C=Lj.", "OI\\LZ", "KY:h3G", "v*ope", "E#i/8", "0Wq8/v", "G-GtB", "T3s/2", "GRv2UM", "&7U]c4", "}o", ";_M{M9g", "Z,&Y]", "FromBeginning", "$5P`V", "/~XgJdi", "EW+$4RW", "KXwl>", "L;;vR", "~P*6|", "-@ju>hdj-D", "lKeZ1-j", "Dn4O#", "NmTnT", "ao#8r!\\&", "~e3C`", "wt.%p", "+MW>}WN", "hmATDictionary.TItemArray", "m~R9i", "%)@m9", "HY}t-`", ";}Ww:", "zn{e(", "RQtn?6", ":c`:9", "3Q.HlE", "-f6Ov", "pfjN&", "W~Ws7", "7%TR8", " b9-", "W/+9#", "5ek>2", "vBqe;{", "g4O*.", "3OdAa", ",TList.TEnumerator5", "({*V6", "S]c1i", "\\0gC|@R", "TQ(K*7", "$;:yF", "![l1S", "849X9d9h9l9p9x9", ";/;=;U;d;l;|;", "^j?6w", ":TInternalEraInfoRecord.:1", ".a?J5r", "+:;Z&", "mKuRBg", "DCm)U", "TUVW'XYZ[\\]^_`(", "u\"vvl", "b`ZEg", "slAuto", "H9CCpc", "_`vGP", "A_#~sOy", "?DUsaFr", "BKF<.", "fwlw]R?", "B3Q(l", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "P/m@._%", "VKt]@", "r({n~)", "M8ka\\", "?*?P?W?n?", "g9~@m`", "YB$On", "9L8li", "$4\\J(", "smPC0", "c\"~bER", "1 1$1(1,101H1X1\\1|1", "9{$M ,\"", "@jy?)[O5", "t=ox=", "HVW&!h", "ao/x2", "Rao.I", "mkFunction", "Y-^Up", "^;V?41", " nw)", "A#5CK", "18eqlk", "Package", "SetupLdr.e32", "F?m#>", "FReadSignal", ">&><>R>Z>h>~>", "j>y t", " 6=S/", "7ILC+", "\"_O~B", "3;kb&", "E!S57NH", "4+434D4O4W4h4|4", "Iw#~,", "L3k;d", "]:y,d", "n<6od", ">K?n?", "u~oQ.", "aQf$S", ":BZX}", "FMethodBuckets", "qwHZhI2", "){}h}v", "||}a8Y", "e0/<#", "n`elZ;", "8%8)8@8J8N8p8", "dm6(;!", "v'jf8", "g>.0B0", "x^*a$v", "B@9YX", "ur>(", "A8&3jN", "9[6R1", "m*T3Bq", "6UD{g", "QQQQSVW", ">A>P>X>h>", "#PgAd", "]-MMO", "IsEmptydvD", "UIw]C", "Io4)=", "Qx_-M", "<%zBC", "'4UQ{", "3x*pk", "(9gT7", "+TList.TEnumerator5", "nR+u$", "rNL1E", "]vBgr", ">XDIl", "ASyncResult", "(F#;}", "9&9@9c9", "K%091", "Ke,]k", "36lz;", "a(BY!", "\";wogt", "OdZ62", "2~\"2;5", "3!-X1", "zd}HXn", "\\Y~?(", "*8]g9#h", "LT+Jo", "faReadWrite", "lX9>lm)", "0/G9'>", "2!212C2Z2h2x2", "LM!nv", "X.y_NrZ", "E=kAE", "zb5P~S5t$", "@Aks\"", "g5M`8", "Memory", "imu*8", "zb^_N", "TRttiProcedureType@", "i+YnY", "SS']t", "c~_X ", "Kxi?;", "UhaHI", "OOO[u", "9Hq{C", "*rDg=", ";uu7W", "pQ<{S", "I.]iF", "bigfive", "6>]`tv", "PMonitorT$@", "xDf)3)", "@`+xan", "Qtz%L", "u\"h2_", "%?ktg", "0lbT,", "-TList.arrayofT", "S(D.=", "LQa@h", "DhQO7", "_Tf$9 ", "@]v*U=", "_*uA8", "9&979N9\\9o9", "a9YfX", "ew+R?03H", "T9I|\"", "/sc,c", "Direction", "L?)>f", "(TList.arrayofT", "e?XU$", "ls$wK", "#TList.TEmptyFunc", "p7@jd", "QVc\\r", ":?:e:", ")\"rr*", "TFinalizer'", "H+N,8G", "ffInline", "{M10V", "O.[`", "x$r5BF", "X,Prr", "X&uCI", "Zq/+A", "r[='/", "7(7-7<7A7V7[7j7o7", "|MJ^B4b", "G&GUF", "TRecordTypeField", "FClasses", "eZ'9W", "]a^von", "EXkIv", "Zdg$p", "spQ5()", "2'Bc0c", "8A(;`", "8:8K8", "V4PDh", "4TWb}Q", "wZ52[", "|yNX:", "eS\\XY`N", "/)~-62>", "vrMd6", "2%#,c", "SR+sM", "ky@0. ", "KtP`+", "G:+2<", "e5#]4,", "'ulnx", "q|O?T", ";8DV-", "sV3Fc\\", ":F}!{", ": :$:(:,:0:4:8:<:@:\\:p:t:", "Tl|uu", "C-KVc", "H9z|V", "79U2u9", "H,nrI", "@ay;i", "3]$A]?N", "?NI.Z", "-21wt", "CIJJ$", "Ot+?\\", "B0`P~", "fv M,", "5sZ W9", "A>`hC", "alHtC2", "GetThreadUILanguage", "ShortTimeFormat", "XAIY7", "7 7$7(7,7074787<7@7D7Q7t7", ";2\\||", "w8Io^R", "\"rM*Y", "mu]!;", "6'I@'", "/9jP3C", "^[YY]", "Y#ilw", "rWzAc", " _5!.", "K%?*v", "A{Mv:", "~*.N!", "11'`8r", "YL@yf", "515?5Q5k5y5", "Jb_Lb", "NCV2F1", "Yg7m-", "UX;L?", "I#dP/", "-v%_K", "Uhr'I", "u`Iy_J", ";_0jX", "H,HI_", "V/|@m", "1#151E1M1[1n1~1", "I<<.R", "+C9c9", "Wp~Qn*HV,M", " >'7VB", "Access violation", "6B)~J", "\"&A!Ky", "}C.zAt", "TOrdinalIStringComparerD", "R`!s&g", "g%D?T", "FFixups", "(Cu&Q", "9MyJ*", "xfk#Fk", "72868]8g8k8", "z8`tG", "lCIo@", "A9$G7", ",;mV#", "TFloatType", "ZylI%", "KkV\\I", "/M+]p", "S_V.]", "z'PFL", "@.tls", "\\~b0&", "H-!TS", "TdY.Tx", "@^[YY]", ";2Y$H", "3TDictionary&", "1Cv5+m", "UhBJI", "D]\\~.", "soEnd", "TCustomAttribute", "063AY", "35+BN00", "B5_0O", "Dt%;v", "G!iGzkpS", "I^dvb", "6)616?6M6[6c6q6", "VWgE\"", "PPropInfo", "QE'51{", "FreeOnRelease", "3^Egt)r", "NumISSigKeyEntries", "2hyJ@", "#RdR^", "ddYes", "or&NE", "@V-!`", "~Jimo", "#+@+k", "bQ/W\"d", "zMr<\"kO9", ".jGTl", "*Yb%Y", "xxF!?", "/ci-5", "}}B! ", ";9EEk]", "?(?2?=?U?`?j?t?~?", "1a!0Y", "(oVWp", "&TEnumerable", "Uj|yc", "}6|,-", ">+>/>9>A>I>", "6(7k7x7", "aV!qS?", "KH'b7", "9-huK", "mI+A`d", "G79>1", "{MtrQ,", "000004b0", "TimeSeparator", "C-k?\"", "q9_g", "7Q)*W", "System.Character", "8Alx3", "U?{kS", "|6o9c'7", "1TList.TEnumerator5", "_yb(}", "Pi@*SK=", "9~)$TF^=", "`Fl1;", "`^HHe", "`q%m\\", "BTDictionary.TKeyCollection`", "YS'zb ", "XI&DI", "AIsClas", "0A`%Op", "On5azHS", "e", "W(Kq:", "}KoiM", "9/_8.", "System.Rtti", "nW2,\"0", "V^/~t5-,", "derN6", "AddRange", "l%p%,", "}?@/ea", "*TMethodImplementation.PFirstStageIntercept", "L$$^][", "QI #r", "%MieSa", " GetDeclaredImplementedInterfaces", "'i,Xq", "<'<5k", "t+f;J", "&C9&(", "0Gfpy", " qcXa", "3w=X*;", "Xoz1]]", "xreTN", ";Es,\"xF", "s?*^@[", "a{uXR", "mvPrivate", "BinaryOp", "R@iOm", "LDRb n", "USQW%", "vo(AAb", "4%[P(}/>", "L($\"SA", "&~#2NX", "_1:kw", "Ap1y_'`", "B4q$~", "uapBpjt?", "-m0G/-[", "BwEJV", "i%PGy", "283G3Z3^3m3", "D2D&_d", "InsertComponent", "^?0ye!", "1R`~d", "O10I\"", "[No(24HK", "PUnitHashEntryP:B", "{]E,D", "GetTempDir: GetTempPath failed (%u, %u)", "6rIL+", "4yXy=", "ZSX2e", "}hK7p", "hsUBg", "}pFwx", "/_, c", "aF=@=I", "r[s<)", "/]zt0", "<5gmvRf", "i\"]eR{", "[]gF].x", "PVf0f|", "TYm6xg", "wH\\,t", "**a$t", ">i#J^6", "4&5M5", "+6vq^", "siO ~", "5^\\nX", "$=I_3", "mpiTT", "r}Ct$", "EIcti", "utbp~", "}%QDI", "-vfv+", "GJ>sN", "\\>", "h]", "BZ=V}", "3%3/333P3T3u3", "%TObjectList&", "AsInteger", "I\"Qm`g", "l(!Skj", "PRTLCriticalSection", "b2p2T3n3", "r!mW^", "^k ;w", "2/2=2M2`2r2z2", ")*PzKIA", "Kr\\DS", "9,9;9K9]9w9", "h#Q5q", "@HTfA", "TList&", "*8-}b", ":lyqeJ", "9f-Lh.", ">+Cm0B", "\"!7dv.P*L&s@Cz", "y.;{KT", "oW|$k", "MK{iE", ":&:5:=:K:^:m:u:", "I-n\"dgY", "'a}=nT", "This installation was built with Inno Setup.", "/,M+O", "Q", "BTDictionary.TKeyEnumeratorp", "s!6L3", ">wmDEW", "VarFileInfo", "OxkzB", "0NpF+", "d2tww", ";);9;K;S;a;n;|;", ";46i3", "Invalid argument2Source and Destination arrays must not be the same0SpinCount out of range. Must be between 0 and %d", "AiBb'", "*nONW", "k?n/o8", " |58oi", "Odg@1j", "3g!8eVe8", "Myz?n'_q", "Pc!v8`", ":vL:w", "0WC~Z", "TEMP\\", "xENlu", "S},S[", "FreeLibrary", "(gN4H", "Value", "6W\\XYD", "L4;0g", "~iXu> W", "PY,JQ", "%[qpL[", "Iz'", "(TList.TEmptyFunc", "+H|j)", "=*\\Fz[", "B4H=k", "8d#Q..", "&PyTZb", "JMK2k", "7`@~S", "cp-is", "F2WZm", "g{CZ", "MWwg[,TVz", "O9R,@", "1(101A1O1W1e1w1", "X.L/Z", "&TCollectionNotifyEvent", "IsInstance", "~^]Y2Bq", "%$'M1", "@P`X'&", "0g(Am&", "e*;X4p", "!7HKp^", "%r`c ", "d?r]l", "h9v.B", "iDv{pi", "ZTUWVSPR", "4Aq`Z", "b#6H9R", "T:eEi", "X|J'jyc", "u\\-Q>", "G:#TC", "M5W|x/~", ".\"`O>", "6-6;6Q6i6w6", "Lzgq{A", "PA'n?", "RefType", "~W1HBH", "VpMh9R", "vw56m", "4u9]8", "kX*;i", "/ewhMAf.}8", "969L9]9q9y9", "&1Bs:6", "Disk full", "gSAdk", ";k`5x", "1e4Cc", "0}qeG", "?z45S", "[gdt4D", "frX\\,", "O?/uW", "pg}nSX", "z#$/C@", " I{a7", "w%TwD", "S:W,-\\", "-v2 ~", "aP2 [", "<\\=l=r=", "|R`o3", "UnregisterWeakMethodRef", "Z!z+x", "VHH+v", "@ zis", "*TList.TEnumerator", "4,<~v", "_]wD!", "CVd8v", "(T:uf", "gUAz;", ",cG U\\", "jedVaS", "-<5CD", "x_7X\"D", "\\.l2", "4q\"J>", "i^h[.\\8y,", "EBg@1", "\\r_IC", "ortG_7", "U2pSp", "OG4}?", "pFxw`q3", "%a{f^N+B", "A$zEH", "BSY^c", "=>CDE", "nd|c,", "1B7.<", "dwnhj6", "{P%Rj", "FaZ0=&Iy.", "|d{WQ", "\")(T/Z", "-8bhA1", "$BI&]", "pQqSi{", "=)=F=N=T=h=t=", "csgb2312", ",@Ft9 ", "GfIVf", "y*/UqA", "ONNlv", "ACount", "]afJ]kUo", "(OZn*", "&# wdE", "@3X@g0", "\\D9tVv", "^7tzE", "\\WjF;", "X1`.n", "Rp }6", "iPO a", "i7(?I", "TCustomFileT@J", "N.%E]", "Z<>'KA", "+<~ZD", "FyH\\*", "j!@L\\", "L7A?S", "O-201SN#", "H3V;,", "N", "FErrorCode", "I*S=n", "BCCPI", "6$666M6[6k6~6", "sH+jXA", "GkF~x", "mbc`z", ":\":*:2:::B:J:R:Z:b:j:r:z:", "pNPK%J", ":nyQ{", "?\"svj", "rk2FOV", "ZXABn|N", "0^k2U", "$|kGE", "pGF||fT", ".sHfj", ":UU{IQ", "? ?0?I?j?|?", "]ik$yo", "iso_8859-3:1988", "%Nc#U$", "?wcy3", "3^oo#", "S\"WtA", "EMathError4{A", "?_8s/", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8", "9#9+939;9C9K9S9[9c9k9s9", "zi}qXM?", "TInterfaceList&", "?'?5?G?X?`?n?}?", "mApb#n", "_gC|!", "3 3(3X3c3l3", " m.:`", "Xskwa", "i*7u@1", "C5'!27", "1@bY+", "F]E?I5", "meX.7", "AppVerName", "msE1/r7", "fdCreateNew", "sSIrA", "44>ED", "2D-Bn", "UQL#M", "9(9,90989@9D9H9L9P9T9X9\\9`9d9h9l9p9t9", ";,<0<4<8<<<@", "j&zhUAL", "-Mt/h", "g%,jDw", "g=6yP", "Vv5lz1tPB", "lW(d>", "d\"D$I", "/TCollectionNotifyEvent", "=6=K=Y=h=z=", "s:@lyJ", "T;$Bky", "B}zBf", ":!:8:F:]:r:", "2sBdY", "%3*pA", ":d@fE1", "}V^v*", "`9Xrp", ">|o+k", "G8]k\\", "opbKoD", "KXa*X|X", "fNdn}", "O|:+$Z7", "R$\\.#", "kp< 7%a", "`r3l1", "=w>fy!", "$Zw_w*", "EdbFT$ k", "AG[J7", " w}j.", "&~h-r3", "^)24V", "Mi;aA", "Lv8]b|", "SC%M C", "{7=bv", "VTEnumerable>'", "HRw)-", "Xl4'|{H", "X4_7S=0", "!qMq$%X", "3gEn=", "otSWord", "G4/}k", "|qdBw", ">8>B>d>t>|>", "210322000000Z", "7#717C7T7g7k7", "*!P#X", "TObjectD", "`f6p'", "RwM1F", "biv F$i", "vxoo/", "NumFileEntries", "9H9f<", "&TEnumerable", "BIZly", "TThreadList&", "eOCH0F", "qm9*.0", "bdF:[", "'E@Xq", "pyt", "1$1A1E1d1t1|1", "1AO1/", "#kq)Z", "Nu:L>@", "ContainsKey", ";^6sR", "X}mcE", ".1u&1", "JmpRel_E9", "RD%{@", "Wz0&GOq", "*iNt~", "xtaKO", "ArKs:", "&.;&CSU", "JL&L:t", "g+dW]", "pz98| ", "SKgjA", "az)b.9", "-vEfC", "tkInterface", "@?Gjx", "o%Y-7Z", "AppCopyright", "6s!x#", "? ?(?6?E?[?i?q?", "bRcJ}", "O3YiV^", "?b7D)", "4aUum", " h);H", "< <$<(<,<0<4<8<@plb@M", "4'454E4X4k4y4", "\\`$C^", "l:7bO\"_", ")3ey", "H4'*-", "\"SzP>", "A^.fz", "!6t2c", "_xu*rg", "/=!!Uv", "k'DiX", "$<6e4", "#Qcu~", "-Qoh#", "($\\:\\", "YqKS!{", "t,tWT", "#I*=R", "%J|C^", "Uho-C", "HandleXiE", "0XA<`]", "vt$3SM", "qps-ploca,ja", "},xI#K", "NTDictionary.TPairEnumerator;", "@$\"\"I", "J4.@tvvN", "Floating point overflow", " h_%/S", "G\"4y~j", "TRttiDataMember$", "$h#X;", "Z1jZ+KE", "}iDxKEC", "pPg>a", "v(H v\"", "$o8k>", ">Bqo;", "7E8Z8", "B@7d9", "=+=7=?=P=[=c=t=", "EVariantInvalidArgError<", "4gzet", "p-|M[", "4Oi;C", "Za6tA", "zxT,6,;", "N5#5U", "Bxr5F", "6{,X87", "No argument for format '%s'!'%s' is not a valid integer value '%d.%d' is not a valid timestamp", "2#212=2L2{2", ":7rS\"(", "0OJSk", "q8:{=", "e6Fkq2", ":*>#-w0", "2Ny<'?c", "P<8,|", "j:%,K", "i RY}>", "N{-S<", "aD%j[", ";PS3&", "nrbF\"", "K?5u:", "Q2.hn", "Z\"<:&:", "=#;'j", "uv0Dq", "%87xt", "vaCurrency", "5\"505:5g5", "y.Bv~", "n4T`Z)", "7.878I8U8`8*989f:q:", "pp/g}.}B>c^", "T)8`9MW", "B^>l>", "HH!bd", "f`&Gs", "FzyJkGl\"3", " hD:J", "woMg ,", ":QHSf", "zPq9,", "Hj\"pN", "?1?L?\\?`?d?l?t?x?|?", "V=<_h", "w7Cw]", " ZPqh ", "VX#*O", "F*OWJUe", "Z~K3^", "FActive", "9 r'xc", "FParamList", "]U~Pk", "?'?;?C?T?b?j?x?", "> >0>8>@>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "[cX:p", "_L0i_/", "3qX@#", "RL*0)", "E=3tTVD", "%K:wE ", "!6If\\", "+ud?F", "b9}&V", "m;cLLy", "QJ{'Npy", ".(d9#Jx<.", "O'3T%o", "3aFiwQ", "DwX]L6", "CS~+=", "[_H56", "J{(l)", "YpG%i", "){]j>", "cp1257", ".}I/%", "FUh$o]", "rXAK2", "DCn&2", "f'gK4", "EHeapException,", "y#?%B", "r!N9_", "@&q6'", ";\\<`>(", "v4N+5", "{?qYG", "pfReference", "DG9g/", "tE:qw", "bn'P9", "]0f wq", "?yb#$@", "f:oc.", "jd8CF|", "AConstant", "aiO:|", "0<#eC", ":@\"(h", "l6B$>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>", "v:l'\\", "9zjcK", "9&yRRV", "8mT3x", "}%Lb4_", "XXKv{", "UL&F1=2", "13HDu", "#{M+ctK.6k", "XLC_T*p", ".TArray>", "First", "Fof+#TD(", "=k5^#w", "csshiftjis", "px*Nj", "TBoundArray", "~0_t)", "@HDVP", "]zA{(Z", "6K(0?", "wm<]xs", "]}I?2n", "BX@Dq", " i9*s", "u/g%=JM", "kOc7L{", "uB+)?", "fY>_.", "m#N?]", "fi!#o", "aXjn:", "TTypeData", ":,:@:S:b:t:", "e|5JB", "$+DN3", "P+]VW", ".Y)KW", "aEMYda", "ZKS{,", "C#Hlk", "4nO/w", "tqK;':", "1 1$1(1,1014181<1@1D1H1L1P1T1b1j1|1", "DY[iY3", "ELaOS", "iso_8859-16", "vJ@|hs7", "+9D{p", "zwKj-", "UCmJM", "*mtK:F", "^jb,(", "?mAdz", "gl}&z", "2 2$2(2,2024282<2@2D2H2L2P2T2a2r2", "rvy?(", "uI5s\\)LGXr", ":SW9jw", "_N~rE", "-F!>`", "k^/k42", "x!}X2", "I]oKLBz", "KH4{v?SM", "}OI8m&_", "/>~gz", "VString", "xO(lEZ", "Expand", "#;\"~b", "[?2>7", "'D]h#u[K", "'S/8m", "@1B*qvl$", "xVR.l+", "HENhQ", ":Shared.CommonFunc", "-0Un[", "Ybb['", "-M2hH(5", "in2o=", "l(k~E)", "%Rw['D", "0.yk0", "A-Q_p", "*YL|!Q", "97*)HF", "/0:0A", "Fd=>Xb", "q4nEw", "F2}sP", "T7m2w3@", "\\}PYLj", "0\"R(686", "<;tA}", ">ilr{", "jV@@*", "D!S0kG", "@{zwJ", "38Kn?", "UhurF", "WakeConditionVariable", "}5R&25", "5GCULe", "H=~QY", "(51)q-", "ou\\a@K5o", "U73Sy", " wa4b", "FindComponent", ",T#\\|)nS", "@JN,QO", "\"G?cy", "]\\h;8/", "/f0&5", "x`,oS%/.2", "Parent, D", "DOE7d", "mg.~2", "qQU3<", "/!Qx'", ";]E5m:", "OYxA+_", "Bytes", "`Jwa6", "~DAJR", "vy#Ny*;]8j", ")'%:y", "VSjSEh", "%/\"/X", "EInvocationError", "UQp`!", "]Q(UR", "@gX7p", "PDGpn", "6vR%^@F", "6s5g*~3", "o/E_C\\", "'?.NO", "FFreeNotifies", "InNr+", "TypeCount", "G\\LBV", "xO#%b", "f%OWq+", "85+03T", "zn^d6", "d8I`_", "QHU1]", "_x>g&Y)=", " TList&", "6l4/ ", "9<9L9T9\\9d9h9l9p9t9x9|9", "%Kk`o", "29nW:M", "FY5LE", "V2;P8", "cmZip", "[e\\N.", "T?B\"[", "dn,(:", "A]g$[", "iKJ*Hl", "H8 ]&", "vOfPu", "z`jRc", "biw+_", "Rj$B]U;", "WUI[*", "Z/i+g", "SVWQf", "4hb} ", ":d#E*i", "@K]W?,v", "qguxpz", "0#%*,", "haAu+", ")zs#uK", "E}DKA", "DIpT,", "GM;#({", "D&9&\"l\"Z", "kE=;$", "&o*xNZ", "&TRDK", "cUou'", "*XsGJ", "n\\Y\\w", "5e~1C", "WVV>2", "cT(Bh ", "ParamList", ".h# }", "E\"Lr1sUf", ":A_K,-", "zP;HK", "-#231", "UalNMS", "EVariantArrayCreateError", "+,,Gs", "Nf>;[<", "\"/!r|", "+Rrnm&KpDP;", "FreeInstance", "TVarRecord", "2+2<2J2R2`2n2", "%gD\"(", "5 5$5(50585<5@5D5H5L5P5T5X5\\5`5d5h5l5y5", "5\"yl]", "?9`aL", "/<)`g", "G7!:;", "x}(\"U", "c0g0k0o0s0w0{0", "Ih9]f", "[VBeo3", ")TOq:", "<#", "MTEnumerable>", "SD1_C", "HQb0;", "U)x,6b", ".~~cl", "!_])P", "TRttiPointerType", "4,4>4c4k4", "t-gW}", "eHf8J3Y", "QIL}Q", "pT9+i", "CurrentMajorVersionNumber", "B0*L[", "T$E> w=c7$", "Y.yrF", "(+'v|)qg", "7Xn vq", "x0Ji2~*+", "%DPW*X", "FHeapSize", "X;yw2", "vf1:4S3$", "qljhR!", "iu-Cans-CA", "TEnumerator", "R+PA\\", "|Q3V!", "0|`zY", "jua[ME", "&)(F}", "gk_|/J", "]kVCU", "&EA*d", "o:AfZz", "-n&/T", "%H7{S", "U-lcPe", "m.I<0+\"*", "m6amk9)", "2C#,8", "_q01Xplut", "f}P7C", ",[]DbX", "kr@i@", "~,P:(", "VR||&", "&8V!Q", "Zf=>A ", "cP#Gu3", "lM4P\"", "[=TkzXd|]@", "q$q?J", "2 2(2024282<2@2D2H2L2P2T2X2\\2`2d2l2", "}^OPsS\"", "|zJ0N\\", "vm~;]", "mkSafeFunction", "i6v)8", "_{V5dH", "/m.]*", "%TEnumerator", "^&''YZZ\"", ".4:i4I9", "1 1+161A1k1v1", "9']%qLj", "AsInt64", "$rEhq99", "FVTpr", "TStreamCapability", "828z9", "V*jA}", "\"0wKh", "QM|QG", "^=Tz}", "wLSa;R", "Qh(wB", "^$.b;", "~=GFA", "rnK%N", "t)W#0", "IOffset", "Q,HUo5S[", "ReadSingle", "7C*|i*", "W|fay", "1n=Y+", ";\"P\\H>Z", "0Ch#-", "D\\p[?z", "*$\\x6", "BeY\"&", "=(=6=H=e=s=", "[%N~j", "thb4P", "ACo&a", "~][vU", "S>-`g", ",KPvw", "utf-16be", "cMPGp", "4'4?4G4O4W4_4g4o4w4", "|mp]\"", "u$Qkd~J", "^o@^AWV", "FOnFindMethodName", "%qP]H", "KQc#=^", "tkChar", "TryEnter", "vaDate", "&S8So", "DW*By)", "-&_#y!", "1?\\b\\2", "qHN4E", "_k,[w", "i% !T", "r,.ON", "(A;OICI;", "wKb`g", "38lM'", "\"t!35y!e", "b@2*,", "jIg8.a", "y`cv:", "IdH%V3", "d9/r%?I", "j|mu|", "?|4a,b", "9MuwY", "x[Pn2", "&op_UnaryPlus", "|Winapi.Windows.PkgHelper", ">GKXH", "NpF;NW?", "u42g1", "-r0/c&", "ZK4?#!", "S}6P,", "*P#N.b", "hcKc$", "oKarF", "C&[Zi", "7,7;7]7|7", "505b5f5t5", "2D81:", ")sxAE", "SAT4c", "i.Dbb", "ppJ{O37)", "0,1G1k1", "U6DWf+", "2$242:2J2]2k2z2", "9*989N9c9q9", "3rr;[\"$,U", "=m0*,RW", ")XPRc", "j=!B!$0", ")vGyL", "cbj|rp?]", "<=a0Y/", ":_De)}", "7/7:7\\7", "\\Y>zT", " Bx@)", "d-q>R57", "V$T?J3", "5S*~1", "324R4i4", "DS3$M#", ":$2iB", "ZT?\"&", "tlR'i", "DTDictionary.TValueCollection;", "l/C^:", "Puqa8", "CTDictionary.TPairEnumerator<", "x+1gW", "\\bzk'SH", "BHl~q", "FromOrdinal", "Cr\"<0o2", "QQGH-", "aaaaa", "~sJz i2g", ")i,Ip", "d)\\pcd", "!],b8", "}B|Mxe9J", "F41v^Da", "py&~i", "S33'P(", "_54%G", "rS(6/}\"n", "VhL' ", "x@a@n", "6+^9J", "f8jgx,", "O~XvbA", "/>=V*", "W>RNr", "ni&U5", " ", "l!cok", "QF!x%G", "2I5N\">", "HC;O:wJW", "LN0yjZ", "&0gMHEY@'", "838H8^8u8", "626=6B6R6]6b6r6}6", "E,u^TA", "y0g!B", "8wr O^", "SetEvent", "`/;", "?1*T?", "'o5&c", "f#@5?,=u", "yVE-L", "8xoZt", "y~(L@", "4_X(&Q", "UhqIH", "ReturnType", "2\"2)2@2D2H2c2g2k2", "a1@a8N", "3\"383I3^3l3", "+\"VjU", "~mq9/", "HfCfx*", "oOFFA", "@Dr2V", "CurrentBuild", "FAsSingle", "/1y@[", "[hkQN%", "kyREk", "Ap%0j", "1MDL9R", "yinYx", "$Z*4*", "&RYi%", "?D=gK", "7$5'D ", "{op?y", "H#Wa-", "W`I6i", "LQSQ~ay", "H1bIE", "Invalid property path", "iso-8859-8", "_-l", "WizardSmallImageBackColor", "L<\\0[", "&O", "Xa[$4JH", "7b7o7", "user32.dll", "h d#m", "]XpQCU", "Jd;Pk", "B]p,b", ";+;B;W;e;t;", "{cY)0", "dUwJQ", "BxC(]", "iYz3F", "FW{E[T", "yiO-*2", "t+eR~k", "vWFh0@+D", "`>g>", "j])vn", ".Bj/[|", "!UHGy", "iso-2022-jp", "2-IE<", ";(;6;J;W;_;m;", "Extended", "^B9`l", "`tCqT`tb", "G}K1#", "`; \"LC", "8vXqy", "7{xtz", "}d{e/1+", "bOP\\Y", ":$:,:4:I:W:_:p:", "'Dsu)", ",!Hm$l>r", "k;zWZl", "%VlA;#", "EkMc `", "*2\\8U", "jU=V.", "\\BtE+", "%'_)]I5`*", "N}AC?", "DeleteFileW", "!=0=p0", "&vG&3", "W[&Y9", "/un,6r\\", "uxK+N", "[,UxP", "Oy+uV", ",SzUf", "dU", "/DIR=\"x:\\dirname\"", "nktR(", "J=@2!", "gl\\jz ", "0Lh*M", "ULNrBq", "Uh5:J", "E%1g#)y>", "(}qahk", "/Am~{KUU", "uuSa-", "1%\"*-'iz", "H_{AQ", "Q15a#", "r`hiQ", "!W|(-s", "8T!ubf", "Leg/Y", "[,4.Dl", "UInt64", "K8L2l", "i/,M#", "ibm863", "Xee-j", ";1K3<", "'Sectigo Public Time Stamping Signer R36", "`(D2]", "yZzWM", "d9rb$", "?[jL1J", "s'^|n", "Shared.SetupEntFunc\"Compression.LZMA1SmallDecompressor", "N07H+", "hBAD*", "W;Xkv\"", ",_I]H", "t7$4(", "FSR.Sd", "kUqB5", "[Xm6E^", "au\\;Z", "B9KcL", " z!1D", "DesignInfo", "E}]C#`h", "[c|9Q", "qe9%Ii", "X^#C8", "A8RJ6", "m;/O+", "`E.bl", "b =Bh", "TEnumerable", "DY8qND", "H/;&Ko", "0dK+k", "&@rdB", "14s$^", "<1JYaa", "5j5Rg", "FuS6Hu", "O4&X%A", "mZujb", "Uninstall Tool ", "47J`l", "R]c 95", "File I/O error %d", "~G}R?", "2grbB", "6Pb1.S.ParrayofT", "'N*|V>", ";Qa+", "i'", "lB;`b", "nFJ6`", "4F(aZuJ", "ecWmWvv!e", "Nh!x8v", "emFB?X", "o7N$l", "?)dE?c&", "y)J+[", "nN{67", "+Bjc?", "?T:mz@", "uABEf", "4&4.464>4F4N4V4^4f4n4", "wVd4!", "}=[hm", "z98_r", "&!|39", "ACapacity", ";K;u;", "B\"z.i}KRJ", "ok'V<", "7#747A7I7Z7i7q7", " [S@Mv", "V[K$I/", "E:t6Ok", ">hTD", "-`RVE", "Nbf74d", "I9>ueq", "QMBC(", "(f> b", "^5DVV2t", "f$t2:", "w E*}!@", "cgki`", "ci`Z ", "uEd_i;", "@u*1`Iu", "TotalElementCount", "MH)Xe", "t", "B%BPJ", ".J}a+", "ZIzS,", "K8e5c", "%LazyLoadAttributes.MakeClosure$ActRec", "}E))=~", "sTfPc5", "e|Fl#", "lu)ztJX", "$7SyeIN", "=1XH+}", "vaWString", "+Gbfp", "<&&-tg", "F7O,1", "iHcT%", ":]@:a", "_c#sj", ",&N4]@", "\\aJVj@", ")(hFv", ";P'fq", "`~kW]", "V,hHi", "5d3jP'", " mGFL", "ZmTb<", ":Ni98", ",UzZ#", "gIq#!", "qL=5s8", "l)F2:", "8bvBY", "g>+V+", "oTIE]", "\"igB$j", "[@\\E^l", "wNN=!", "fQ/fN", "FActiveClass", "pfConst", "cnDeleting", "u2$GC", "lWm|e", "J5`U/b", "V0FwG7p", "+fmRV", "coz~> 4t", "M\\pMz(Z", "$IComparer", " ", "R?PHv", "@gumMx", "2V3m3", "_od#:.", "]aQ)mrU", "LYRRut8", "InitObservers$1$Intf", "2tX{]", "2.`I).", "uW7xp", "jvUJR", "=il7}", "&op_GreaterThan", "Uh:EF", "kXDyDG", "'_9I;", "XYyBu", "q~n?A", "_UZVE", "emRK%", "\\CxP!", "OnFindComponentInstance", "?ER?<", "VPA}9K", "uBI[f(", "%&N<3", ",r>Bc", "PTypeInfo", "YI-6[B", ",TEnumerator,", "/U%}0", "H) grl", "u6`):c", "979;9B9W9m9", "G67Z.", ";^O8C", "z7Sn)P", "\"%{-gyY", "SetupLdrAndSetup.XPTheme", "e*i}pF62", "'CMg?6", "R<'\"1u/", "Ujg$3An", "GY&|?", "v,S_Gd", "55Bbt", "w-AN>", "0TList.ParrayofT", "uh{ob", "M{C _)?", "csibm861", "k1AZ`", "eNs:IE", "4U>|F", ":M03=", "4dxH", "MaxClassesInCache", "$uN#7", "Setup", "ibm860", "d_rwK", ".&.17w", "dgWf5]", "o$J\\&", "860o>", "=0K2R6", "ListP", "tUDQ1q", "c3HR6", "V/2'6O", "wj;D\\", "CharCount", "(S_^w1", "9.959U9l9", "n^oA`E", "!aJYY", "O$|#M", "CO)7l", ")3jO~^y", "n|>}ED`~C", "=#=G=K=n=", "^:1E<", ".oGZ6", "=}j<;q", "?YF~a", "\\r\"oM", "tzA[[", "n ZT2u", ")!\\~Xp0Z]P", "\\7xwK", "l3V._", ";]+YvQ(", "KoE:2ilE", "5\\66[", "]K3,i", "5yARA", "QSlM[", "Qek}D", ")w4Wj", "[tKu5", "walq$", "jjjjj", ".v>^R", "J\\5W9N.", "dkMessage", "==P!~", "vTjfS", "3#ELB2", "9IwoEt", "CZ]/\\", "/_k\\A", "<$o>X\"c", "=4>^>", "k2QsB:e7:", "'>O[y", "We5sb", "9\"9*Q", "]0A[2t", "[(u]raBq/", "(@XhTi9R?", "p)f/3", "gi,jey", "V%Vd,HsD", "h3mW0", "FAsObject", "6 6$6(6,60646T6o6s6", "Ii-!{", "505@5H5P5X5\\5`5d5h5l5p5t5x5|5", "Params", "!D^IO", "5)+]s+", "5-5;5Q5f5t5", "(p/xa", "hF,oH9e2", "S0_^[YY]", "}|,]=r", "'@#r5l", "xL-bf", "61cjD", "^^n:$f;$", "DialogFontBaseScaleWidth", "E%`KNF", "p,c\"O", "ae6e/", "-wD#*", "FSize", "'s+'x", "csibm869", " <}/N", "Um_UR", "<1v", "2/5Lm", " 5-{|", "Ki1@X", "7a-eF", "IsValidLocale", "H=m~)", "CA|\\^", "l(-Pu", "M[\\$i", "!e=*3", "5$656]6n6", "qa`aE", "JB5V Q", "ls}8 ", "rUZ|V", ";4Pct(<'", "", "~.#N$", "g$%6p", "N5jNXk", ">$=Rce_", "4#4'4+4/43474;4?4y4", "AIntf", "q>PXj* ", "&!jT#5", "F&Zs3", "q&lRU", ":TReader.:1", "F6Yb+", "`v:S>{|", "ll#y'/", " = function", "PHj(9}M", "Vgpkh", "^4Rn'", "doOwnsValues", "o|R^w[", "eCQT4", ">/?3?Z?d?", "n/VpF", "(hy#o7", "$Fv=-", "+X4ys", "\\M\"\"0", "/TList.TEmptyFunc", "g7gNW", "dYdXG?L", "Q*lu^", "\"=Qx_", "NumIniEntries", "G{uqpZo", "CastToVarRec", "IzsA;^s+", "vIjy>W", "5Om o", ">", "kl0ci", "t2-c/", "646w6U7c7q7", "TQg0|", "VlMl1", "Nroa4i", "LEp)A", "*ios`", "Os;kf", "ey/S(", "9{-Ra", "Uh9eF", "*MmN\\9", "/AU0o~", "<)7E[O", "{C[z#", ".MrWH", "iH|P/k", "Z@s>u", "ECvoX", "ReadCurrency", "FSy^>#", "_\"+l;", "Invalid argument to time encode", "*WI$^", ".wi0Fm", "Rni($", "'UQhF", "t+}i2", "!w4,F", "*N}]x", "/FORCECLOSEAPPLICATIONS, /FORCENOCLOSEAPPLICATIONS", "uJ 4s}%", "U>4b&", "7I1E-", "fe$ST", "@@%u1", "4T}wN", "<08ZP", "XnDb\\U", "=2=@=X=g=o=", "wa-tn", "Invalid access$Error creating variant or safe array)Variant or safe array index out of bounds", "List$(D", "$tc Z", "b0N", "paU, ", "..LT|", "a1*W@", "CheckTokenMembership", "sr-Latn-RS", "WI\"Y^i", "|H2ZFx", "rj`*5", "2_XUM.", "tM57.", "|#Nk'}", "U%b>G", "4_)F@", "M>C8j", "U=e1Pi", "Jt+A)", "$W7`/u", "84(zE", "t--$3", "!;OFw{\"", "E|TcV", "HLN2Y0", "H$1TC>:", "iso_8859-14:1998", "fjo>loH", "tl>1tF", "8=-#.!", "PVmtMethodExEntry", "^j: {k", "G-Ui=Or", "G|H:B+", "sMp[I", "d'K%V", "MZo[m", "[+AYquA[hN<", "poY8`", "9 M]>", "&hx%C", "iI~]{z--", "Q*}3Tt", "0;6Rr", "ReadData", "Equals", "so@j}C", "[-6SD", "gJTNmN", "f)g7.", "GetDiskFreeSpaceW", "z^&nRZ", "Dq=ZB", "J!32!O!T", "E!x_}", "h8T!l", "/\">AQ", "kMa%8", "m%MH,", "1MFv!", "Y<:ll", "I!sq:p", "7\\8a8", "B2dWj", "!ejb_2p", "[x<^g", "-%wsE", "v__Rv", "\\|[!=x", "Hh\"~F", "P$NK__n", "@PZ;x", ")TList&", "u_F,j", "DFa!C", "VK*xL", "i8@Ya{", "ToString", "}~#je", "}PN>w", "Ly}7b", "gns7_", "laDestUnique", "L?o0p", "`db5r", "}-+1{", "[X3c_", "]M3gWx", "uD:k*TQ", "=3=I=^=l=", ">x.l`z", "os&(.Y", "FBufSize", "~)%ks", "\\<'<4(?rW", "r)__?z\\xX", "jKc%y", "TMethodImplementationp", "Windows Server 2008", "LpAYEAt@", "!y}?#", "656<6C6J6Q6X6_6v6z6~6", "5N:?I", "`nW+|", "[J#A}", "k-e2TN", "M?4}7d[", "MXr)*", "LOg.5H", "LN1\\j", "TRttiProcedureTypeQ", "+$>7|", "|6:&a", "KZL:n", "'c;02A", "ZO4ddar", "!RvM7", "?N7l[aH", "windows-1250", "0w3G-7]a", "Ko61>'N", " >m:O", "mj5D5", "s^>FZg", "4G%Vw", "tTI4c", "Negate", "q.z.Sf5", "%vKYk", "(\"LA%", "Xu?)eL ", "y;|p2", ")If6x", "T$L#D$P#T$TRP", "2M==S", "N.nw7", "TSynchroObject", "#&@o%", "\\m]qV", "AOwnsObjects", "\"9N%=1", "'br''", "|Xkn4", "8F8dtod", "AAccess", "dmyD}", "AWox{af", "^3SG'", "f6#-u", "UnhandledExceptionFilter", "*4Sw}I0", "/Vp{j", "#nmKw", "'Wz=n_", "Co.!,", "3jYY)", "TRttiPackage'", "%*J=]", "*R3)s", "25292W2[2v2z2", "TThreadLocalCounter'", "m{?4@", "NZl-i]", "!JH\\f", "q{)>u", "MjsaezL", "B.(9Lt", "{m4-?!", "B+rS4^", "r@Uhk", "FStatus", "wR:D>/", "<'c;", "0m;pk", "o@U+}%f", "ezOH>b", "/y=Rf", "OfI+L", ":@DBw", "dXLYN", "^y1g09>:", "IEnumerable", "z]_ZL", "Sh?rfG", "g>vo.L", "2#282X2f2w2", "=\\>l>t>|>", "p8h[u", "fZB$W", "il\"\\e", "BeginInvoke", "{B;.TValueEnumerator", "{N\\\\b", "?PUH{", "WU|UEm", "mwd']", "g-v%oTR", "FromDays", "InstanceRoot", "H2(/7", "TInterfaceListL", "ckHc[Ma", "ML\\)r$", "LCMapStringW", "ShowLanguageDialog", "(Uninstall Tool Setu", "((8'Mt|J", "3Jzm#v", "NTDictionary.TPairEnumerator", "\\1.$\\", "9DH{}.", "W:Y6k", "Y1#ca", "xYvJZ2@", "PAC?J", "NIxBW", "k8N\\S", ")/]&3", "iso_8859-1:1987", "aElVz", "p'};I", "zeY2}", "RDce4", "o3LNXo", "dx#b/", "n{7j&", "CMH\\vY", "iso8859-9", "4(484@4H4P4T4X4\\4`4d4h4l4p4t4x4|4", "X@h-Y", "G@MJ.", "_Eq's", "P}L=G9", "7 777E7U7h7{7", "+w'R.", "]XH>3", "<\"<&)g|", "^QBZM", "NumberParameters", "FromEnd", "J{Yep", "|q1e.", "?sn\"!u", "7!7J8P8p8", "d@$@B@", ">l>}>", "*W}dX", "]", "Uhs1I", "4.t2?", "???N?V?h?", "OmA|\"", "%L?py", "9;{zJ\\", "D/^h:", "a';,C/X`", "o9=<;Rpli\\", "H7R]U9g", "Z(t~S[", "Mz8Dg-", "EClassNotFound", "An unexpected memory leak has occurred. ", "PushVal", "c\\J$y", ">xf]-", "OKt'>z", "&C)'Qw", "b7c'J", "VoQ59", "x]md*", "g}}\"mk", ".gs X", "uh2en", "f#)H{", "QuKZ2", "k>0XA", "pX'^1P", "rM", "?4p\\>", "3AuR]", "/3;;k", "Pl`8s6`q1e", "2?2G2d2", "9z~LG", "HasParent", "BZkwa)", "/&]LN", "tGo$,", "w2&K?", "FGr0`", "-Yi}@", "y\"2tl", ";J&%(Gk3I", "^3dQM(;", ":!:0:C:I:W:[:j:}:", "ZVF{\\", "TTimeSpan", "DJbM\\", "ftSingle", ")42rh", "Ox*K&L", "#pjf|/", "TCustomComparer", "l&+*h#", ">r&Ih", "Qsds_", "TRttiType3", "9(9<9T9o9", "KTDictionary.TValueEnumerator", "VarNot", "VarType", "8-8=8", "H1(w3", "xJkr0'>y", "yR.o32", "WriteDate", "h~8=Y", ";h(Ag)1j", "y\\l4SK", ";0;G;Z;s;", "7Nb??", "A}kg$", "|9R^G", "TSeekOrigin", "xe{U5'", "?{^y\\", "MF+9$", "/VY`Ow~", "#`?(CG)W", "\\VzB{", "<&=;=I=[=j=r=", "Z((.z", "hCF`C", "_Zcut", "UhIlF", "vaIdent", "UCN,P", ";+;3;D;b;f;", "tW.f?", ".TKeyCollection`", "35zjI1", ",=aB|", "%TEnumerable", "_My`4", " |*iEO", "5F-.7", "DialogFontName", "r~o|7\"", ",g9\"tB6Kvwp{R", "Z,VqC~", "isy%V", "9 9$9(9,9D9`9l9p9t9x9", "qO$('", "3KNa-", "/t-_O", "d*&f7/@", "?+?z?", "u x+a", "O`g\"s\\", ";5^Z9", "Bcm/o", ">ld1XpXA", "D{Z{Q", "Windows Server 2003", "xLX&9", "JR$3s", "SaveToStream", "&geJn", "]\"|AW", "5sA;6~N", "ER,6O", ")uddc", "vR5@r4", "TRttiDynamicArrayTypeD", "!eCtX", "6)676H6{6", "{?$B~", "_k[@xj", "avQ1~s\"", "f]rOb^e", "iso8859-11", "Dk6,M0T", "", "WRCe'", "Sd&'o4", "%*y3yo", "t0L?q", "LRN'P", "e=!unDn", "3%3-353=3[3w3", "7-`9Z!", "nLZCt", "Y~zu%F", "ul6Twx2", "Qk?cR:y", "=Hk\\;", "B6OWYJ", "\\`?a?P", "].5:\\", "nNb+n", "Gg_Hn~^", "D$5+v", "_q'@o^", "Gm-%D", "4/ah+", "cN!h5", "=26]XE", "DmY<4&", "SQB!u", "0TArray>", "AINFNAN", "#;(@)>^", "=r~$+", "1,%bH", "1; -4", "%59)$J+", "(_P{Y]", "9x+20", "/HELP", "a-)>a", "1#E#!{Wb7", "XB_W@", "fsZero", "5dkWl", "Kfa3g", "Q+<", "[d b5", "i5#47", "d7'3f", "rpSH9V\"&", "x0?0?rp", "}]09/", "8V5D[", "b?O&<", "SPk-3c", "+A$uM", ";t/d3", "4TList.TEmptyFunc", "u$lpm", "&y~>:", "FatalException", "g7m~}", "3p\\`4CJ", "\"{{s+E1", "R]>bW_", "+Iml7", "QFly9N^", "aa]9dn", ":^'&x", "&a$U(", "2nz!V", "$.)WB", "5@r+l", "1:dSo", "8D8d8", "ZIXg ", "svZB?", "JW}Co", "2K#~", "=TList.TEmptyFunc", ")*ksi", "IPL<1%Q", "?u=ND", "sxk&m", "s/7IH", "L/T|jx", "pfOut", "!EsK!", "@'`xD", "~t&LO", "q\\qRhft", "G%lYj0", "313<3D3l3w3", "Q-I{O", "Pointer", "{nE6Y", "6I2z4", "m?BL/", "&TThreadList", "4l;)ih", "v:Z%B", "$!+2N", "E\"zsh", "=ZT6.>", "bAj~%", "-^:GOYFu", "tytL9s", "]6'g|", "Q,KB(", "I}O71~:", "System.Variants", "3eA#i", "r2[wV", "b<7ah", "8*87,", ">l|}Z'", "0B0c]j", "'_Wa9S", "0tKUL", "-;9qg", "|etcC", "nwLdnJ", "-!&/@", "8Y!KX", "=wbHt", "o!uq1O", "*UU,T", "_jzXz", "-uJgx,JF", "S^t L_", "MIMEName", "v:u7{L", "la+r:", "9:w", "C$DD):", "\"bii6[OF", "@.reloc", ")XwA}", "#DRYRq", "wOFa=", "gHqs4~I*", "TRttiStringTypep", "c8?{tU\"", "ds\"`_", "l&9o\\", "Priority", "\"&[/7'{", "FStackInfo", "Jlh[D", "RootAncestorH", "@p?DE", "t>1UV", "`>7I(P", " Zv@Iu", "8z3m2", "8'8/8M8m8~8", "%|2]H!", "n$n#1V", "CYC[A", "s(@ \"", "(6\"U<6I", "1[vp|/4", "i}t|V", "XkaVZ", "~;K=}]", "VL)3[bED", "DisposeOf", "TRQN?", "@cA5d8&G", "Z{)oV", ":9cSF", "tS:c=", "opaque_Probs", "W[9ng", "aLCNR", "oT3jA&", "F$mARd", "BG`XU", "~r7JH", "WriteInteger", "TDictionaryOwnership", "dvqV=", "wEy3#", "w#Erx8", "?b6mt", "cp936", "%EcSRLX", "30343;3N3b3w3", "yLQRv", "L%*[x", " ,JeM", "b7J5{", "/*bq.", "8,U+(", "m~q^*M", "UnitName", " wdDa%", "EraStart", "k9i89 ", "HW(~G", "osFNbvH", "Ft&Ufy", "T9lwst", "!/VXb7K", "uMm|]5v", "l`A!N", ".~4Dy", "aV(*/", "1v?^n", "FMethods", "pPB}8", "Invalid code pageNNo mapping for the Unicode character exists in the target multi-byte code page", "Vqku3", "q4`@&", "M^zdj>", "/P8zQ", "K2Oq?", "5K6`6n6", "4l5}5", "9'9h|", "3? 66", "!balO", "=Ko66/", "\\VDNM", "4)4;4I4Z4n4", "b,}TB", "f/ tk", "'Z[$ii", "q=0IHE", "Yse$j4", "OnCreateComponent", "-tK+v", "VS@X@", "9(989<9@9H9P9T9X9\\9`9d9h9l9p9t9x9|9", "T_$!#", "6x'I$", ";$;3;;;I;\\;k;s;", "Lze`$", ">f82G", "hE&@?O", "CrystalBit Solutions0", "EN|/:", "]}^cg", "Uc~E%", "{Z.Pi", "ACollection", "U'^C#", "3`g8J", "BV?", "ifdk-", "O^5f-", "TRegGroup", "LaRgT", "(}&Y8", "I ]iw", "F=dL?", ";&;=;R;`;w;", "S.>oL", "i3[{*", "#TEnumerator(", "AdvLnc", ">_s_\\&N", "X-Peg", "List count out of bounds (%d)", "*ep r", "rEl]`|", "HdU3U", "?nK\\O'", "&,=_msTS", "LI/5(", "~VnP=F", "4&484J4\\4q4", "A}s$;(", "1 1$111H1]1e1", "E\"ko$", "MSFknU", "6A7z+", ",L1O$>", "AQxW=", " |h@@", "eTQ#o", "zYU=_", "#JTgL", "x}D>V", "]|Jew", "}[p0#vgc", ".d", ">0>A>M>~>", "2(282@2H2P2T2X2\\2`2d2h2l2p2t2x2|2", "bR+(N1Okf", "[NeSJU^{", "Reset", "i]T%qiA", "XCYbvE", "sh|iu", "TInstItem", "d{o-y", "FHCt", "D`e@7PQ@", "-Y;>!", "9$9(9,9094989<9@9D9H9L9P9T9X9x9", "oKKf7", "5g1-N$", "=,|rKW", "'0p:;", "KJ#K|", "j3,$3*", "dw8|(.", "J:J.;\\", "?{uc?", "34934", "/R#u@5", "7KgGr", "q*8Dk", "q!LR(c", "SetupLdr", "M-jrT", "e&%9$", "?9?s?", "Ob2]5", ";http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#", "[GexGo", "RegisterClass", "l'&<4", "ngu8c", "8?\\yk", "QTy:E", "#*G:K..", "dk}wu", "r[QUA", "m+<8q", "oG_>>7", "1|b$v", "r<=VB", "[NN|9", "=3L1'", "~v0'<", "tW5DiZ", "\"RFRH", "<'<<k wt", "5(50585@5D5H5L5P5T5X5\\5`5d5h5l5p5t5", "-JzOn", "4dsP9", ";0;@;H;P;X;\\;`;d;h;l;p;t;x;|;", "Ik7w&*5<$", "oo/l?", "7VxIk", ":iy&=", "OTAwvX", "TF2E\\", "j0j71", "//y_\"X!", "<%<-<5<=1E1L1S1Z1a1x1|1", "Z(r`M`y", "RTEG[#M", ";nvlP", "}r&w+lF", "XjT^(", "515R5y5", ":", "Mf&1]", "IComparer", "`sa#4", "Rc(E;", "8FJ!,", "&H^Aq", "6\\*o*\\", "9A%wr", "HQh5yU", "lb$W>", "+:Te=", "o[0lY7", "gGvmH", "BestGroup", "K0Pq6 ", "`EJT{", "'Cwr'", "H>2I-", "MK`_f", "A%+C{", "x@1J!?", "&G'I?", "B\"[/s", "{YMTz", "JPY:0", "73<1(b'", "ZfU]3", "3NJq`%", "&Eru3", "jNUGH", "%c$T ", "zit(l", "t+]9Ss", "EraName", "EMmADg", "qt$K$", "CY,!1", "\\1CA\"6", "$TEnumerable", ")IComparer", "3WxVG", "+TList.TEmptyFunc", "nEA+bj", "XzQSZvn", "s^fEf", "\"y_X)", "~=kuy5", "Fu6/.", "n'AeW", "4\"444K4Y4i4{4", "e6fx>", "Z#fW#", "2J4#e", "iso-8859-10", ">M!sb", "TypeRef", "R(|>}", "9TObjectDictionaryM", "E8$%\\", "%oO~/", "C\\?.v", "mE`M_B?=", "bw&1}", "]l5yK", "Wc'EH", ":0;S;^;", "VdRc*", "A_bOLY", "@Du,#)7^", "MaxLength", "6Z^uSRt", "G0]_^[", "EInvalidOp", "FStateAndSpin", "_$b{]", "lZAs$", ";.tH=", "B7~Tcs<", "7I:]Nv'", "o,,jj", "F;UI\\", "'u!JA", "`2I(K", "Tskd~", "yz66}F", "[W\"Z=", "xjmgk$wo", "FL_Sx(", "U*Cc&@", "SjLE[", "Kx}w@", "@E=1E", "\\F'WZ", "WaitAll", "TuSmRr", "TVarArrayBoundArray", "<`cn2", "p,p{4?", "z.%),", "CTDictionary.TPairEnumerator;", "D3++B", "_<~>w", "PX%C2y", "^$W`[Z;,", ",Y1$e", "L]_^[", "w)Fkm", " {[sM+", "I%7;04|", "(T3C!", "^UP?pP", "%Z1{n", "0ga 8", "9\"9&9*9E9M9e9i9", "F@^T/#", "-%W,X", "Y L&6", "%TEnumerator(", "N5<'}}", "lnj#Lt:", "-^26[", "FOwnerships", ";E^L%", "xUk^P", ")Bm@w", "O<~EG", "90p0{0", "pZ8rB", "#OFK.", "elmbC", "[3>}=", "FMBToWCharFlags", "6saV]H", "!BNUp", "[]EK%", "-T?J~", "FWriteSignal", ".TqXu*", "==DBAV", "5!\"pZ)", " vzbE", "OWgK7", "Q%X-q", "dc\"kq", "gJmK{", "OB%}s", "IVt\\=", "4/^TDictionary&", "gUs'#", "KA69'", "3", "DirExistsWarning", "P,Q_,", "iso_8859-1", "_Reserved1", "Bx:/O", "Botmf", "Queue", "|Mh(V", "sDI*:", "tXsG.L", "+x#M7", "Npw#Jz", "TOrdinalIStringComparer", "l?,e>", "LocalAlloc", "TListSortCompareFunc", ")%;14", "q Zf7", "JpHh^H", "$wn;i", "3apR&", "dZ0=dc", "9TDictionary.TKeyCollection;", ":JoSm", "awO8f.", ">*,DR", "\"GIocQei", "5\"(_$", ".I\\'?f", "TMemoryStream", "z}XHw", "_j,haEw", "Np,ID7", " )kH'", ";*r0Nq", "&?!/p", "]Vj(A", "u1U[N", "*TDictionary&", "g.8X4", "cKhM#", "hP d]", "7EOZMa", "Bb>`n", "9m\"*I", ".|w)A", "p.mlR", "DC\\%37", "pkel3", "*tzKo", "4@0Hf", "]%1oDM", "555F5T5\\5j5x5", "LgU(t%", "YV\"tbO", "96)CH", "]Vx6<", ">%?:?H?`?t?|?", "S7[=P", "6M'hH%", "2y=XWv", "4Z!S= ", "xp0};", "N] q<^", "==}\"q", "sPmPE", "FhvqD{$", "ttrT ", "uI5\"q5", "%w1Upo", "Jg|;b", "<6L+~", ";ak^p", "'k[fo", "*S74b", "O{bu&", "M=,^}", "\\O?1(|B", "?75o5O", "PPTypeInfo", "tNP", "!#Voh", "DefineBinaryProperty", "ReadPrefix", "1`9:<", "\\?YMJP", "DtpDe", "wo{B\"q", "UpD9Oz", "Tc&d,&", "`,kTw", "tBtLd", "'2(Tj", "@r('j", "Field", "3s?6R", "YVvpEQM", "Dw!-r1v", ">5&|W", "Ax_f`", "1 20282@2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "F:g>D", "C1lH]", ":[@R~", "sB*,=", "{^QlN", "3Iz|V!", "A8|uNR", "?j03v", "l[_9vM", "+fl$Y", "'Ctj6", "4a4l4%5", "5,545<5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5", "NI*u<", "W\\V[I3", "6(S9N^", "$IEnumerable", "$TEnumerator", "$t~IR", "B}Ps#C", "{%?*@", "0#050C0K0Y0k0}0", "<{_#C", "-@}eO", "uoJF=", "Blp[m", "]b5jb&4", "Qiae>y", "w%$%R", "]+C[pF", "8Xd@7", "6wzvg", "S>{-EZ", "8lZRN", "TMultiWaitEvent<", "Y,>mg", "|=0sK9", ".XJa9", "ce\"F(", "pHF{U", "O~L[L", "fWZ&_", "p|&D'", "-TPair", "QU}}<", ":kfe*", "m*aW1", "I,/h:", "m/)Y:b", "gH=j{", " Y%[", "FOnFindComponentInstance", "cUS58", "?tr%)", "oiu:B", "TList.ParrayofT", "^s24$X", "11}tE", " /LJT", "7%8.8V<]<", "b&D>]W", "0baP.1=", "m4<%Q>", "NoLiW?", "Bt`BY", "^P/kr", "DynUnitName", "?*?2?@?\\?k?o?", "=Nt\"z", "`:yXiN!", "F|Zwzk", "'`FUX", "XGKQ(", ")7", "7i,;d", "/$_u6", "p%rbXW", "`[b&(_sU", "`_>FQ", "yqTNW", "NLdY.", "Mct}j", "]9x0P", "+?r22", "HIJKLMNOPQRSTUVWXYZ[\\]^_`", "36K :M", ";628'TeW", "k?wgCHwt", "b!J}Co", "]1]t%", "!+/HIV", "n`0/OT", "*+yyF", "Z2(]fV", "NzYzd>", "f-AfTVu", " @>$rwP?WUU", "'7siE", "3r2\"3F3N3V3^3f3n3v3~3", "^e]OX", "~!zGE", "^#]Y<", "TNd+a6", "b LiGP", "~^S2uuX", "W r?)", "bTY01", "a`%i}7", "?*Blp", "~m'wg", "AResult", "1j$$v", "18 2q#", "ClassType", "p;VJR'", "020@0W0l0z0", "_rT+D]/c", "kNc|{", "Ik4Ip", "*z[ts", "iso-ir-109", "y#x%@9", "#')Nd", "Z@D:>L", "sxFhZ", "TCustomDecompressor", "Bal7L", "~array~of~", "jtBu)", "+f2=\"7+M", "4KV?&", "`qKD!,", "vJ!!E", "JDZ[)~", "BE*h0", "mtJgZ", "pS^r2H", "Q(_^[", "g8)3p", "UaLAM", "N,KTrX*", "LI&xjE5M5U5d5", "b~\\|Y", "J=;$9", "SetSubComponent", "4aW\\E8", "> >6>H>P>^>p>", "TDecompressorReadProc", "{w{Ir", "ManagedFldCount", "94J)&|!", "UMS@}O", "7W.R_", "k7 Ct", "<$ar0f", "?/9xE>", "w*+f:", "K:$jt", ")\"ytM", "hssX2", "p6K<'", "AfsVT", "h}n$Z", "5 6/7;7R7B8T8", ",!3]/", "5hP$ZM", "(u`t.", "5!585N5_5u5", "m$y[f", "/>cqp", ";,(4x", "\"L~(n", "5FI!t0>:", "=E>N>j>s>", "^)MM\"", "6)+hB", ":MH--", "Iq925", "vC>e@", " ", "L;}!`", "u=\":w", "/z;Eus", "MSPTm", "I*~VENE", "&qj(5{QY", "4+Ls0s", "\\>3kv\"1", "{C\\kK", "=,>6>@>R>l>", "v11#K", "ffx!xE", "ComponentIndexD>G", ";G(HK", " bDpv", "+u{w\\Z", ",clp~", "R/|R_", "t`=e\\iJO", "ChdwkCL", "t9WHV", "ZIxfq", "\"WZmg", "a_K>OL", "8~zFG", "M<3WU", "cDNzo2", "p#29|9", ":vBsU", "8zn\"*", "R5W|E", "8Ppg\\", "gB~Bd", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "T(~yH", ".7\\Wm", "KTDictionary.TValueEnumerator;", "CA(5P", "] |J0", "fl|h$", ">'>+>H>X>\\>`>h>p>t>x>|>", "Rl]vq", "tOf;J", "PQzf%", ";izI4", "2b2f2", "ci@pc/I", "ReadListBegin", "KG:yl", ")RU#9m", "yZSOY", "LNN@g", "Y8Z.TKeyEnumerator;", "jOfzo", "-s+FB", "\\ferKi", "WJAm(Q", "/{(3%", "~PIN]", "6nBHn", ":&faB", "!~iQh", "h?6N=", "DbQAP", "DsMpw", "4Md9`", "A?SUE", "{l 7<", "&+?#,k&7", ";u6\"\"D", "cnr.!", "'e}|%", "dU mO", "0!0%0D0", "@fb=*KX", "nbw1a", "tP_h}", "`Y;)i", "S5uvJ", "N&v}:", "The sizes of unexpected leaked medium and large blocks are: ", "Dex+~[", "w8=PXa", "/x@0AE", "Ag\\27", "y,+*><>O>W>e>w>", "x\"91i", "R{Oc6", "P's2:", "+b&FQO L", "TMemberVisibility", "amB){", "vgF.7", "nzqi,)LQ", "`o&Mg", "tOG&:", "c~g-?7PT", "}a%m}", "NameListFld", "wlK;n", "opaque_Reps", "Pw@Ng", "(u>;e", "cX8>Jbd\"", "a[&3~", "a^i](", "A gC}M", ":@1hBA", "Uu$do", "-Z.2E", "*_l0UC", "E7*LE", "|$.8g", "a6/!w", "K4J6H1iW:", "Hy[7.T", "@J>L.4", "#z[z$", "059G[~", ",b>;_", "awie8", "UPvOJt;", "qW='u", "A~}Z\"", "*dM!EN", "556`Y", "9UN=2BJ=t", "C|81S", "/2C.u", "/TCollectionNotifyEvent", "Uu}a74", "TV_;%&", "3uAZe", "U|t|P%", "%/D", "dHJD7mP", "^{GYK", "CurIndex", " TArray", "MxcLSV{C", "ZI*k@", "_Fjho", "].TEmptyFunc", "V[<:r", "System.Generics.Collections4", "Y7OI0", "%w\"8kr", "W2NGN%", "=(=7=Y=x=", ">6*s0", "230410000000Z", "-pg", "4V\\Kp", "9YWClmI", "Qhhs!+", "2R$/@?N", "-!JZV", "8H)Goo", "=6=R=f=", "\"o/h1S", "VUString", "XI>*U", "5IC]mc&", "tkLString", "ho]V.", "D2[QG", "0rw)2", "%", "au&.d", "x\\h$sG", "Ic*[H-", "3 3$3(3,3034383@3D3H3L3P3T3X3d3h3p3t3|3", "3(,l\\", "8V6IQq", "3$363E3T3", "Gd>U'", ":&E];", ",*1ca", "RPJ\":", "|g69f", "zpJgH", "RJ%n?", ";:6+*", "@%:v1", "R$2_x", "NIfz@", "gJE`S", "hu%c\\!#$", "PT8g|5ON^=", "+2q5h", "r.w =7x", "i5\\=q", "fE$*C", "`G FZ", ";[\\`!2", "ksc_5601", "unQN1", "bj)1&", "30QP!2=", ")>f@P", "=/>\\>", "N(,Y1h", "P9A>0", "keystream", "ifDispInterface", "=|IX\"", "TranslateMessage", "O.]1aY~w", ",-\"~Q", "7,oV~", "Y 3OV", "1^O'[", "|eQ(B", "szG(X", "Y4^_R", "KneaQ", "@W[~]", "v.N^T", "n y6s8J", "uD.1;", "A call to an OS function failed", "}ZHE]", "kT(FRR", "G$Zv.", "`ha!Z=-n", "av{&%", "Un0{V.", ";$<4<8<<", "U~:uM", ":2oTjI^", "7,7;7C7Q7d7s7{7", "iso8859-10", "oaEiC9>", "4,'&|", "7Z/bD", "p*bhX5", "1@5r5+6l6", "0i1{1", "m-?7a'LgfM", "^$O{@", "&TEnumeratord", "*-_Wn", "\"Ciyv|W", "w!Xq,", "J|(h!", "!2guX", "VInt64", "F\\hM{", "sdV:P", "3Z3g3z3", "r+rbY", "2t\\55|", "f]*l1~", "EEncodingErrorx", "H8K:I", "zf_D(", "RVf\\#", "NTServicePack", "9l ,Hx", "UhtbB", "%USERTrust RSA Certification Authority", "di[kIg", "0!y9:", "^\\`(a;", ">mRq=", "a1t]u", "\"bsJ~:", "CallWindowProcW", "Specifies a list of tasks that should be initially selected.", "(5Cs{", "t/xM!", "&$I;Y", "ListB", "'TMethodImplementation.TRuntimeTypeInfosL", "$q7^{", "TFinalizer@", "C\"RFK", ">vK0>", "WKf\"^", "B(WFL", ";r f^", "<6*kA", "FlushBuffer", "p6Zi>", "V07PM.", "A3Uke", "CEa:`", "c.6Y\"", "pZ3jW", "=#>->P>`>h>p>x>|>", "o^HB&W", "s-ljU0", "# QBb", "k|DW`", "*j;0S", "XQx0m", ")e$?9P", "ha:`l<", "n4n&r", "+149|oDN", "YbP`Hy", "RoUF.", "\\E&''.4,5R", "", "6J7_7m7", "FJ8 :.", "zO5h#MK", "TThreadList4sG", "cw&bN", "Xd=", "?S4,/I", "bNu3]", "Bl3:g", "3AUw4y", "lg~H@", "\"~-C$", "y:}jDr", "gb_/Qm", "bz~&jO2", "P>.aQ", "\"f$pZ", "DVv|@", "^% Ww{", "3Q^'>*", "$TArray", "C,]T W", "fsDenormal", "qx@%n", " oO+s", "L!:_A", "T73ee", "`608O", "w~\"C}A", "u]~&Yt", "hB eb", "/76yYwB/Ob", "=fwH ", "(A$\\6E", "MTEnumerable>'", "*xqZ=", "3Q2T5", "-V8&+O_", "Z&wd6p", "NnV%J_", "cp866", "<0nnj", "\"mID\"", " c:;A", "CZT>CP", "Z+G>H", "Vp", "!f3%v", "eg8\\v", "FL|uu", "d#7b?q?", "W!.]Z", "f0{_~o", "sKJzW", "|3Lty", "Jas]j", ".%(kU", "P4ER^ek4", "Mp0V-", "yhjs+", "6;l9I", "Write", "B:m,O", "0)W?x8", "I|M2b<", "e]N{:f", "m~sG\\5", "3nye3a", "+p4\\ ", "sBZHx", "m([hU", "c%rD1", "vbpP6OAI", "415c5", "TRttiRecordField", "TH#Bh", "/a1Jk", "dhe.9W", "CreateThread", "E4.ZS", "=7+/$", "'\" i5", "!~P7,e", "\\ua.N?g", "CQ5QL", "ru(j!", "TbJ5DI=", "$^\"kD@Q-", "bb0{{*E", ",AK<1", "2I=Jo", "J.l4y", "*z3&^", "T%fUAm5(nas@uh5+", "3P mI", "9Pr]sE", "kw..L", "0FKBaW", "Ix.|C&", "H\" d0", "V`dMF", "p2&C$", "?mW`D(", "{Zlxj", "9@-uB", ":4:H:P:q:", "2.2<2J2", "EHl4qL", "-y4(U", "; ;$;(;,;0;4;B;T;i;z;", "}^Is~", "TRttiInstancePropertyClassic4hE", "w9JiK8", "pN9}p", "UF[Wt", "59( z", "0sV<_J", "o7d}'i", "}=_/a", "C}fuV", "k6ZQnL", "u\"Y2[", "2)262C2O2V2`2h2s2", "p6^lK", "TProcedureSignature", "windows-1256", "EsX#d", "6x82J2M", "R03~Qk", ")u^fO", "8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8n8v8", "eU;.c", "0;{9(", "cp949", "(V3}*", "EUiB {:", "@e8\\q", "V>unN-", "N}\"8kW", "n[.9{'wf", "-ne_'", "HVg,I", "TPropSetK", "j'a", "TComponent6", "GMo0o", "Fr]rTYf", "\"AVGj", "6Ut_[", "'CIi1", "c4$=&z", "3nYQz", "fZ6{a", "|y{a\"'", "EFa/t", ":6dcJ", "1&?MVcd", "G-]:M", "BR&({", "(#kK<", "1%9lR", "(A;OICI;FA;;;BA)", ":P/7G", ".YJ~D", "GS{,t", "Z>yB7", "-G\"Z<", "$=P+KI", "nav|6u", "2--G^", "E(o,Dr", "bbZ3h", "1#2[2)7", "898F8e8j8", "Zt!*Z", "/$.iG", ";H{iE", "tp|x?", "!)%(hi>", "7;^\\i", "@_}j1", "s||?S", "=ZrX<", "'%H0)0:", "x_/W,$", "~(Pfr", "6CU3!", "8=jDA", "@Hw5d", "}G,ZS+", "OnExecute", "3~#L))9)V", " c?)j", "\\%)kT0", "p>-2H/", ",B'$D`W", "y1@Ea", "c5p`Vp", "0RB", "5gh^.", "R[z.M$", "cpAh]X", "4U5~5", "-O1~I", "Df->(", "XF}\"kz", "qmS7I`", ": _7W(", "4`5i5", "000>0W0]1", "t@GK#2J", "b]_5Z", "1UZ\"R7<", "~4u<[", "csFixups", ">+>B>m>", "u4(6d", ":/:V:y:", "A9?z#", "FindType", "W)UkL", "Iww7]]]", "y[[qs", "OHrplWp", "]E2(z", "B$#X|K@", "P<%lP", "zHQNA", "'|&vV", "AnsiChar", "N>_b@M", "qn;b /?u", "M:Ap4", " 5Y\\p", "Vn`q~", "6l%YjS", ".Hin!", "XG&zN", "C;b4]", "1+1T1d1", "8%Bd*", "$(2`s", "lF{Bx", "?5?H?V?i?x?", "#fy>y", "8E8L8", ":!:8:R:`:o:", "Lme/+", "Z`2I8", "Q!yIb", "FProcSig", ".43y7", "Hg}d'~", "m,d-:", "PArrayPropInfod!C", "Q4^6$h", "@:tAb", "7o~gxy0", " jlB{", "0Ig&~csq\"l5", "1ao]x", "t(#!Wbp8", "wFm)'~e", "Ewz|4", "Q@ ?J", "X4=]\\", "9 9'9.959<9C9J9Q9X9b9", "|-hfVL", "cnk y", ".\"}L@", "^^}0bj", "H#}tN", "iso8859-14", "FAcquireInnerException", "Kzz5]\\c", "u/) vv.", "Y&Fs8NH/7", "C@[9x", "I.Ytn", "LAp4om", "ju.TEnumerator", "AClassName", "!7XF:", "0&OrW", "_=my[", "/s/If", "/+\\\"&", "898A8I8Q8Y8a8i8q8", "0qkA{", "4FLl+", "t~^V(~1f", "Q\"SyZ", "5)e!X", "i%\":7", "5D\"`C", "nn[TC", "`3@|0", "o\\*t)", "5'6G6|6", "$}'T4^&", "ep796", "jBV*U^t", "D7>(3", "VTEnumerator>", "TEnumerator(", "D,S}m{d|", "d#d3:", "@v7H{", "|DM0I", "D_m.D'u\\", "5FM_O", "080g0", "X-DQpa", "{tNqHM", "U~p@r", "<6=Q=`=w=", "&@UWI", "}B", "'.'NT&", "Y.S]q", "9}xv+]Z", "/,{`/", "5O.TEnumerator", ":(:,:0:8:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:", "zDFj Okf/", "6q/WP", "h~1nt", "{EJ;<", "Too many open files", "dp$n4", "a`4LC", ":Uv;H", "'TList.ParrayofT", "rp}xr", "t8}#5", "Capabilities", "9 9$9B9d9x9", "i:YP@d", "e8fr~", "f'H3Y", ">+>M>a>", "aA(r>v", "_TzE[\"", "C>64 ", "902GT", "BMU#os", ":$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "AbwsB", "]Vl X", ":O}C[", "Bk|)#", "^QMEn", "W]A%tf", "Edsw^", "4VWBn", "d^]:S", "GetArrayLength", ">YO12", "EAccessViolation|", "RJVk^", "-UB_wU", ">L?R?o?", "f#0P5", ")4f?3", "0 0$0(0,0004080<0@0d0", "(<&E$", "_]J7Z", "8hsn3o", "ar l8", "tpNormal", "!t-b9ze", "drCNX", "@N/LsC", "N9#5WI", "AlHfM.", "D.tS.", "}PW^s", ".Fn#E", "+;9-}", "f6Jqc", "mry}'", "u 8I/", "L/.m>", "\\O=o~", "FAsSByte", "n1FPl", "Qd|e4", ":&A64", "18bBv", "6>6t6z7", "e]XYw", "XIMhl", ";)H#<", "+>d$P", "VD6r$", "\\6.*wJ", "CB1tm`", "Yd?j\\", "HS2-j", "N1nOu", "N\\*?5", "`G\\%KH@", "@1T4m4", "s<^Rh", "n&1-i", "9[wai", "Fw-YN1", "Nq9xL", "b}Zp5D", "lCy_s", "Hcn}w", "3~F:2", "| g+{", "0.5Sa", "%F3v}", "=;=O=W=e=t=", "hmo|^y", "Stream", "&TThreadList&", ";q h ", "Qf/P.[", "^/}}}", "||`6_6", "#TEnumerable", "B]$]X", "(:Ey;", "=(=,=L=X=\\=`=d=l=t=x=|=", ":0;9;r;", "<*LB6", "9ZRZ9", "ComparerT", "koi8-r", "%{O]*i", "m#[q`", "+10(?@", "\\}1c`", "/zn.h%j", "RGN3Y", "D}gp1", "> ???h?", "@'6c%n", " =&N]M", "gLzAk", "PtG#w", "&TArray", "Qu/M6", "Y!K2$", "o-", "PropList", "_$p2N", "m.)P`", "EArgumentException", "r*J2$", "an-fD", "EInvalidCast(", "Nj:dX", "mh!l$", ")l')3", "T={3A\"", "7/7>7F7T7c7v7", "41454\\4f4", "%w,KV", "[PnLm", "G{JVHa", "[wRU ", "8<>{e", "Q|pl4", "e~Z##`", "CreateProcessW", "a'2F2m2{2", "M)S91", "7'7l7p7t7", "pgK}H", "znhB:OT", "ITDictionary.TKeyEnumerator;", "Fo4|=63", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2", "At][=", "v3:%(t", "ClearAndResetID", ";7|8U", "J:CuF", "i#[X:", "V:7ym", "\\PD9]", "+Us%K", "pzT}[", "M~`9!", "S5\\V/", ")q\\2W?", ";y*k(", "gAe )", ";5H'j", "{0qua", "d1x`/", "FMemory", "CfLla", "y p>S/", "s$;KH", "QXEEn", "I=m+.", "Y@L2|", "UCxF>", "8V8n8w8", "tNt{Bc", "pJ#D/", "+D|:[", "-1h1XKPp", "&op_Subtraction", "<)", "edddS", "Gv_uP", "=bHgx", "E6-N8", "{[ji", "^'q1&", "*`Xl!4", "19G%3", "v_Z4D", "gI+-C", "#\"#5Q", "aA9wO", "vFOxT", "(z@kO/", "Q5g@I", "2v)9[eb", "GetComponent", "> ?K?S?s?|?", " N#TF/", "JT][Q", ";R7A^", "D\"x]GV", "i.", "FU5M}?", "@w!Ya=", "!TSetupPrivilegesRequiredOverrides", "CT.'ux", "/;jqR", "W9xM'!z", "MF|JP", "MpIx_", "4*b)iK\\p", "9,9;9", "Q\"Tn^", "008\"n", "0^o\\0", "drU.faO^", ".hn[o%", "8 :s-", "[{K3I", "J_SBkX", "+ia{@", "6yh-A", "gyM,-", "qXJ\\?", "PTQ$%d", "H8|#T[", "D0=T4+M>I", "greek", "'-]}9l", "'vy!O|", "q6]o#", "I&$/O", ">Q\"|2m@", ";![8B", "2 2$2(2,2024282<2@2D2`2t2x2", "V(vY0PI", "W4NO1", "h`'!~", "4'4/4@4u4y4", "fF7sa:", "&sG7sp", "Yw*U<", ")>,8 M", "BTDictionary.TKeyEnumerator;", "G,}I}", "& yr-O", ";B.@(#", "Wr!O/", "0K1m1", "|(06u@$", "zVOpl#y", "*TDictionary", "bbF#7", "W)zvt7.", "UDKqQ", "/n#:6'~", "FVCLComObject", "(c7}M", "yvF3N", "GetDeclaredFields", "`EJoL", "HandlesTarget", "8$8+82898@8G8^8b8f8", ".L!Nn", "K};gH", "v Z$-", "ExtractRawData", "OJC}a&", "GXMuK", "CodePage", "Sectigo Limited1+0)", "b)^W*e", "5lho;", "eqt'm3A;", "lKL-.J", "fofsbw=*", "ZyO\"?", "0= lV", "az-Cyrl-AZ", "D8:o\\", "=:HUu", "tbG+/", "&;=$PI", "65-B&zX", "9xY:+b'i", "2J2t2", ":&C&X6z", "1I#%O.", "aWNwX", "o)2GuNk", "_jLS{R", "-L>.z", "`ugH", "D(?G9", "iKwke", "FQL2+", "", "wwz;~", "D0WF{", ">qnY]1Y", "wwTc!", "3@N3.", ">>jfJ", "`(*2R", "1Q+'a", "+U!}{", "+5LUDD^", ":#:*:1:;:?:\\:`:", "Execute", "}[.H\\", "w.7EE", "ZR[92", "p:RX7a", "3&J8BfCg4", "X.T|b]5", "Callable", "8&8.8<8N8d8u8", "[rMaSn", "AsString", "P^@E`", "g'G[e!", "Ck%#K", "*vsfF", "X2,=dGC", "slYes", "E(F?B", "K@z7B", "Uh)ZE", "sccCompressedBlocks1", "Kk;+B", "4;4P4^4f4q4x4", "iso_8859-7:2003", " k1f8", "woH?#", "04'8*", "^BYZ'h", "ifMethRef", "3\"3N3V3c3i3w3", "o&Pm2?", "5@_1h4nJ", "oWG}{", "0dgA7p", "[.zk0", "F|~S!q", ":%;);K;O;t;", "|cxfLQ3H", "\\W5e ", "3Ib y", "BdA\\=", "ef]$+7bu", "a4gaF", "Instructs Setup to attempt closing applications using files that need to be updated, or prevents it from doing so.", "iso_8859-10", "0!H7E", "WriteDouble", "J5@?N]", "w)3\\8%0", "HFm-gb", "WriteString", "f[u{I", "rS9Q\"~ u", "|'y:}", "s1R2zT(", "ZSm~fA", "?'?1?V?^?", ")rxj[", "TRttiIndexedProperty6", "qGfza", "X%[(N", "VByte", "VEAkky", "919Q9t9", "h?.'O", "6'P@w<", "jS_X9", "{&(.9", "! ?2$", "'^lPZu", "?;+l>", "-@B5=C?", "G[p<]", "6$636D6O6W6h6{6", "jL.]_", "YKQ", "NyT_A", "i,b? S", "3:F1Y", "h 9Z|A", "[}RV*", "82jR*>9>A>O>a>o>w>", "IJ4X)", "K+8NT", "mNeJ8g", "&82L_", "RegSingle", "@ayVm\\4", ":\":*:@:U:c:s:", "EZt\\gw<", "s9@'.", "fZ\"!Z", "#9mbo", "VS!UI", "<#p:'`", "*ihCk", "2hOvz", "gW}&;", "b6YvZC", "Ig&a(o", "}>^/8", "<", "(A22t", "f0(^3", "{kxcQ", "X+AIr", "e_#S/ME", "GD Xe", " M:ZT:L", "nv&BI", "[hE)cA", "')cL&", "HpfX}c", "cv_;W", "J]!nIrd*", "WVA{)", "qi9L5;U", "4\"4C4J4Q4X4_4f4m4t4{4", "{'tOD", "AFunc", "Hl@\"h", "Bj?pf", "piB;Ar", "TReader'", "X/6?b)", "ukf`.l|", "s\\.K.Q}", "dJ09z", "}#k:+", "bSw2J", "CreateWindowExW", "T$>m?", "N=%T=y", "VarBoolFromStr", "UnregisterClass", "w\\y5d", "_LK9&/h3x5", "yht?!W", "fXv,*", "PSPUv", "v2_k\\", "U1L;|", "vaExtended", "6#MS&", "2>3c3", "\\TEnumerator>(", "t3V155", "Hh4L~", "]#yeQ", "'aVh:", "2[ B5t", "w,Ag4", "4'5P5", "wNhDs", "'Ex'_(~", "lk>G:", "2e`>j", " ,z/l", "ry_!Sj<", "?]3kl", "TQG$I", "!IEqualityComparer", "5#CZzv99", "u},@#", "z%r}\\!", "#+.wG", "#TEnumerable", "7tOmb", "Xp/Z;", "-;}P?", "hy\\Yu", "7f~yB^Q", "Fau<$", "AvClo", "LongMonthNames", "OwningThread", "GetFileSizeEx", "g6$PI", "\"F4\\~", "$TEnumerator(", "0#*Je", ":4;C;J;", "T gmO", "FI5L}", "p8f,a", "|hifea", "\\M?-2D", ":ru'Ww", "3>8Y@", "{19v+", "UnderlyingType", "TRttiInstanceFieldEx", "DefaultDirName", "klcyK", ",2uh\"$9", "Q4+)Q", "^FKs2.#", ">hnU'", "4Saiw", ",LIrMr\\", "[}22G", "546D6H6L6T6\\6`6d6h6l6p6t6x6|6", "^5D1/1", ";vd\"B", "*0[BU", "x[IKFR", "TIntfMethodTable", "fJf&N-", ")M#>1>@>[>_>v>", "I}=Ta", "BW>af", "5:kM%\\", "|$5|t", "3TD`_", "D1~+N", "CJ,gw", "DA\\ooj", "zn`/5._", "ct+qk?", "sU!Ll", "/R:h\\", "WGO\\?", "x\"vl;", "8\\C-N$", "&4j&H", "ATuN{", "q]'Zp", "&op_Addition", "dnnn=#", "-m\"6m", "}`05ze", "$z].Dw", "Windows Server 2016", "9x.tk!", "TEK)pX", "5=;o1", "R;\",DYo", "%fgg-", "BhW^x", ":\\ }P", ".[fsY", "4.4?4M4U4c4x4", ",W'OJr", "csWriting", "-&<#M", "TFiler", "HcKB?(SQI[", "KobrASN", "$g+{z$,A", "L-v:/", "c1k6 ", "ivn.#", "m6V|l", "{o!o<", "Peyo)w", "GetAttribute", "pA6yH", "YRLYY", "oL8,#", "TArray", "&\\jMRA", "Q1S}2", "|v^9Y38", "1+131A1Q1`1w1", "2$2,242<2D2L2T2\\2d2l2t2|2", "'|,:e_", "vaList", "$]J[I", "AclvJ[", "z P5G", "k\"dg%}", "_KVY\"St", "[5O{`V", "vE>O'r", "eCT5x", "FE951\"", "q+/qe", "!2-m`eA", "n=-\\AF", "xz<|6", "(", "z,dhl", "?/%^GY", "I9IX&H", "|_/'v", "m]5ME%", " _z>8", "goL M6", "xx^[7", "jMX3qR7", "M9&1q", "SetThreadLocale", "W(oky", "525`5z5", ".\"C_=", "p<^_N", "1uwqj>", "DG,IX", "fnW(5<", "-&4x~", "D`HcxR,", "Sq=Ae", "F2Bswq", "7j.arrayofT", "CEka7", "~/O[p", "3$3,3:3E3X3k3z3", "xS@>(", ":;v3/", "GroupedWith", "!IComparer", "qYsdm", "5=^yz", "Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists$''%s'' is not a valid component name", "O4'.[", "FOrphanPackage", "UGbWdcZ6", "7,|>p", "@A8c7", "iory^", "?ta!Uyz", "HfoC;", "2do]9", "hbec9", "eVM.,^", "AddInstItem", ".M|M\\", "IQKIb$", "RL^Tz({O", "\\^tWpL", "JXWOLC", "f~,:[", "g6LvZ2M\\", "FOwner", "uQRM)E", " name=\"JR.Inno.Setup\"", "Uh\":B", "6)6-6T6d6l6t6|6", ":^}>6", "=E}# ", "Mfg+V", "_5U^R|", "cp855", "FloatType", " CrystalIDEA Software ", "?i3>A[", "H?`M0v", "H0*B-k", "NESCG", "5NuElN", "SQVCX", "d}cje", "Ce|pJ", "|i Jf", "(TRttiPool.GetPackageList.DoUpdate$ActRec", "|H]2H}", "TArray", "ic(_^", "ExW,z", "R)I57r", "Embarcadero Delphi for Win32 compiler version 36.0 (29.0.55362.2017)", "dK_v;", "1O!y-", "KIzII", "eM", "*|yf,", "^ioO<", "7l7p7", "D\"?~F", "^7Z7t", "4W[^q", "EventCount", "d?j^4", "bc}9-", ">KjdmLk}hD", "j\".PB", "\\$*tJ", "Pf{m.g&", "{-+* ", "pltVhAt|", "FieldType", "'#j\"Hc", "L9Uga", "Sz0IZ", "~=0`O", "duuFRG", "BSq7h", "494O4r4", "C*z1NoK", ",b7`X", "x%fonT", "RWN#fp", "Waiting", "SZ+%ugp", "jv\\a}RO", "d71", ".XT$X>", "fW6>E", "&EE>?K\\", "14w'3=", "`x`&T", "32-ow", "8+838D8S8[8i8{8", "SdIRd", "nnnAvvv", "g~g\"dDa", "}I\\h3", "#}rb^z", "JB>\"u", "9!S,1", "VUnknown", " tDMb", "2`,h!", "Gns+|o", "/ rYEG", "YR;'&+", "mb/r5ni", "pU6Az", "Q=34x", "OZ 3\\", ":rX=L", "Ws=YD", "'S*rO", "tm#t[4", "Xyrt6\\", "D> G%", "*hU'$", "\\,q#Z", "oEVW9", "Write64", "(3h~sQ", "H#`,k\\", "=<=J=`=n=", "{^_7H", "lEo\\p", "3R4~4", "FmWG7", "a$@3r|", "7Zj~/", "u8tT>", ":http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#", "V;$se[", "A\"(tp", "4)4>4W4_4g4o4w4", "*a\\m0&|", "CheckTerminated", "}$TeI", "GetProc", "RttiCount", "\\cfsiA", "#78~Sn@0L", "TArray", ";,;C;R;i;x;", "C?tQg", "S[@i?", "mJ[HO", "u7'Ea", "uPLU:", "c-]FDg", "111C1Z1l1q1", "h@iY>j5", ",)FBvTE", "p|YLFo", "r,r@i", ".2nk0", "", "4_>X%b", "2#3j)k)", "55^]f", "9'9=9R9`9w9", "232H2V2h2", "i3l=T.", "U\\)9QW=", "Wi|pt", "Vr:M1", "8By(@", "zl_OD", "p(M6%", "~$0AWf{", "FNL^j", "Y*7)K+x^", "VcgQ", "iso_8859-4:1988", "YDEe#", "ilKa\\", "8j!zyP", "CTf3xio", "v,Ua|", "LanguageDetectionMethod", "){vN.", "A36PX", "TCustomDecompressor9", "#Ri5bn", ":@vx,", "OphK]7F", "Y:7g)", "x+P~p", ":!?%?)?-?1?5?9?=?A?E?I?M?Q?U?Y?]?a?e?i?", "wyE~`>", "VogN)", "'->,{(", "{Cg(e6;", "}Ri`.", "8D6W5", "fsNone", "ADecompressorClass", "iH=uF*", "6W&72", "G|,v(", ":%&=q", "p~D+{}", "z]F[k", "Y_nht", "=dM0h", "Instructs Setup to attempt restarting applications, or prevents it from doing so.", "1QkKS", "2r8f~", "n.mDIyh9NC", "8'8/878?8G8O8W8_8g8o8w8", "Np<|o", "IZ9O~", "paeEj", "hytpQ", "pP1=\\", "7B7F7d7h7l7p7t7x7|7", "0\\ENM", "=o{Ar", "!S_WL", "l~tv&", "URhq}", "FromVarRec", "$];Gq", "H3T#-'", "r!t3Hta", "TListThI", ";(;8;K;];e;s;", ".-s9d", "J-Aca", "izA,pS", "m_Qbf", "/^9MJ", "Ve%8hoN{", "/yzc/6", "EVariantErrorH", "_Default", "=U,>y", "Cq@-{", "|q?Jb", "'V5dCs", "aZ[[)", ">3>W>", "?4?E?X?i?|?", "GetParams", "*Vb;tw", "abVH)Kv", "6VXKQ4zVG", "o#QF$", "Active,", "t~:Cpq5", "-vs]V7", "StackInfo", "TMultiWaitEvent.TMultiWaiter&", "VarXor", "'HROO", "7VxIT>", "P|Z5Dic", "k6\"k2", "t6,0sq", "+$Ds{", "Ka^hc}", "Y;2<1", "\"7eaa", "windows-1253", ",//[Qyn", "gT%ey", "igo4H", "Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread", "414B4W4e4{4", "jd!Di1", "QQQQS3", "G7(nc", "(ecLB", "GetFields", "T#L,+", "]z\"H|", "{7P7b7t7", "4Q'S!=", ".Vy)kHMl", ",}o1J", ";*@5\"X", "g82?~", "FiredEvent", "1)@dW", "|0)3/:a#v", "vU|vn", "ep&43u C", "sTo>VT", "q\"41|", "GD_^[", "#6]6$", "Reserved1", "WJ\"M1", "BFe^iqo", "n0]+}u", "dwurN", "|Eybs", "AList", "U\"qysN", "{@m!Z", "LM:>jh", "NNJ)p", ")\"m=A", "=j6RJ", "/D!p^F0", "LbZ$l3", "Ec`l[", "G)t9*", "NSK%[D", "Ordinal", "x^q89", "+/RWd", "Bi%\"'\\", "TGetStreamProc", "ACallback", "&IR%x3w", "E!ExN", "J%pl)", "[_9wjO/", "})Zx\\", "windows-1257", "1G:$b*", ">C-.N", "(_eGp", "\"o#]+v", "Q]l\"O", "Destroy", "MTDo\"", "1 161M1j1r1z1", "WeakAttribute", "119\"7@", "RevisionLevel", "gPY#dL>", "ibm852", "!Ro;~", "{OpY_B_", "{;M`q+_K", "^/+2\"", "=0=F=j=n=r=v=z=~=", "z%)exw0", "g$1 9", "V]Lzx", "[E} J", "AjSH+", "BxB/0O", "J2\"QD", "k[IeL", "tGf;J", "K(kMgf", "E/exhb", "5O_sV", "W~ 2-8\"_", "; ]i@", "TVarCompareResult", ",^68B~", "i6YlO!TL>/", "Srsuu", ":%:@:N:`:z:", "\"H\\ P1", "[6u0L", ",(6|Ib", "!2=CM", "oc-gn<", "RYL}:", "R@V^\"", "CreateImplementation", "|ri]S", "6(7,70747B7P7f7x7", "j&:|M#", "^ZJ$G$e", "p\\T,'X+", ":8169", "", "T:A2F", "+KcYQU", "|b7;I", "?JZLvz", "Wp0C:KJ", "826!F", "/NORESTART", "%TObjectList", "4 4$4(404M4[4c4q4", "v+)RT", "5F5[5l5", "ry=\"?<", "d+#7 s", "8B|&2j", "WriteWideChar", "M@U'w", "'pBEk", "iso-8859-6", "pWxX[fF", "CC1Z=", "h,@Uy", "r$[cF", "*4b{T", "7j9O:f", "n{\\Vf", "7|;OP~", "3]Jf)", "Z3Y`(7Q", "SCL0=d", "OFB/}", " ]_^[", "P0uG3p", "8L9.:h:w:", "%~#'-", "(AVY1", ",OWP)S", "-8}C,", "1Lv7%", "#D_4\\Uh*(", "FSynchronizeException", "w>G^(", "Hb@2h", "+S;~g{", "7'7/777?7G7O7W7_7g7o7w7", "cp858", "6e~c]", "gtV]G", "Y?F38", ">g8DI", "@02IR", "L?|P6", "^Ya#@{", "7h*gGrP(", "j,Pbn", "q;yH2i", "ByteOffset", ":FB;T", "In-}5", "SXs'\"o", "0a\"f^Lx=", "Ff0}T", "2k&Y+3{z", "KtGSR", "p7wTz", "sma-SE,sma,se", "Jo:2v\"A", "=|?Zz", "EQ?Qx", "n/Cq\\", "aP'Cc", "oX,sK{", "NsJCQ", "#.;o[", ",?QmE", "%o|#K", ">1'T{", "c)J/O", "(Y)k|", "e%nyMU", "%4w?u", "fi9k9", "{Z^zQ", "D6N}*", "hTk)`\"x", "^jNz\"", "v\"VQ{", ",E-+<", "TSetupEncryptionNonce", "yc`I/X", "OnFindAncestor4", ">7>E>T>k>", "s|8=r", "kLENe", "75{vN", ">%P[2`^", "{[NB%", "Pjbr@", "4OLld", "H2NPB", "SZpdJ/", "c7p%r", "tInno Setup", "%YI1K", "QiO,]6", "C`pbW", "_GOlYy^", "R\"f/m", "3$Sv~z", "=!>?>J>", "TEnumerator(", "N}1Q#", "`GDt6", "GetSystemWindowsDirectoryW", "{\\y5;", "iso-ir-203", "}MXTg", "FPageSize", "Kgj/?", "xLlz2_Vb=", "&TEnumerable'", "[9'Ak", "sN'j>Du", "G2Cib", "Y@rof", "IWlhZhv", "213F3W3l3z3", "GetExitCodeThread", "IJ:}o", "!CX#J", "=[_2;", "Clone", "~-bjDz", "FinderClass@", "Xv;?l", "%fJeq", "M~jO\\", "fp))e", "uPIb! ", "a$Yy0", "<)-rff", "g!R)x", "V'dfJ", "2usZ^", "ReadDate", "QH\\~R", "xg2=a", "3{L:T!Ss", "SetThreadPreferredUILanguages", "}^)Oo", "TGUID", "=Uh&W", "DMjcH_|", "YS]Sf", "8dhu!", "DJKMd", "2=92.", "S_N:}", "692/T", "OK.`m", "m.KA:", "u u9=", "TUTF7Encoding", "Uh[YE", "*O:e&", "o{=+r", "VkC1Ka", "$;|", "bEIx|", "pzW|@=", " *R^8", "JqV^^D6", "#,[gah", "<+wH_*l", "|U}q{1gOg", "w86A%.)", "oa\\Pq", "VarMul", "wdLx|", "FGrowThreshold", "M%s;EJ", "P@\"U^", ">Dkk+}}}", "14oRs", " TArray", "c%Zp|", "gZ,vxg", "16qe_w", "onG*=(", "!xgpRP", "X(mP`", ".GIjAG", "{!c6=", "}VlkK", "AName", "[V9O~", "6C}|}8k", ".K7&f", "FGlobalContextCounter", "8D:Od", "v;aK>x", "+=+7uK\\", "X>J%_", "bto*s.d", "`o>hv3", "|kDd{", "AStartIndex", "MdeP 0", "fsReadWrite", "_~(Ay", "M6!%.", "B6AM=x", "i@6QJ", "", ";N_Bt", "in,@x", "c3B-zCI", "y7B)H", "AVarType", "VScE-", "+\" Yi", "MBu[(", "^$.rWe", "4ey$k", "VTEnumerable>'", "/GA##", ";WsFz", "b:n2jog!", "TRttiNamedObject", "2Db(R", "iso-8859-4", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", "E{46F", "{oT9TE", "FAsSInt64", "hi?Sp", "P<`hNZ", "*t&^a5", "._Tv!", "p/H23", "~O&*[K1", "f2I`R", "z*o-7C", "uW3rl", "ihfKj", "QLiT'z", "WriteSingle", "B@0'FW1", "Iu2|z", "CCoDJp", "Wbau|", "->\\A**{n", "VL%l27W", "L{(z$#", "(GlVN", "'Ub<&", "C&I+A2Q54", "_3O#sZ", "C(J ~", "mchY$", "7W2&G<", "skShortString", "m\"rQP/", "0L++?", ">/g,-", " fH|I", "B\\$J:", "_OHon", "@/@Vo", "L3m,d5", "-(>?V", "c\\@7^", "Nr_H ", "UzbRwI", "jI0R0", " uD^b", "1sL=d8", "d", "_Fp`y", "wx[.PMC", "/tSaW", "&op_Implicit", "0 0$0(0,0004080<0I0`0u0}0", "BIg%g", "cdx&`Q", "!Q}jd", "=R'B8", "a/y-~z", "Qam=+@", ";%e`*", "AV\\0'", "J[\"3_", "Ba7]]m", "l4JHG", "DUY_bC", "aEU T", "^", "=TD)%", "=V\\!8M", "y$}AC", "0RI[|iH", "ixVgs", "ft$vk", "|dEd)", ">&$kV", "7L7c7v7~7", "X+B2r#8t'=#", "dkDynamic", "l/7P[", "N_Z6(", "qd:|]", "JZRL9W", "h;DdMP", "S9Cq*{G", "j.ncN", "$IComparer", "8]RDLv", "]'HO;uR", "3#[p2", "K`ly\\", " DhBu", "D(,a&", "Tql'+|w", "TRealPackage", "*$f>p", "_}2t9", "4Fe~zl", "l8]~w1", "+R~^c", "GM[+3", "m!,\"]@", "Floating point underflow", "rHjL{<", ":M:Z:i:|:", "/LB3i", ":,TOZ", "TRttiInt64Type(", ">,Y cB", "5FfN}", "T/15F", "x'Al}", "AJbKB\\", "@iwde0", "W;KJyjZQJ", "NBhe3>", "GetVersion", "V.fl>OJ", "S!^\\K", "ncjS56l8", "r|DFjdR0B", "sShaO", "M|e1L", "0#040G0X0k0y0", "a{RHh[", "6hC,G", "UnlockList", "#[OMw", ":r\"p_", "", "Y0Xh@", "e(EPX", "a", "7,e~X", "&Eo8=", "Rg8t2", "UCAn:", "|SPI1", ";ht^p0pGv", "qU!W_QG", "0(0,0L0\\0d0l0t0x0|0", "(De.?", "TA?-Ca-", "^+JxSa", "8 8(8084888<8@8D8H8L8P8T8X8\\8`8d8q8", "7#@DnwT", "[AE:vd", "vNLgCRj", "Unused2", "IndexOfItem", "QUyj&", "Q>k>56m", "?^oY5w", "K;0PI", "(A&HcU", ";TCollectionNotifyEvent", "525h5", "@%y!6x", "w?=P2", ";OhrG", "Y,//c}}", "b)\\&IJ", "6$@&uL", ">Nv@v", "_u'Im3", "MN0m\\", "7v(R)E", "Dwh63", "*09I(", "A#yofB", "o#Fq*", ">#>4>H>P>a>o>w>", "Must wait on at least one eventECannot call BeginInvoke on a TComponent in the process of destruction", "?2KD~", "4PZPq", "K", "VS'aO", "~?q\\j", "4kG\"!", "J-{%1Ytd", "U:2&1", ":ie%A&C", "=!=0=B=P=b=j=x=", "^3B|?'", "dS3`n%", "KeysH", "-WWmG_", ",F}*}", "l|$,Z%", "+ 6uy", "GHd~2", "?@B|o_", "hpKN&", "$4Jk9y", "*VV+4", "O*'!bY", "o=bx[", "0'p\\mW@", ".meX)", "H}a}^", "TList", "b0U+Z", "v=*}6O", "1u079d", "Hv;ni", "FSVWQ", ",gMtC", "y4Vpt", "OleAutoVarType", "qIs]3", "cp860", "a`q0P", "U?96A", "&TEnumerator", "6|_5j\"<", "_8(V9", "QM", "O,1e\"[p", "JiD-a", "475N5p5w5I6m6", "u>57!", "TResStringHashItem", "ExecuteAction", "ArwEVB", "1D7vu", "dI/[i", "1 1$1(1,1014181<1I1_1u1}1", "V)rKS", "AZ}#2", "A&#/Q", ".](q*", "E}5\"w5E+", "P6P\\}v", "%ZCEDN", "1tbqo", "2h&=M", "6,z)F", "uxl(;", "Odwjp", ":$;R;b;1x_.,", "TTypeTable", "io?(v", " tIyR", "1Dgt*", "UhkFI", "w4m!e", "1 >ED", "3$363F3N3\\3n3", "1R@[>%", "|LztR!", "hR+Kj", "S`<;/", ";rg`E(", "8|IX4", "d|5S+", "hXX5Z9", "*HH{$", ",5B@W?", "1 )'T", "-i6/$(", "]s|;!", "NCjaR\\:", "U@xw$p", "ldLocale", "Z37eP", "4@Jl.", "*ZT~Q", "ATimeout", "CXTPF", "yk3uO", "e`]wP", "2*2J2^2}2", "dYe)o", "wgBE/", "!-\"-9", "5H7U$", "FUseQualifiedNames", "TSetupWizardDarkStyle", "hfy?z", "$Pvx.", "+IEqualityComparer", "ey37Q", "Sk=b: 4", "Overrides the default setup type.", "TList", "zS7iS", " \\X>'", "SetArrayElement", "9b$QX@", "Windows Server 2025", "kwr+m", "D5C5m7", ">0>O>", "oV|&!M@", "TParamFlags", "Q \\%A", "Gf5g@", "$j8W7", "8LdZN", "Cha/$", "T-z?R?", "k|\"Au", "I{M/t", "y^I&~B|", "Ab,~dc*[", "S;6FC", "FSpinCount", ":<:\\:`:", "{qm>P", "_N;0l", "%'.PL", ",N7KS", "K}YvT", "eai=tu", "*j48o", "+o+eI", "kbG%e", "/?x@n", "kcor~", "S5KtvQ", "myYL7Bf", "Jg5-N", "\\0m0p", "G%.O/", "GetDiskFreeSpaceExW", "><00p", "W|S,[", "6!6%6)676E6Q6`6", "GetField", "OC[vA", "e0l6w", "MO'I1", "gP`|.k", "v9`=l#", "8", "wv\"", "2xZ2R]", "bXC>'", "fNZ~m", "Mo>#4nqha\"5", "r_l{/lB*", "TParamFlag", "g6ji}", "5PSOd", "\\s7T!", ";n~zD", "1`k8m`", "RegCloseKey", "cb8MYj", "1 1$1(1,1014181@1]1k1s1", ":ib;%", "L|cD,yx", "O&.fL", "3LUgL", "SetData", "mIj6r", "8*8;8O8W8h8v8~8", "X:I9Zt", "636P6T6p6", "_#'@<", "7)8R8", "=_$T~hS", "!TList.TEnumeratorL)D", "*='Uyk", "b'`hbb", "N;~D#'", "f9ht9", "IW,gz", "&}{>NP", "p;ayr", "d*'G9", "FHits", "JRmdB", "w~`+^", "6k?iI", "Software\\Embarcadero\\Locales", "\\s6Z/%", ".?GnfrT", "HK@>j", "ICsq6", "U`)(Cd", "k-!#$", "{%R(aS", "nrt", "Y'}\\\\", "L:58z1", "CreateDirectoryW", "/eN?N[o", "( bjPy", "7]vG.", "West-Vlaanderen1", "Aifaa!", ">5?U?\\?", "mk|20)!", "Zg\\E*V", "6#T.a%", "v,ccZ", "70e \"q", "8E>q#+*", "e0($s", "I3E3;", "IWK=r+p", "zg]H8", "i=TbB", "Q^.r]:", "FCrih", ")C'.Z ", ":}3w4&", "v(Nb/}\\@}", "f+Seq", "x,l`)", "Dfpqi", "jKj5J", "(\\C(a", "*%$)p", "L}19z", ">.Tgw2J", "^{N?t", "Zt] a", "SafeArrayUnaccessData", "iS':@", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "q8_2zn", "My>e7", "xI*pQn", "r4ZSg", "4,F^i", "qH)\"p", "zcQV!_6", "RR[94'A", "?X3Fu:", "T=Ws&", "7,.EoU", "rXYw6%", "TExternalThread&", "February", "8&ySTE;", "~ /NQ", "fe#KL", "lofpMu", "SysInit", "~LE_'", "?&?=?K?^?u?", "}M.o8--", "<%YE?", ":ti)6G", "pTu1p", "hz5#d", "yvz=7z", "o5m|$", "aD}&u!s ", "y3dal3", "SYH*x", "C]6;~E-", "iso-ir-166", "ibm864", "GZr3/", "TynYi", "%%AR+o", "F!Q,P", "Q}J+Z1", "Hv]B(", "^Zh%e", "Kpw*q#N", "]Q4Na'", "=%=-=u=", "*Le86", "3K", "M< w0", "4,}B1{8 ]V", "1'.2g", "q?fN;", "_TDQu", ":X<\\<`1X1f1u1", "yT>F@", "'?ISS", "521C!", "<5e1_", ")lLPz", "TRttiRecordType<", "0|nz>", "p5n^s", "A'SZ^[ ", "g/y{6p", "0UBW;", "ComObject", "System.Diagnostics", "Z?8ZO]", "8z^rx", ":TDictionary.TPairEnumerator;", "2y''X", "5n<4|", "60", ")=J@L", "}eae^", "FreeSid", "1#141H1P1a1o1w1", "z@2Sc", "f.j", "VPointer", "K>E|)7", "gs!# ", "= =/=7=E=X=g=o=}=", "J4fw3^", "[H&xf", "psYazQ", "|8+F1", "1Dp2&", "abc?defg", "hZ>ME", "K[VE9", "H ^BE", "a{%p?", "VzrbCqH", ", w`!", "csibm860", ")F~%7", "eGzVn", "4MU^p", "q%>7WyI7", "P=q=", "[~?CZ9h", "fUxgY", "z%w7p", ".?%rv]3", "CurrentBuildNumber", "iyNg*", "O5Y(Q", "yGCDn", "qW6i:", "E!sH(", "828I8W8n8", "\"(tub", "QP;-%", "&.x|[", "@ES]x", "V.gl#Z", "\"g3|ebA", "GetName", "4)D2y", "I\\7j`!c", "enwGS=", "yBP;n.", "3MTN|", "}@TV}2S", "W:Y18", "KFYjm80GU", "Nw2.3", "`EEIQ", "6$6/656:6E6K6P6[6a6f6q6w6|6", "nDL3E;q", "kEW .", "b@^VSW5", ";2;@;R;l;z;", "cH]U<", "TN[O$e", "t,_K$a", "Uh]{I", ",`OqN~", "wrError", "}gNq<", "G+w'k", "'nQH}", "&yw?E ", "is-7n", ",$uN%[", "OveaM0", "6%6;6P6^6u6", "\\YHlE", "IValueData", "_4li]WD", "b1b)}B", "vnZV-e", ":,#o?", "Y*+KZ.Q", "~_&TF", ";.r{K", "dEpZxQ", "UCHa{?U", "On099+", "Jgx!p", "%]N)D", "wo:gF", ".2)pX", "o%Wdp", "a8O\\g", "-Xa3>", "1'1=1S1", "dkStatic", "7ky] kK", "G`K?_", "<^V,9", "Windows 8", "F5W'+", "H'T&Fd", "@O>8eAX", "_s)\\7", "%` oy", "[Wd;Nh", "pF$ -d", "aTuS/X", "K*;gp", "5+5=5M5U5c5v5", "Y5oVB", "fiS|-", "~73O(p", ";;.%E", "3'393I3Q3_3r3", "Capacity", "y=u\">", "6F|Y*", "L>v,:", "Windows 10", "!TNtu4", "M.s1K", "M-iX]", "DfZQq)", "TSetupLanguageDetectionMethod", "2L3S3e3l3~3", "RB=j5", "2\\%-GKH", "6Shared.VerInfoFunc", "{I+-F", "Z~1MV", "bLVS:", "VUInt64", "4#4.464G4[4l4y4", "Wu\\fDNg", "ljEh&g", "*.2Qq", "%Cur1S", "VmO1h", "?.", "9y9,q", "bfFMK", "X{&aP", "SeShutdownPrivilege", "W>:.{", ".YwP)Lq", "4\"=ed", "AB7h5", "GetSystemDirectoryW", "-tSo40", "{TVq", ">TDictionary", "U2SXz", "85MZ^^", "StoredProc", "K+(.6j", "TDate", "][@5:", "Ux!(q", "Fa/+kt", ".Vi+!", "TFileCreateDisposition", "c/GKq", "L9 c`B", "?@^]9", "9VVu-", "dyf**", "!;*;v", "*OrAPPb", "6;6L6W6[6w6", "FFlCx@", "0K5IF*Xh", "ZQ+K", "fsNegative", "Y< XYO", "kWqAF", "5]_e3", "PIntfMethodEntry", "FAsExtended", "hW.%K", "B|2lY;ZJ", "aSMrm", "J jBh", "1FRo*", "{!}OwZ", "ul6K)dFd", "Exchange", "WN1Wm", "EF^Ic:", "6:6A6m6t6", "O{O]S", "7x}jO", "8PkvAn", "AGoDfcFyj", "\"(%V]", "'1XAw", "VqF}a", "xmnEsK", "Z}fX1", "]#L61~SK", "my.c9", "PList<", "2*zTL:", "DestroyWindow", "sDA9&", "2PA3K", "e@5V!", "+Qw u", "4/%Uj", "`>B^~", "3lTyZ\\", "x.kQ(", "w1CbL", "@U.-l^B", "{XGD'", "3!S4R", "h@H;}", "GetMaxCharCount", "CuwP>", "[73~T", "k?e4Z$", "lBm/t|<", "-{'>'T1", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:", "\\3uT", "h<,F7G", "6,E#GE", "xcp'b", "dL+b[", "M(o1d", "", "&op_Explicit", "\";wqu", "S3JK1p", "1JE$R", " 0@P`p", ";-;S;|;", "m)sFX", "&6!pr", "4'JN.TEnumerator", "6h[yvQ_", "rEWj;", "Y6i'p", ">=J[j", "tEtf%{", "TThread&", "j5^,2T", "g'j^&", "L9'wM", ",TEnumerator(", "EveeNi,#t", "TClass", "b^diM1", "=:z0X1", "6R*T?", "X~>E|", "7AbQa", "%YSKN", "/NCr%", "MROp4x(", "sN/8;", "$Z_^[", "NXD]{", "wqckQf", "%?HLfo", "^\"vdN", "d$H0", "vxYxm", "S2 :[", "jyLk?", "EhE}g5", "0K", "(?[%G", ")QlZmR", "^7'i'V", "jBd^K", "RZ6gyB", "<5f(#", "&TList.arrayofT", "6 757J7d7|7", "P4i's", "nW\"`G", "x-cO ", "uU0X!_", "YX@Ix2", "XmZw/", "i\"Z)\\@", "&)i{!", "FfW^,~", "N'Noa9", "B0--9j", "q#oJw", "v8DpXW*", "ohGKh", "h-_jr", "OnNotify", "7@-8sf", "#dvl7C", "O|:x=", ";M\"RS", "ik?I7", "mw[R_", "fTY:>LIZ?j", "wn+\\:", "1Z[Z@", "5,6f6", "'9[T}", "^{8!g", "nRve", "=#=1=I=]=e=v=", "w!4|/", "y<~He", "\"P1l#", "?)?y?", "b8{Eq", "[)TUC+h", ";8:\\LY1", "Winapi.Windows", "!u3Gi", "PZ~|u", "f|lzA", "~G_ l", "!-Jh*", "ELf;[", "Push_68", ">@[{;", "|F>E,", "To=eaX\"V", "m%8U-", "4+4?4T4o4", "TSetupHeader-", "jl$]d5", "jF3ix", "i|,vZ", "sr-Cyrl-CS", "wPnch", "{b(7P", "RSJi)", "EAssertionFailed", "92-gN", "TLightweightEventX", "FReturnValue", "Hph*L", "!4RiH", "qw`]^", "gRpAd", "TRttiStructuredType", "j}Yf'", "5GFf0", "QUA'", "QTri?", "lS6+[", "%HYTP", "WideString", "Uhe\"I", "FqV5~", "?zDPd", "i7eG\"s", "Operation not supported", "iz|(^", "arxx8911", "2.Wz#sZn", "4:FVr#A", "AStartTime", "V S(pTrW", "q]E'b", "i", ".+C.4o", "On8&:", "JYZU*@y", "cnamL", "25.zI", "@R7Ah", "$[L>?", "I5=VD$", "zh-MO,zh-Hant,zh", "System.Types", "`veP_q", "TL9gf", "PnF,Yg~", "^q70E", "8Bab@c", "B;||P", "DTDictionary.TValueEnumerator;", "=E0dU", "-wCO|", "1F4IP", ",5J7A/", "Iz)ny", ";qFY1", "LRoG]~\"'", "k/[#g", "$)nx8", "YO2Qk:", "/<[`H\\V", "6PD9a", "G~DG`L", "u=Zm@", "]T^S>2", "9zZoM", "SOoT5.", "KesjY", "[Lm1(", "8/}';", "r/|e`", "4oE*s", "2D)F=", "IsSubComponent", " az9d", "0X%T1s", "\\TEnumerable>D", "Zr?`B'", "%o,4:", "2JAVGBs}-^", "h]Ik75", "iso_8859-13", "?w@W\\!", "9+999F9X9", "Z,p*D", "[m^,}", "(k'q]", "}x(@:", "TFindMethodInstanceEvent", "AsInterface", "xy`Vr", "mi>}D", "|}H}k@L", "PBKDF2", "kaVl/", "EZeroDivide", "4-414\\4l4p4t4|4", "Q/_!o", "elSize", "gMK~A", "575?5G5O5W5_5g5o5w5", "4 4$4(40484<4@4D4H4L4P4T4X4\\4`4d4h4l4y4", "RW@/w]7^", "3Q3y3", "IsEmpty@", "7=7E7t7", "ydgC.", "k*i>E", "Bg,QM", "-Rqp_L", "KL/Oi", "AThreadProc", "ZiGvz#", "s(cjq.~J", "h[V5c", "nt_nL", "tudpiL", "~(S#IC", "gI5s+", ")NbeLK", "WLJWf.q", "w?Hy/", "SUje ", "G,9OQ9", "lCga)", ".=d,Za9", "R}b.l", "ju`:I", "(7xo)", "%gSiqi", "\\.ZApCb", "cu=0+Yt", "<'ls[", "[n&qU0@", "727G7^7q7", ">.v&\"", "gG#8w &", "Oqs%R", "\\3~bnQ", "#a/Vni", "Destination", "m,8?+", "QO#|}nN;", "JW{\\8", "pm>D'", "'bKnR1", "HM?nf-", "-)bp{5", "F6uAj", "ShortDayNames", "SetSize", "l96{m", "TComponentName", "DY_p\\", "&5U;cR>", "EM;.m", "Gy.&r1", "1RH]T", "o)Dt<", "BXbYl,X)P>", ",,1;^4b", " =Dv G(", "AHvlK", "9G:V:i:m:|:", "4 4.4@4O4W4h4", "!i;x-", "f qc5", "?xYw5", ".Ioa(", "cTqVT", "wQ|N;9", "ju7?Z", "?(?8?@?H?P?T?X?\\?`?d?h?l?p?t?x?|?", "9\"9(929>9K9P9l9}9$:i:", ";v'hD", "V>T6[", "LJ>;/", "pMoKT", "?0_REm", "v?4,O", "To/y ", "e.Y6*", "vE]9JCL", "YEt*}nRhl", "9?mo/", "sitEY", "csisolatin1", "euc-jp", "YGG@u", "(` k+a", "eFWmZ", "x,M6_", ":TSetupHeader.:1", "c^_{`", "zf+t$", "bHUmg", ".D!M3", "RF8bz?", "6#I*j", ">o>Nk", ")19l5", ";}Up~", "Hf.\".=}", "4>`5T~", "(Q7O`", "#W$YuW-a", "0qAoYAD", "1 1$1(1,1014181<1X1m1q1", "8$949<9D9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "%{,p^", "Single", " _>$K", "4CoRY", "JTDictionary.TValueCollection", "U>yV=D", "[Ev5-IZ", "'*.jf", "9b=(y", "\\\"AhN9?", "voZz]", ":$:i:t:|:", "WriteBuffer", "2 2$2(2,2024282<2@2N2V2^2p2", "Ky=jC", "!_ 1h'", ",]v>8", "z_z)a", "Pq!A]", ")rpz[", "2;Ox\\", "$XV$f", "e)&K{", "BuT=A", "E(x&d", "h{|Mp)", "/GROUP=\"folder name\"", "MAINICON", "\"OVM*", "r['6.2", "/cj(.", "!>kZ8u?", "= =$=(=,=0=4=8=<=I=g=o=w=", ";8;d;", "in'g&", "Z + 5", "Ze$Cv'=", "YG=[gy", "X\\U|s", "aRDOe", "w#Fj\\=", "eq;Jh", "Reference", "WvW}4I", "MIo{?", ".E'\"ZT", "biN[W$L", "i@[EO", "Qqq]W]", "*?@%J", ">3Z\\})", "vqj%a", "sOS^06", "?bfG)", "fa}'L", "*|bh]", "Ncddd", "GetTypes", "a4T+Pj", "TPropInfo", "FPropPath", "6U7\\7r7v7z7~7", "Exception", "WriteCurrency", "K#oq;", ".T_f\"", "iF'I%", "zFlZ.WhE", "0 0$0(0,0004080<0@0D0H0L0Y0p0x0", "[4a6i", "M8az>", "FPropertyType", "'MS>G&%VHr", "{Tc@M", ">,>J>X>r>", "6)6<6K6]6p6x6", "Hr0~*", ".q}r~", "3a;vV>", "K$3At", "P8>S3_8", "C^z/o;C", "9 9(90989@9H9P9X9`9h9p9x9", ";CQ7/", "oE)Be", "P@f/l'y", "98o>\"", "5$5(5,5054585<5@5D5H5L5P5T5b5t5", "VarMod", "tOFOu", "NB>Kz", "!cZ?{", "TUTF7Encoding&", "3S4b4", "ppz2wN", "jq=88X", ";);:;B;P;_;u;", "d5h2%9", "b4!\"]P", "1 131L1_1c1j1|1", "8hm)(od", "el jv", "lx>Ls", "IntfMethods", "D4=QC>", "pjUy\\", "9ctq]|", "P+#(z", "waxOp", "y0Ti//", "jv&{E", "`a8?r#:?", "Z&_HP", "TWyYxd", "TRttiDynamicArrayType", " FrCPvL", "#&Uw+", "V6_b?", "7>{~Z", ">/(|)", "Uh7NH", "YWWmr", "7J-If", "j1DVI", "(\\Bb.arrayofT", "i2#cV+", "j1ZF@", "*rl'9|", "DI?X}<", "gV?!l", "DTDictionary.TValueCollection", "Reader", "NI\"%*[v$", "-QBbY", "NW\\N#", "fu@N9Mw", "MJ1(!", "WDwXt", "K xQP", "hgY S", "{jYbM~BI!", "H\"W&n", "kUjo|", "q4bO$", "\\o{=D0O-", "_4L-a", " yQqH", "SJr.ParrayofT@", "GetAttributes", "srns:", ";\";*;2;:;B;J;R;Z;b;j;r;z;", "uPct]", "EOverflow,}A", "$5<9U", "&mdyO", "0q{/iT0", "k^E\"ME5", "p]Q[A0S", "9KWn=", " %2e@a", "C0A0?", "DFA6f", "746o>", "?pp:*U", "b@cv+$(", "C_GZ~", "a*eg.c)gw", "ConvertSidToStringSidW", "+Kj`^", " 5-ul^ ", "Aj'ZD", "\" =<3", "da-L}", "5TS44{3", "x[Ra7`", ".oKZY6\"", "~Emnn", "=OIK7", "X^Nk;|", "/I>P)Z", "iso_8859-7", "ni%Cx", "B[fez", "2=nR5", "R:YzqK", "LQJnf", "s%lOHvsdpo", "8F91D", "SY51~", "D+(m#", "TDispatchKind", "OnKeyNotify", ")F0^r", "Rf\\~d", "g#0)Q", "/1.#TC2", "[bmPL", "`.hs=O", "-2LBN", "B2%[5", "%'Enl", "7<;5X", "BS#X", "h}A gO", ";hawG", "uaKFgx", "gZ==x", "o6GM{", "kgmeG", "zY@S)", "OO,0Rz", "9[+8jS\\5", "'}f(5", "5~bU~7", "r>>ZM)", "a\"&S.", "]~^*3", "Kk'78", "^q>;^", "F7f8|)", "ddAuto", "g+&OF]R7", "C^?fG", "!rS{6", "6IComparer", "$3T1K", "Tkiz'i", "[lPFX", "2l6&Z2", "%[w4A YL", "pm%8Ar@", "OXmK{", "BZ}s0U", "4^Ywp2", "Sb%e;", ">>079]", "0TEnumerator(", "\\AFDI,=", "@u{k\"", "2 2(2P2^2t2", "')oiHT", "4X^#F=", "QQA\"3", "3)434?4J4W4\\4b4", "C\"bggK", "XvDiEM?", "#TsS8R", "YZXtp", "Do'!`", "2149f", "IZ>L<", "WN6dp", "z@w}!2", "qE0hBl;YK8V{F[", "tkArray", "ANY^/xs", "80&]^", "nyIEO", "m%*|cO", "f3v24", "F?pZ*", "ChY?q", "Z'x# u&TR[", "t#A(.", "&JhNH", "Uhx%E", "-0B0S0h0v0", "3o", "#x)vL", "IrBevt", "}^HRa", "2[I;\"", "tyJ@#zWT", "j'8~Q", "a~BCfBf", "Wh',C", "O> al", "CDS+`", "Q?_Y,", "S}~LM", "vhM%(", "R,$*0", "R3$>S", "fS!XK03", "/+8n]", "", "71xep", "@wp!C", ")^z1Rh%O", "3&3-373X3", "Q1HSi", "8]o^[#D", "E45X<", "e+=s6", "q>R];", "LU#NE", "UX9,85", "8r8/989K9Y9", "LOX3C!", ">&>+>D>T>X>\\>d>l>p>t>x>|>", "XJ.pJ:", "mhSb:6v", "/fzk,", "#f&SDi", "0I^nZ", "/4[\"]", "nZFKLB", "T7A7l", "QD.e26", "L2K7d[", "tX4G_", "him]{1", "-QUeA", "9B;v;", "s&@NU", "x!mI6", "BFl\\^wX", "fsNDenormal", " TList.TEmptyFunc", "@5R`&", "fg\\\"r", "$0q0a,", "AFormatSettings", ".5$*{", "y4s)C", "kU6py", ";Z?Ch", "3*AaR", ")3hnc", "m/\\kW", "p(Sbp", "`52`s", "yT(Bi", "360321235959Z0U1", "$3?}kU", "o?`r^g", "fmNCg-", "L\"C}v", "^Ser.", "hALCd", "io7,Zd", "2xz~!|", "GYk@/D", "1J.ZG", "QlPdmSn", "!n;f{", "N[wdZSpT", "7S?m,<}9", "9*X,B", "bAL\"c", "}{%ZV", "s/c$T", "?Lg#D", "!c!Dk", "L,*Ks", "leCfs", "H|*b$", "\\LH92", "u8`u9", "Inno Setup Setup Data (6.6.0)", "soCurrent", "9+Cy|", "6T=+@eb", "G2**]", "iwy|/", "^F-c*", "mmF9^5", "AShared.EncryptionFunc", "Ie>`d", "N{Ms5", "X#(rd", "<=xci", "UnitNameFld", "%k.mJF", "4%4?4M4\\4o4", "oV*4?", "3&H{#", "{\\0z^Gqw", "b>5Dz", "RqtAY", "l)G]?", "dDRzID", "NOW[6=", ";9<=<ME", ">4>D>H>L>T>\\>`>d>h>l>p>t>x>|>", "c3@{k", "/f-#].M", ">9aX#", "QfjmK", "*l'87", "=Fhm>", "Vf.,O", "p&;$K", "at46cj", "%S^.P{", "585?5F5M5T5[5b5y5}5", "p|yUyU}e0T", "w'\\Gqq", "S&H;|44", "{AZKOr'", "<\"6|{H", "b\"<6B", "5OjNW", "3x?)ZD", "0!030C0K0Y0l0|0", "d afd", "xu+dI", "FOnCreateComponent", "a20IQ$s", "a/<[&", "IsWritable", "H&K;<<", "]B9UxDcVNF", "L.[-V", "I%d)i", "D1:B?i", "*Aj:c", "dpYes", "}3bdL", "Bn.bq", "rqi_@", "< <$<(<,<45y>+", "/hr>b", "TFilerFlag", "70aVbx", "*1ma@", "AThreadName", "c3s:b", "j@g9&", "RD_^[Y]", "$B@gj", "_X$E|", "y1(=:", "Windows Server 2012", "2vVK2", "/adl(L", "o0\\uZt/\"2", "\"7?z%", "\\a$UY", "%ue)v", "929[9", "A1I~3]", "/#$K]", "=JF0C", "%TList", "l8x!2", "(AYjQ", "f;wTDV", "NA,l=", "]W'zR", "f 28#c", "NmZ.=", "%{]j[", ".(RC5", "PeRq{", "\"W)p>", "Floating point division by zero", "}<\\\\t#z", "BlockedCount", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "", "'V]%Rt", "NcL==", ".nr}I", "^:G1/]Qu", "kx:c?vC", "42sn2", "\"\\FEaJ", "Vnad/d", "<#).G", ":Pa0'!-", "QCsTr", "SP.Bb", "H@Av#", "QyS6@", "UV.ny!", "i{F_M", "Taq09", "Z42nt", "b{#%F", "2]#h.", "N{E.^kC", "J.,3:", "W8D)#", "msNiEz:", "Int64", "SCFc0", "z:.0J", "u&hy6R", "H;JZj%e}", "}4Ep&", "\"DnYV", "?'?/?7???G?O?W?_?g?o?w?", "+H^#m", "4N_&}y", "}uo9T", "UnitCount", "#[q%1", "nFfza", "#cMu\\", "]_^[]", "TMonitor", "Components", "vuF%%", "'B;%~R", "62-U>", "!P\\g|q", "v}mz#m ", "3$444]4m4", ">n+cs|", "r_;y=", "2T\"}>7", "5WW2/", "LeaveCriticalSection", "`;o%F%", "~@9.-i^", "qw4h>\"", "|S3+_", "OBh$v", "*UelC", "Instructs Setup to force close when closing applications, or prevents it from doing so.", "|#cs|", "CW9bi", "\\wCX.f", "&(&`UruCm", "'BPnoJ", ";1;?;L;^;s;", "=G>h>t>x>|>", "6F5VkY", "r-dN|", ".)=UCuS?", "aGq1x", "EmptyAsAnyType", "&op_GreaterThanOrEqual", ")Cpk'", "|LK/j7", "f6{WQ", "Ya3~b:", "SW(vk7", "{cjA%", "vsH4,", "@tR M", "%s.Seek not implemented", "ClassParent", ">G>]>n>", "8`z<'0{", "C=3{p$", "o\\,YZ", "Ne$^85", "N~yz ", " HHm;", "Ym4=VSM;", "l/^Jgk+i<", "EF.{k`r", ";(.ParrayofT", "2+AJ4WFZ'", "0X6qE", "]9;Ae", "b?i/Q", "UhzEI", " [O_xa|a", "M|y<;", "{X)ca$>", "L`$|E", ",&'gN", "X:VKr", "Q,u?a", "z(<|4R", "RBY3,", "C#!F;i", "?'K>~", "121E1M1[1i1}1", "t{}C", "x%Ld^", "8&8.868>8F8N8V8^8f8n8v8", "JsP^c", ",ojZ ", "2h{<3", "y#k@j", "{S=/R", "1 1$1(1,1014181<1@1D1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "+U>41", "C(N;{d", "8>8i8", ")0W)O", "iZkn~", "thGT7", "th$FS", "#eIys", "mtj|^", "T^;2s", "*TArray", ";c%S1", "}SBKbO", "?DW%:", "TFindAncestorEvent", "&cdxl", "`CWh4G", "q033.5yU`", "iG(){", ".o$nP", "EHashException", "8pT", "!/9JB", "FreeOnTerminate", "@TY\"&", "RemoveFreeNotification", "yI{-", "Dzh\\Yu6d", "4,4>4P4e4x4|4", "Zcd?B)", "_cE7p", "rKIKM", "mw`2i", "\\gbN~", "Mz2ss", "G)+cu$", "o3ZOJ", "8OO`e*", "# %]?", "&f!,CI_", "&sKd6", "1.Y u", "FItems", "Ylnv4TwrA", "M_:G@", "F AW-", "laCopy", "?c.4u", "UAi", ":*Wqs", "}G(Qd", "TCollection9", "QTLt 4", "`_T6^", "W2ceS", "-3GCSPr ", "(9J#OC1", "9 9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "?!?4?B?o?z?", "Entries", "9|`}o@}O-$K", "O^774q", "`2$(<", "= =$=(=,=0=4=8=<=@=D=H=P=X=`=", "| >M\"", ")$6S*", "=I,V=", "cL*f6", "WU*N[:", "`.0Ds,", "656F6X6`6n6{6", "~/8edp", "GyizD", "TMultiWaitEvent.TMultiWaitert", "Invalid source array", "v#[p6", "Hz(", "s_@}L^", "mg`~r", "0{*b@", "@[cnF", "RmF'/", "3E\\zXw", "%G /h", "0J%nU<", "=`x[C", "NdBe'", "volatile bool FFinished", "ofTuL}", "TInterfaceListEnumerator>", "@Qz4vq", "fgNri", "'ax^Pt", "@5M|v?", "FAsCurr", "xLU3,", "6@6H6d6t6x6|6", "ITDictionary.TKeyEnumerator", "~#hY;", "AEncoding", "v#\\u[", "s~T`D", "HTArray>", "JeZ^]i8", ">-$YS", "H$hnn", "Systemh", "The Setup program accepts optional command line parameters.", "GFViN", " hHHa", "6'7|7", "w5l0@", "HjC>B>", "W{Spx", "=1&j!", "$ZXw<", "zIZPk", "OT)k.", "BE?n=", "Finalize", "[:pi5", "5EFW]\"", "6SVF$\"", "0$0,0K0", "/7*MXi", "'d=$z", "twN^M", ":0Kkx", "Listh3E", "opRemove", "MaxValue", "y=)/P", "ddddd", "HeapAlloc", "]3\"Y=j", "To({\\Rdk", "\\S3ORW", "Ca`H]", "]MnD@,Bf", "H7Bi5", "L}rwFQ", "mJ(:,", ")4Q]p-", ">e\\4|", "N-@BK6", "_JG4u", "2J6ok", "OQN$_e", "na=>3", "-9S~u", "000S=", "Ed<{x", " TList&", ".TKeyCollection", "N1y=}R", "EM;=:/z_m$", "8m!tN", "Qb%_i", "},~ZC", "c}'GZsi", "(^5^/", "TIntToIdentK", "@.VgV", "NW?iI", "hTmK2", "4#41494G4T4t4x4", "FInitialized", "?N?hQ", "?/N }\"", "Ls}6y", "$!ojk", "U<-Z-", "(f(Dc", "U_B2H", "&TList&", "|pmDh2s", "!DT62Zr", "*>@?U", ":@@kQ", "4$;t$", "Uh^eF", "RandomXorFirstSlice", "/(&]F", "AppComments", "xZn`R", "trDb`", "N-.TEnumerator5", "|kCrF", "|_:_/", "dU6$]M", "XuoZv", "gec:b", "< <(<0<8<<<@'", ";#mNb", "HG}Sg", "vO:4@", "_cMX0", "%a/\\%", ":-@}i", "_.o?<", "hoMy|6k", "_1`k}", "qo*02", "Q0hmH?", ":jTs-", "lG26K", "s6sqw", "gJ@wm", "C_$Y<2", "1HCJ5", "TOOHz", "rZ)[J8", "vaSingle", "7-7@7H7V7d7x7", "wk{n!", "7g~J]H", "hq(8%", "6|PnEB", "\"i*^5D", "{Xhl}Kpq", "weme0", "I?CQ^o", "EndReferences", "/mxi-", "|O`EE:\\>g-", "2l:Ls", "/KZ]R", "}\\bga", "*TEnumerableH", ";9}#6", "^rJqD*", ";_^[]", "'.hQ\\", "h!qj2$", "6C:Z;j", "|q5!'", "PSZ!&", "T$$#D$(#T$,RP", "?)?5?=?K?Y?g?o?}?", "T*K+M", "kVX>%", "D3(P*3", ",7\\pn", "w|#QWI", "QSVW3", "9$CM?T", "5m2K9", "1,2c2{2", "Vu#N\\", "HBx0$s[", "%RPT(lL]\"", "z2dsi", "8SOEg", "lO5Kx", "@5JMX", "J#zCM(E", "az %w", ",K7Cu/", "5$595A5", "B3jk)zo>1U", "h)Q]Z", "_R09I", "2$242<2R2X2{2", "FBNOS", "&_SdG3z", "^+qTK.8x", "9?OGdg", "av4eM", "Zv/q=", "[g[`WP$z", "anX!]O(", "l7S*,", "]?>;t\"Y", "csunicode11utf7", "j@3K7", "StackTrace", "X\\\\DUU", "5O#R'", ">v,#b'", "$/T,yv", "&~Dt!", "plE_:rO", "o=K(U", "lZRc7", "w}Q%f", "i6md{", "oQ?,B", "o!/_Q", "3cz&b", "4&MR^-", "ifHasRtti", "^tXED", "@Eu&u", "7<7F7h7x7", "Bi`hWWdR", ". QJc", "G'~m-", "LongDayNames", "3Y]L,", "h3#G'D", ",f#b6", "TFormatSettings.TEraInfo", "[_2}m", "/Fd@8h9", "(x,Qk", "5V 9Dy", "zEPmC", "oN(pr", ",,,l|", "+_rWB", "E}ag%", "uXDew", "T4zK{", "-gGab", "jQyQ^JQ", "c(L6R", "zIv*.", "=uj7Q>", "C=t!Zm", "System.SysConst", "VC`3?DU", "L=-/o", ")o>h(", "2&3@0", "WiA[/%", ";-;5;Q;t;", "%n| U", "LMNrr", "`?^U2&", "9!:N:", "Sm;@Q", "]h5G+y+", "[J`aMz", "B]eP^", "#*Gfg", "j?=}@_", "aL'%Y", "*au5+", "FRootName", "h._x/", "mLSXh", "6-$)u-2", "g6tJ/", "EQ|cvGx", "GetVersionExW", "6#U!ja", "`e;w@i", "gNc;%", "PJwA $J", "L`@o\"eS ?", "R)Qd0", "B8Q%r<", " hd@F", "+GJVd", "LkiR{", "g1k)`", "LAEC<", "#HQ+2", "Y>", ")B.`r", "{`29Q&", "BVs4^G", "I,[o[+", ")fM_8c", "V 6AO", "Fb;c1", "p7}i@", "xy?b%", "67hde", "q;790", ")ZE~5", "gxvGG", "8btSo", "lu[6r3", "?dqU`", "LJ;*w", "A%_z|i", ".bo+d", "bcrypt.dll", ",uj'5-", "nmdkb*", "6ZfJGPUK", "3 3(3034383<3@3D3H3L3P3T3X3\\3`3h3p3x3", "6\\:jZ", "~4%@x", "TProcParam", "x!q!2", "OnObserverAddedtEG", "iIBrBE", "3 3$3(3,3034383@3H3_3t3", "<\"<(<0<8<@", "%TCollectionNotifyEvent", "S0p=|", "Cardinal", "R1p\\\"G", "kA.TEnumerator5", "E~N^o", "{+f v", "7;?E{r", "w%{lf", "s:p5I", "_S+5_", "Ma_*v", "u(-=$", "KO4*h", "R5T[L", "=B:_\"|rA", "&l{BGs", "(J_io5", "6B,P#j", "Z&lCD", "7|mcR", "BEg*e", "H`\\q6", "Q2n\\0", "O\"_;+", "q(SdX", "KhpC%", "6D6?C", "G\",wIM", "w?Db=\"", "IsStandardEncoding", "V\"\\roe", "m`s/Aw", "vDWFy", "]KTsd", "^xm#!*.", "v>R'x", "N!lt+w", "ExitThread", "]iW80~", "88OJ};Mb;", "X a,D[/", "rolp7", "*+rUc", "{\\6VQ", "{)&l8", "\\Szs$<", "[y)NpA", "ExtractItem", "qEh`]", "9jF_eO", "QR'B3v.gn", "/.xeb", "^2\"nO", "f3h,v", "7#7-777B7L7W7a7g7y7", "}KFC6>P]:", "Fd$.E", "r7$A8", "~6A77d", "#%&m\\", "6H2*#", "QNy~LG<", "Lb\"\\%W", "f00`2f", "nkz8W??", "JTDictionary.TValueEnumerator", "VZ|QK|zj", "6BhkZt", "8/878H8Z8b8p8~8", "s@VP]", "e%l|Z", "/", ":6:::>:B:F:J:f:}:", "+}\\wT", "$]_^[", "B87\":^='", ";O$#%", "<(<0<81>D>W>l>", "TLZMA1SmallDecompressor'", "ReturnTypeInfo", "XIKXL9s", "}c+F@nA", "e9:Hq", "mE`yy", "~Z+|b", "T8o7eP", "+}!\\IBf", "pIv*g", "oji&xd", "*9F>f(v", "819G9[9", "cJqtJ", "1,D", "8TEjg", "]tv;#\"D5Q", "Ancestor for '%s' not found", "e%We/", "u&bD92", ".Ob;H", "2e[57,", "Boolean", "U8NNp", "'V~1H", "DRr B", "CriticalSection", "0 ImK", ":c)zM", "mW[@'YS", "Fx1P2\\", ":$:(:,:0:8:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "=K", "$TEnumerablel", "DFf+!Pr", "T$:)L", "Of8a\\", "|eG_q", "*O02G", "UninstallDisplayName", "d!*L%", "3G6.z", "O1uzh", " ", "=07W3", "x>t$9", "7/}4D", "O'vTD", "tp;4l", "=VwT2", "F#2Ko", "NJbofo", "Vai'x", "GetArgLoc", "2,2?2M2c2v2", "-2!c{", "A[Slx", "TFileSharing", "_pp.[", "g2`G8\"", "'eTy*", "sEL'm", "KWQER", "+%nBy", "KoHi7", "E/B5B", "t4Syb", "#3*I6{$F6", "L`1^ \\", "!aM(@", "6#606D6Q6f6|6", "KYGxg}", "aw0\"F\"", "ha6zd", "o[Axy", "8JbGW", "eWUCG", "yh2A`", "QBEKS}", "jA9Z|wo", "G5&C\",S", "Y|60\"6", "^n-\\=\\", "+\\8n#$", ":@:y:", "4(40484@4H4P4X4`4h4p4x4", "TRttiMethodType|", "WwV[D", "`nb6%f", "#Fa)b", "]-`X*q", ">DNkM", "l=bGo;", "H>!2B", "v{Wi^M", "F0ju5", "\\+K9t", "ty<=[]", "7 7$7(7,7074787F7N7`7r7", "n\"d%4", "EAccessViolation", "+{@GG", "r3zj;>", "(Q[ atD", "AiwD]", "ap*dq", "This program must be run under Win32", "Bp2hJ", "$TList(", "\"!faM", "DzRBF", "o4EJ0", "N{\"We3", "Uhm*F", "kTz\\8", "J7VISND", "h4np7", "MkTUn", "eZ]Nf", "/@KTG", "BozV#", "xfo1jj", "mkProcedure", "))*4p", ":`!8c", "~f&Fs?uKg", "opX-M", "X0Uu!Y", "G-'8J", "MO*i!", "zc9;|", "", "fv$\\A", "^3e}c1Fd", "5Ib;}", "5Gb>Z", "hAG>cQ", "IEt;h", "IoBfk", "}r5}L", "g<", "qI`+)", ",XhH~", ")8!BK", ")'!I'mD", "1j[0\"H", "mqx6v", "B9g.'", ";+;=;V;g;u;};", "dALHE", "yKMr7|k<", "&M}Cy", ">C>c>", "TArray", "iL\"sF", "csReading", "GXhx6", "1=Z\"*n", "011Qm", "cb8!K\"fWP", "8&mB$", "? ?$?(?,?4?8?SMB", "Dd-;h", "o2/Z@Z'", ";:8sG", "\"nNJT", "\"#%UN", "5.5:5B5S5g5o5", "*R0[e", "D\\,)~", "jr' )F\\", "^jc^G", "525C5Z5h5y5", "`6N84L", "?'0D@Q", "0!0'0,02070=0D0J0V0^0g0s0y0", "]yW>\\I", "&4 okI", ";\\tY5J8", "gMY#rG", "UhxOI", "YRsZD", "Gh*[E", "yVnJL", "1!m]{", "(|ZDE", "R/-LO", "8_bMv", "6&Iv8", "t}ftX.z4", "Ns84xa", "\\lwy}Hz,", "XyDW%C", "|4J7I", "NrUch~", "W[mCx:>k", ";\"PG`", "rWCB;", "Azo6jA", "yO\"E|", "^kQ_k", ";7 zF9", "(TList.TEmptyFunc", "J6@%M", "m=Zf/c", "/TEnumerator", "TPrivateHeap&", "CompiledCodeText", ":Wn2<", "Specifies the internal name of the language to use.", "(]1EN", "JG3%_qL", "GN\\@h", "ZS7!;", "t$>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>x>", "^3]kZ+", ")j4\\kz", ".w|l[", "&\\!dZ", "Ka[.a", "Extract", "V%H1C", "+cLu_", "$IComparer", ";A>XX", "TCriticalSection&", "}MVV)", "=D=Y=j=", "(!m&n'';", "Dl52B", "TPropSetV", "(|Z$CP", "QS6 d", "u7VVQ", "]TEnumerator>0", "9PXV^2", "C@Y!U", "Hv{vu", "&RDh5", "Hs;dY", "[Xw2E", "aTEnumerator>(", "0,0;0C0Q0c0q0y0", "B^(9J%", "AFq)M", "CZF7fCk", "&i^f|", "Wq+u{", "#@1wL#f", "NZEW", " w`a(", "303c3n3t3", "c&XFD", ";]KCd", "[&", "2H2t2", "7TCollectionNotifyEvent", "B!b.g /@=6", "#Ext-", "a'vp,.", "2Tnec", "&C?,w", "jw|A(", "`%\"`8", "SdW:[", "Zano~jAS", "\"", "V*AZPc", "ieOG[", "I>a0,", "^o*_M", "DLIqP", "J,xEG", "sDNIG", "kEL&z", "jWOA3", "DUCGi", "Lub.v", "JOrU?", "sd]A_", "_T~iv", "C-[bm", ":9\"%~", "TIwdm", "UhTDI", ">kQ?q", "K({9uk;", "hr?SW", "8*8<8_8c8", "<}nj\"xv", "n!9&2", "232@2H2V2h2y2", "p?b8m)", "Ksa)eI", "M2#x/", "iz)@I", "!vy6n", "6$6,6:6G6Y6k6s6", "dh:4+2", "VDouble", "e+KQ>IQ~+", "`W:aM", "M)hyn", " TList.TEnumerator", "XXzt(", "kieH[Nl", "q,hPJ", "S=U:R", "PProcedureSignature", "MethodKind", "&TEnumerator(", "HS2s g", "dgOLU", "~`V\\R", "&1Ben", "'Y#N6d", "n@C(0", "Z>mB5>", "Go4cZ{", "VdZX)", ".arrayofT", "Ijjz@Q", "j2:0)", "r,7Lr", "@;&#+W", "!+X&yVJ", "#75R*v8X9", "ivX05", "2,2A2Z2k2", "JTDictionary.TValueCollection;", "dADR(", "p7:FCj", "UhZ^J", "s#;;)", "-t_u+", "i~^Q$", ")T8Z;", "3L4b4y4", "MGL?H]", "IntfUnit", ">{~u-", "(,\"jL", "oy7{S", "=F>Q>\\>", "0J'f!", "N:{3k", "E[0by", "Wz+Hn=", "L12Z:", "tor[gR", "Yfw\\%", "\\W5[X", "pgbu+", "#@3o%", "W~o_\\", "~FtqE", "wW[U0#C", "FBlockedCount", "IEnumerable", "7.767G7U7]7k7x7", "Overrides the default directory name.", "tQkU,", "`v0wF.^pC", "iYEh<", "DynArrAttrData", "}Tu;;K\"", "**bQ\"", "/xa!ONW", "C[XtL:I", "M29)R", ",wyZC", "wdsDynamic", "ZRpKigz", "IsType", "QO?_Ct", "'B<`\"", "CcB|Jb", "y<6`S", "2J2r2", "~yfff", "c\\2(E9{", "CTDictionary.TPairEnumerator", ":-~z", "KHzQ;", "*3s:R5", "GetLastError", "L'74mF", "TValue", "G1nDh]", "{ wK(", "FE>X_", "D9p`uML|", "22A%]", "td]hx", "ReadInt64", "wdsDark", "3+8me", "5A-@=", "%0!6kf", "<6\"4N,", "}s5>B", "\"7hlo", "%9aKD*", "7#n1<", "?Fv*_", "1%2G2", "TRttiPackage", "9#'6J", ":~fjjlCRX", "]TEnumerable>'", "RC;HIg", "pfVar", "System.Hash", "8;s7*", "#TThreadList", "p{?#*OY", "Type_18", "1(2=2K2]2l2t2", "P0qs0", "O5^Ck", "Atu,q", "(tgtk", "`.l/5", "6`Z*v", "IwYk2", "iso-celtic", "QGPwIwpYtn", "f>_a6", "Z$f8(4", "^(O*q", "AmW{\\q", "x?XSl'", "/@pH0", "=03I7", ")y.fH", "Invariant", "V0P>t", "6n.T\\B!", "mebYpO", "M3n4|l", "'K]#da", "4!lG:", "8X9_9", "&BB$F", "P?J6p", "Q^~Ra", "J*5,z", "%+wI~", "6OG56Yv", "LicenseText", "}+SZsT|", "J7T+p", ",X+@?l)!", "he6m0", "`PpaN)!", "ymotf", "HPdW?", "6iHvM|QB", "li%JF", "TInterfaceEntry", "csisolatinarabic", "+h)P4", "zvoIG", "91!K+", "3 3$3(3,3034383<3X3o3s3", "oGgE ", "v^5Y E4", "q;[Kqv", "t'?yQ", "mVr-zBG", "n3'{4pF", "{])\"(", "0lQug", "J&M9^4", "LockCount", "#z%tV", "TMq;W", "TIntfMethodEntryTail", "[KCpJ", "~a\\Bj", "tCoD5V", "c~+}U ", "BrBXkS", "juYl5-", "x[g=dk", "!/bh/", "iso8859-3", "%LazyLoadAttributes.MakeClosure$0$Intf", "0N(N{", "0e~M,", "bFB}|", "4h(wp", ">D?\\?", "\\KGS9F", "l+{j^", "EVariantBadVarTypeError", "O5X9BB>H", "3,3B3P3`3r3", "rwn?EcM", "{\"m~l", "rA.bY", "ZG xV>", "vh[*Q", "889X9`9", "X}$Mj", "878V8", "8C0DFg", "tT3,a", "eF3c/", "?3?K?S?[?c?k?s?{?", "7\\<]^", "Ji6;\\}", "//REl", "cW&0^", "7m[^}", "|tJVp", "]3/.d", "E^38v", ",vZyB", "#vUV&", "1z8'I+", "4{qu$", "opInsert", "{Js6t", "7$7(7,70787@7D7H7L7P7T7X7\\7`7d7h7l7z7", "td`ss{", "UNDB/", "ViGr\"", "oaTRT", "f!\\8Ff", "7$[u~p", "HxIPQ", "KFBHuuy", "cec5Z", "jp7={7", "Thread", "jr(E|", "macthai", "D(wh\"", "HJV=u", "\"\\)RX", "=2^V!", "Eg AE", "RUf)#z", "r@H>4", "ko[v]", ".6JYN+", "", "!LuZ-", "7Pv!}", "cp1251", "&>2VK", "Y;ugL", "FS2,7", "Mbmq~ZT1", "VU>+j", "FixupInfo", "YI?0YAFa", "xV);l?", "ahPRsr#", "zRzn0", ">f8h+m", "CFsaz", "?+?R+", "DNkRk", "CJF&(p", "TE\\c+", "s)ISd", "buB>=", ">`m\"-", "1#1<1M1[1c1q1", "2GAs&", "6ppzp", "PTypeInfo$", "-^zLH", "Jg1m^", "TWriter", "EStackOverflow", "GH1aC'", "<[%2J2", "PVariant", "=+=@=L=T=e=p=x=", "y!H.Hw", "kDpZv", "Unlock", "?Vt0W", "&85ix", "VarR4FromStr", "7uJJD", "#2h-k", ",o0Js", "'bp(2", "RawData", ")+6*#h<,2", "\"w*hi", "/LOG=\"filename\"", "~-vUYR", ">;t=f", "n,9m:h", "CappedSize", "#Nt&tc", "SleepConditionVariableCS", "b_n?r", "Z&Ssf", "sDAUN", "\\(qH=Fp/", "ALeft", ".id}u", "+Q^iaa", "0;UC3L", ",EUed", "Lsfbs", "[,apf", "tpk$8", "2H`*V4", "'@LX]", "9X5^G", "r&L&b", "2&fO$=", "BTDictionary.TKeyCollection;", "{>+G/", "RKlkH", "UDP2xE", "_aa3?8", "K&:ZH", "K\\Q6f9", "5k ^g", "`=Z,o1d", "~~gT&d", ";|rIs", "%rDS.", "<\"<1<9V!", "KeepContext", "[$;XO", "Tg#b>n", "TB/OP$^", "SpecialType", "GH1&_", "P(]_\"wg", "uESGZd", "4P4`4d4h4p4x4|4", "wx%FPq<", "A(q-!\\9^", "P;ZQ*F", "w.Vz>", "Aa0b)%", "!~40oY", "}m;TI", "l`]='", "u2:KG", "},52=,", "csiso2022jp", "IDispatch", "5O6S6z6", " 04t}|d", "{cA?9", "Y\"!j#", "U;Jr[~X", "g8eq=", "v0&}4", "l&85m", "q59:&u", "FReadPropData", "YxCT9", "IgnoreChildren", ">YlK,9/", "9 9$9(9,90949A9X9`9h9p9x9", "\"`0Qe", "][k+`", "ZXUD#", "1TList.TEnumerator", "File not found", "D,tnYx", "qdnsg", "zH.@R", "4]d,|4", "aH!?f3", ">.`+[", "9PQYM", "Mm#[K", " tNsM", "]eVWQ", "+NjvH", "z7$j(", "W'$T^{", "QgLj@z\"", "@\\OL2", "<,Lu", "}D'&~", "4|!q=", "TProcSig'", "(H:xG", "!Compression.LZMA1SmallDecompressor", ":'~c''", "l3u&i$ Q", "waAJJ", "rPqyM", "yX7wE", "sl%&e", ".v:3@", "X!uoh:", "IgU4rT", "tIa>*", "qb4Qm", "FReadProc", "~ +[o", "#!u_4", "Kt(XH", "k2&%\\P", "j\"YH&", "\"H", "P\\\"X,", "NIv5ng", "1m2\\I", "S$J08", "&((((", "=/=C=K=\\=j=r=", "onj&3", ";='rH", "?>qjlmm3", "8Z<>`", "UHdeA", "b5Oui", "QualifiedName", "Currency", "(k@oB", "Qv^}m", "3'3/3L3\\3d3l3t3x3|3", "s5]NH", "X(X|sZ", "`O^rd^P;", "NR#$S", "=)%v8", "TEM`[A", "$\\^-k", "!hOk-2>B>J>[>w>", "+Fj/!", "y?@)(d-a", "XOPS:", "]a^RA", "/C8<0~", "4#4-4;4E4T4X4`4d4l4p4x4|4", "%HN@0", "j+^gLN", "B]:LY", "tw\\HD", "a6}I\\", "g2)7M]", "-Winapi.ImageHlp", "DO.]3", "HTg#A", "2 d>N8yV}", "[@t6Tp", "NJ7iD", "x/L.E", "ba,gC&", "Bu;k<", "/\\&p3G", "~x6lx2Z0", "Da\"eL/", ",J\"Yz$", "E2`Xm?", "c}Gct", "W~3Yy:Gm1S", "*-OXa", "I%SsP", "5a|f%", ";L|wy", "7v%@\"", "uE6E/", "FTail", "m-]@I", "t|\\@c", "#B)LFN", "E!_@X", "?J\\aZ", "3TPair", "FHandle", "d8RSN9", "UnsafeAttribute", "IjnJ1)g", "\\Qcwjz}", "PU5iY", "3rLH$~", "RecInfo", "-iIr6K", "RZP:e}W", "ZZI~m", "ss' d", "Yb6QlII", "y*W39", "DWWWe?", "Px1qQ", "ccReg", "b6DKvv", "Uhq9C", "~m}SH", "P]_^[", "FSentinel", "E5 KIe", "+j\\\\,#r<", "Vkkn89", "7)7T7c7g7", " wsTm", "UqS?W", "EZ4N!", "8*979o9", ",t9+Wx", "sV1}/b", "NWM:m;", "lqj!>U}", "Av#{p", "csCheckPropAvail", "PW-k)8", "T><|%", "4 i&r\"", "'", "HhW,5Q", "myTXK0", "", "~3\"8bde", "drfS3#", "4d^Y7", "]:N!)", "qD6%{C", "7>>nd", "IB]]y", "(eE3~", "mL`;cm", "m", "shift-jis", ";Y_yb", "3}9^ ", "U$Z\\`", "!cxw6", "Czp}Z", "}Q6|hu", "cXB?h", "QL[TW^", "XKOYZ", "tRr'\"s", ",w|Fz", ")URcd\\b:", "Wvvn_", "e)j[V", "?Ni$~g", "-;>=W", "@y/`T", "99#T/", "T)?gP", "I,PVYOo", "Mv8/w", "E=y$d}", "52YPbD", "'ZPv,vQ", "3JTzy", "yv7s\\", "!zE%I", "^SPWe", ")<(MLP", "aHz$m", "iX^pc", "525R5p5", "G.Il\"", "PrivilegesRequired", "iso-ir-100", "}Y4y%", "1*1N1`1r1", "ks_c_5601-1989", "/VerySilent", ":W$3%_/+o", "z-t&E", "c\"(\\W", ",TEnumerable'", ":P!e3", "tX]Pf'", "0F\\U.", "c^/,1mnM", "*OnpW", "U3+p|", "-:vg;", "@0:Bb", "Invalid class typecast0Access violation at address %p. %s of address %p", ",System.Character", "UgE(7", ";RSH'", "+\\VHe", "]E4G,L", "FAncestor", ":E::W", "@%AL{9", "9iVh2", "-yTu}%", "Observer is not supportedLCannot have multiple single cast observers added to the observers collection4The object does not implement the observer interface5Insufficient RTTI available to support this operation", "KiZr|@Y", ".;*[R", "Xpgyf", "fr@yC*", ":%vD*", ",TList.TEnumerator", "Stream read error", "~fkBW", "~m2kc", "kIlV06", "/=iiHn", "&h\"P^`", "4=n|q", "VU6bW", "\")M&a", "tp_Hr", "3)Hf`", "er9]z'\"", ",", "gO]1/", "hU=WZi", "V*[geq", "eXZ>[D", "[bd'3", "W]%lj", "+zaDM", "}u?5T", "Uh.ME", "%%~Ca7$", "/W#\"%", "MjiZ(o", "EPHkv", "Abstract ErrorKAccess violation at address %p in module '%s' (offset %x). %s of address %p", "vX+`@", "}RK`\\", "YsA7|", "sU^wA~", "P>`o?", "P8^[]", "cW<\"/Q", "u *t1(", "zm/cy", "HRicG", "2 2G2Q2U2t2", "TRttiInvokableType'", "9%939B9U9h9v9", "wp}sQ", "+8[!!k", "[\\kv7n*zI", "(3q{X =zEV", "5T~j$d", "/aJ3!", ")}*WFH", "F@;-U", "i{+pR", "On|#d", "YmgQ6", "}mo,-?", "7LAfNn", "\\Y>mDv%", "\"D^7$", ".A+Ue", "x+O`d", "KKml58", "81_Db", "TComponentStyle", "I^F!F\"", "6\\&fP;It", "]i3)X", "2/272E2T2n2|2", "Aaa3J", "D1AY,", "A]>ud", "GR'lOt|z", "%QZN%", ")AkBpm", "0O1S1", "S%==c?", "z\"]}T", "(IZ+W", "{!7$>6>K>Y>a>p>x>", "VrTf\\", "C/<}>", "]>AXl", "DefaultHandler", "fjX7)e`", "$0~{qD3", "56789", "FDecrypt", "$t]vV", "c:~'ff'", "cwZm{p", "84'\"M", "?(5@;", "6Z$'N", "747B7Y7n7|7", "EndWrite", "oRwbU?", "V!#zp(?", "@sV&5y", "Xp7M^>", "0X`DlB", "T%dGF", "{_cFF", "FCanObserve", "^?gb?", "@~Sj#H", "~(q'`P", "FFhg),", "1B", "Yl(5:", ">#>.>", "jZd~lWl", "d%o;:*dD", "~4-i5-", ":+;J;G=p=", "E*};_", "2=o}TI", "7\"717B7U7a7n7}7", "3 3$3(3,3D3W3[3|3", "PAMLOtlVp", "s_='p", " ih0D2mr", "A65i[^", "BkU'9", "DASU/", "hgOPo(", "|nIm>", "$QZ#Z", ",Sp0}q", "{y'U}Y", "N8\\HD", "DNjk}", "0lA|]8", "6}1&:U", "ZEXh3", "FIndex", "4w\"I'CP*", "irI=g", "!:q\"C", "3 3$3(3,3034383<3`3~3", "Z{$}W", "FExecuteAfterTimestamp", "\\2pU\\", "/W#U>", "e '\"`u", "[lfX2", "H3K)D", "wu:fM", "hF62?", "z/?)Eb", "PJijq", "0Pl4\\Si'", "/COMPONENTS=\"comma separated list of component names\"", "$P@&", "", "f,#2A", "GH6e7", "6ILZXc", "E}=M$", "ifUnused3", ";sV*u", "FResultLoc", "f;BZ]w", "=GVrp ", "7{MpV", "uWuj,E", "Q7#IG1", "01 7{", "0 0$0(0,0004080<0@0D0H0L0T0\\0d0", "%9YS;.nX", "K %%.ParrayofT", "5%6)6P6Z6^6|6", "%F2(qG", "(0?3'pK", "M[4hc", "AItem", "Q4_^[]", "!me\\J", "t2-0@5", "f})uK`", "><>l>", "R|;q+c", "9.:2:Y:c:", "LurE[", "ASharing", ".0b2k", "6,646<6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6", "yKX~h", "0BJE 'uAV", "Qmi!'", "\\Bjpk", "h91^Ww", "9t{'D1yFY", ")psLJv", "p=v2iHo", "USy2=Ib", "hr*bNU", "{`xeV", "B!n;D", "5#5:5O5]5q5", "6&616B6W6m6w6", "qHH!:", "4o!Mc", "kLyGo", "u/F[L", "R,=ISd", "|{eg0`S", "0+0/0Q0g0", ".&K>TmF", "X,T9h", "0)010B0P0X0f0t0", "FObservers", "22i\\d;", "ts7!:o", "TEnumerator(", "S(", "r}s3-7", "3-VM.", "HZ2';", "y Pq{", "k1@f/i*L?", "WizardImageBackColorDynamicDark", "i:VJr", "Eh2?I", "B=C)S", "]#p4A", "O t1C|", "9ZbJ|", "nnMc=", "Ib\\~[(", "meTqe", ";*q}K", "Ig vD\"<", "Winapi.SHFolder", "6,6@6S6g6{6", "T`nCmO7", "1`:lk", "(%m[X", "z@([8", "r>^?!", ")D6LC", "Z%vLI", ")q_w:", "@NtU/", ":Q]`B", "Y6Up%=", "hgL4S", "BTDictionary.TKeyEnumerator;", "e3\"E/", "ER+&u", "K|E$G", "TArray", "YQ&(O", "~K]L%Fv]", ",mqy|.", "c{KkFK?", "dMZe-", "odS.GX ", "D=-P+", "*|Bg0", " !ACs", "EexKP", "5gHW_", "|pO#V", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "7Vs=3", "U=:}R", "$~U%2", "0 0(00080@0H0P0X0\\1`1d1h1l1p1t1x1|1", "0:1?1X1h1y1", "=\">6>q>d?", "z[rl7", "}", "j4u},", "1#191P1e1y1", "EObserverException", "b", "FAction", "uUn1K", "OV>-~", "t8> V", "+68(;", "?'?5?G?^?l?", "=CW>Y-", "D:\\Coding\\Is\\issrc-build\\Components\\ChaCha20.pas", "r2<0%", " A'5s", "j,#:lfR4", "QQQQSV", "TList'", "Y5VO^_", "o9+yh;", "iKXmCS", "oD9:n", "}>#Uf", "&@u1?", "\\^cD9", "!c%w>", "VuLSD", "tpe\\&", " Hk#Mg", "ContainsValue", "|50QNoi", "0TO--C[", "r_>e6", "_e0sW", "BeginReferences", "G/bCy", "I7r2=", "?\"?9?A?a?v?", "5H8mQ", "l+`}yU", " \\9RTt*", "W_P^`_", "&VDFp", "YxRm}!", "@&wTj", "@!t(i", "BWWOmVh", "Diz~Y", "T]7:0", "cJqG", "i%w#3", "lVo/i", "9!9%9)9D9d9h9", "L8", "6 6C6G6n6u6|6", "KB `|L", "wLZ$M", "S;*q|", "Z#lZ\\", "MM(c^", "6`I4u2R", "(c>v\"", "GetEnumerator", "\"CjF;N", "w{5&ez", "GetLocalTime", "RHgYI", "i _+d", "~$0Hj", "WriteIdent", "Instructs Setup to load the settings from the specified file after having checked the command line, or to save them to it.", "TM$G`?E", "9=g)M", "z'aWB", "+ol#$", "&U7.%", "j|`K=", "v]*!T3", "OE{W", "FList", "9I\")K", "g+RU]", "9c5'UhC", ";Q'B%", "L\\c}kEo", "rqLm_v", "Int64AttrData", "f[hbY\"fM", "%6472G", "{-}& Q", "(Jtwu", "~5plz", "ZgsP]", "[)`Q4Mc8", "Uhdp@", "SqpZ]", "#K!>+", "TAsyncConstArrayFunctionEvent", "$$e`<", "rAXQT", "{|qxlv", ",BZVg", "y;K]q", "2~OC#", "[wa9yEL", "MDP-N~", "<&^>R", "?!?2?M?h?p?x?", "/CURRENTUSER", "WlO~%", "/yQ,n'", "^BvW ", "`!gw?", "Nj^E3", "6`7m7", "!ZiO4", "Uh/QF", "@6R#,", "6|gs*", "k_u*ZE", "~a!~V", "9jS~2", "?Y>G?h?", "p=nKh", "?qu1J", "J{|^6f.", "DXX%K", ">Ej@t", "#3:I*#", "Component", "*jcbm_", "=*P^|!", "m6-_9", "0PPrz5", "4L4R|", "Pa^*.", "/l*1l", "#yo_f", "]%d{f", "SI~Fo", "Ot.k1)>", ";{%I5", "K}Iq5n", "]@pM%z", "kr'4.", "^i3MK3k&,", "TThreadPriority", "csbig5", ">y;J+-&.arrayofT", "#i\\:w", "sq,?>", "W/b=J", "{!g:D", "F&y)[Z", "m(wAb", "3TDictionary", "]7g^J", "Bh=jj", "G-v,<", "TwoDigitYearCenturyWindow", "@f6Jx", "*TEnumerator", "08'yf", "h.j%Zis", "1/161M1", "QUFHA", "gO^+G", "R'-)Z", "}]]x<", "UjyfN", "U\\PMa", "\"nfI|N", "Kz51vX", "Keys8", "+:o:d", "AFilename", ":B+hFP", "?9=.v", "B#fJ\"", "UhRx@", "407n7", "$5e8r", "/&s`Rn", "FRefCount", "C6jh_N", "5 595A5O5]5q5y5", "P$bzoN", "lV^Ar", ")\"l3;o", "uy>+s", "'Qi8F", "EHeapException", ")FB0x", "-z.\"o?^", "Comparer`", ";]lntAiWk", "rRA|#", "TRttiIndexedProperty", "(/xbj", "+_:Q=*v", "`1ie( QO", "1>#oL", "l=jo:", "O\"7]t", "MBZ)7", "G$/cz", "GQ %G", "y.F9 n", "Ry*", "^O<%$", "8YZD7", "^B=;8", "t0X`E.,", "R|jM^@q", "1tXZl", "Q!azi", "I\\(WU", "T+&/+E", "p~1nV", "a]q;lL", "5$5(50545<5@5H5L5T5X5`5d5l5p5x5|5", "BufferSize", "rwsWZ", "M4/bm`ZP960", ";r+r7", "~W-Dx", "A6ZHb", ":55{E", "?GppXE", "System.Generics.Collections|rH", "5F!=3}", "9>kcr", "b)TlV", "ccZPej", "9r8.7", "H9g1wN", "TAqR0", "6\"7W7", "{P5cm", "8$868O8]8o8", "OHe_X", ")9r:\"", "%_~74", "g-ZGI", "NewIndex", "t/W>+", "bh7jv", "|\"Gf#", "w'[yOp", "CompressMethod", "gau a6", "x5}7`", ";HI6.6", "CanObserve", "7:k?2", "vlePF", "rPw(W", "x&ii\\8 6", "|aK{~h", "tOEgZ", "kNp?J", "EPau7&", "2msyRkb", "FH*3Y", "3F>lL", "ac(hyAF", "\"IiIJ", "FQ9Bq$", "{#:GF^", "7@!?>X", "\\i&7$)", "iYgQ(", "p_& i", "RWyc*", "z9m2*w", "x?TW%", "^+~>E", "Nxj[D", "EOutOfMemory", "YDbZ-", "feh3|x", "2 2.2E2X2`2n2|2", "K-FO0~", "TMonitor.TSpinLock", "y$~\\[pU", "%']!2", "0 040<0M0[0c0q0", "X@@^Z", "&TZa0\\", "/$E[?4k", "csUpdating", "csiso2022kr", "b]Zw|", "_+5-b", "pko6>pQZ", "TList&", "slk5e", "nB]pK", "tm'M5", "m{nxr", "[}e_P<", "\"^3g-", "GIxL{", "$cpI0", "K,Z&?", "7>[!o", "PThreadInfo", "J)Y,]", "dnYSQ*c", "VmNXwB", "Z[o>H)", "jk-FwY", "SystemX", "2(2N2R2y2", "@B3?CO>?", "&TEnumerator", ":l:q:", "DO -Q", "]plGuM}", "Gj@p1N", "W5J'|z", "*6Ec3", "UKy_Y", "I@=/l9o", "('llDz", "VExtended", "UhG^B", "BE8{e", "Ef*()", "TmBNg?", "`j/&?", "ZgQ}9", "(t1dhy", "'Su.De", "vs=g&", "3MO?O", "DefaultUserInfoName", ">F6,C", "'o*4f", "{B,f9", "G&UbI", "N,k&^", "=$>P>q>", "+PydU", "8'd>0^", "wa={%_", ">:y}@", "LSr8>", "skAV$S0", "Hq9)f", "IntfUnitFld", "]A;YEL", "}#zn7", "?%m$~p$/i{4!", "j=O if", "-\\1Xg", "(uxC(", "R?Ld9", "6#6+6<6m6q6", "E% 3%", "po lg", ")TList8{D", "_l$E?]v", "={%]+", "GvxU2", "5\"B+y", "EQvct", "P][5@,", "iAo?~", "QIg)K", "jb9#pH", "euc-tw", "Z~(rD", "1@>26", "^!VAg", "[-%O1S", "<~mAR", "ProcOrMeth", "L4snX", "z{Sug", "sccCompressedBlocks2", "d`uQe", "414f4w4~4", "TArray", "wmlU9n", "-k:ZSY", "# twevw_+", "0$0,040<0D0L0T0\\0d0l0t0|0", "PProcedureParaml\"C", "hIB8BL", "_)g1v", "cm:bt", "4O[r4", "Z2$wi", "u1=yN\"%h ,x", "I_aK&k", "x\\;7U<", "YWY{8", "P8s$c", "Uc(&$", "csiso58gb231280", "$u2W~e", "mkpud", "Llhc=]", "C-rs3[@D", "M?ZZ3", "#h}NyI", ">3fx|", "@_f^?", "\\tF2[Q", "kb >,8", "r8P][", "FMzL-", "l43r}Z", "r`9.Y", "c(?)V1", "\\*B<<", "[L-ysY", "TH[,z", "MoP|p", "J.B.TKeyEnumerator", "=*Ld]", "Q\"\"?^z", ".Ox>[D", "eM8u;", ";\"6f-!", "UBi]uZ", "L@|>s", "cp-gr", "{%E'[.", "S6Y{U", "External exception %x", "j*s.B", "QLZWi!J", ",%Mxs", "0C1c1", ".W|[c", "oa9K'", "+J\"`9", "7'7+757=7E7", "7bj o", "=Sm6G", "!|?Gp", "onv,OUU", "AByRef", "IH#>qUjZB", "%R~cj", "YKRH3", "dv#0A", "G^<7,a", "2p$g7", "X*&2D%", "_af]~6", "c_NZ+", "ElementCount", "DX^k@", "\"h]k8s", "eybY~7", "GetCPInfo", "`u@BV", "sr-Latn-ME", "TryParse", "6=,g?", "8%868K8Y8j8", "l\\drL6,", ";-y MHQ", "?acCM7:", "_!-]=#", "&)V`Ub", "8C`AT2", "@UUUUUU", "rU~u@", "{Tnu=y6", "DupsAllowed", "565Y5a5", ".&:#4C", "wL>cO", "pGv>x", "fhQF`", "Shows this information.", "iso8859-2", "+Cuy>", "4Dt[ar", "%zw)f", "beqN%", "!4=?L", ">+>3>A>P>", "}l11K", "hd\"rI_", "dSystem.Hash", "_doaz", "!D!A.", "TuZA6Uk", "Qxd,qA", "b(_wpP", "&|rFr", "5=2S|", "CB*Xb9", "O_v@?J3", "oYtNP", ": :$:(:,:0:4:8:<:@:D:L:g:z:", "~r$6'oz", ")66K\\", "/3X 2f", "--_6L", "Z;&Q", "dQgkJ&q", "I`N ,G", "AP+iZ", "U[~p{E", "System(#D", "-6Rd&C", "T&@R.", "?Jwt2-I", "BDuZ*o", "F\\\\UPB", "K/QNg", "TEnumerable'", "=9YZn", "tTG0x", "macintosh", "j8>F^aw", " Ul%z", "z~R6x", "NMX{u", "= CHs", "De3+7", "B|05SN", " k#O3", ",AO]c", "}J2w0O", "z7x<1", "KuW[-", "X(A{%[V,", "FAncestorList", "7\\Mi#", "dm:dT", "mfO#|", ".didata", "{.v?}", "_vZ~s", "Bb_35", "-Vm5B", "[o7\"N", "psStz", "hF lUC3", "$x:b\"", "=BlQ[I/$", "?%?E?I?g?", "qt_D;", "y3[O7", "psW5G", "pFp}]v", "FjIn<", "kaC{|4I0!J", "#+6>*/", "KEYM/", "4Y8A(", "%RNVr#", "StaticQueue", "Yield", ")u$Pd", "VirtualProtect", "JWKT')", "X':\\~", ";G$tF", "JTDictionary.TPairEnumeratorH", "`S4@0", "W\"A8&", "; \":#", "n3hG6", "MFsvC;", "-XY`u", "EDs&'", "-vho#", "0w;Qm", "9:Ijv", "9=nV&", "o|>=h", "-&}1>3", "69\" _", "`]B<>/", "57^7(", "0G0yH2", "/Hk-sJgL", "a0iyF", "?7?B?", "}VbheP", "!x'z!", "6<7@7D7H7V7d7p7", "/DW%k", "<9\\KF", "SjdT5", "gw$g", "^lX#M", "Or#xE", "n$Sv,", "vG@^!", "Please specify the password using the /PASSWORD= command line parameter.", "5%(d(", "kM_Ew", "21@/C\"", "MhB41fWw", "Rrmglb", "~4M$e", "KH(r:3`-", "TList.ParrayofT", "mu6eiTDn", "3r-Wh", "jlDNu", "S7H;w", "ixTas", "H3Z#j^I", "}+05A", "iVnbJ", ".Rp;|", "? ?$?(?,?0?4?8?.arrayofT", "ibm862", "[\\ShC", "gh8Bg", "%.\"Z&", "?$1^@", "CwG~v+s#", "505>5o5", " TArray", "-g[36.", "4q2i.", ",EN/_6", ")JTm>y", "@4lse", "p#S*y", "$q'+Z", ":R:l:", "0f*HWT", "owS3k4", "cV\"_)", "?", "\"###^:::", "{!|..", "GetAddress", "4 454A4K4U4[4g4t4z4", "E@zxr", "egX4Bp'_", "bmaI2", "qM/|>", "}[$T?\\", "/%(j.TValueEnumerator;", "BN%]cp", "l?qDW", "E*>N)h", "{,%3/", "WK#a4", "{p')J", "^3sB<", "KnHk@/)", "}4vo!", "aP\")J", ":(:6:J:W:_:m:", "KfL^5", "a@PrnI", "auxR6", "RelTarget", "~HKIp", "d$R'(", "~k!~8", "BHl{Ss", "->5>C>U>k>|>", "CyY2(", "tRf:J4", "9i9x9", ">x,L&", "kUeTList.TEnumerator5", "<-n", ">:/a|", "1{'q]-", "T?~", "<,<0<4<<=", "o0m0F", "HCXlP", "gSV>$", "-.W;+", "20251124160459Z", "jNwZ_", "Uh", "iso_8859-9:1989", "EFilerError", "6&vEs", "{=Yw(", "e~!yA", "XQQ%ai", "7$7?7G7U7c7s7{7", "5 525:5H5W5m5", "3$3,3@3K3S3q3", "2gbyzO", ".fN1s", "JfM],", " type=\"win32\"/>", "iso_8859-16:2001", "e)]=4E^So3Kf", "eutc=", ">$%:&", "EF4+U", "InitObservers$ActRec", "EG$~`", "=/>", "hgSro3", "Iurte", ":Q_L ('", "|Tu( ", ")5lq=", "3!Zxn", "+w[C6", "8 8(8,84888@8D8L8P8X8\\8d8h8w8", ".vR=g^k", "808E8V8l8|8", "wb(YPK", "HN//m", "B;E[O", "4&444B4V4l4", "X/#\\}", "5i/qH", "x0\\e:8", "Yf6z,e", "p@,rO]\\", "Cx4p5Cg", "PE(Qqji", "\\g6 S", "pZWg}", "TRttiNamedObject6", "np'1N", "A DH+~J", "m(W@\\", "WriteWideString", "CUN1M", "6c[-Pd", "1'q$-", "('!n[", "X/LUw", "K0O0v0", "r1a3 ", "S.UI$", "iaLQM", "@_+p@", "i.~=CUn", "3]s\\p", "otc-3$", "*m5i*%", "x-X/([", "fX*e`'", "PList|_G", "f\"U?AR", "I$-MQ", "\"g@A A", "%pmT^KY", "AsExtended", "d]c-c0", "nv, _P@", "7X$h]75", "w&B.8", "mL@.]", "sQhSV", "1d1y1", "Sn.7UaP", "Xu$\\x7q", "", "St]jY", "Hua~IC", "p3U;H", "8;|:X", "rO[,N,e", "M:^]9", "I3ski", "Uh@", "|vrFsk9%", "m `/n", "TList,", "BPajr", "@26,S'", "eE\"b|", "5&5?5P5t5x5", "$OoI]", "@M.k3", "),s%]?", "O5VmA8", "i&~iq", "OP!ad", "vtP].", "nQrlqN", "|&0yJ", "nFqlO", "9E7R*", "T>V.r=>p", "Bo3v#{", "{wCFN", "?zWpd", "|@!:Id", "xQ$vL", "Ebx&J", "m4d(m", "E5V;j", "ReservedStackSize", ":#Sb(", ":$aTm", "V-~:4i", "IsHFA8", "9-9;9J9\\9v9", "f1/K|", "1%2E2L2t2", "EThread", "FComponentState", "\"gL^\"", ";OIjao", "1$121F1z1", "RT~=@", "yn+%$", "}C}@D;l^", "?1?U?", "#Aq_6", "\"^WHzv", "$Sectigo Public Code Signing Root R460", "D~+nb", "PVmtMethodEntryTail8 C", "sVK/L", "D#B0P", "8H=R?H", "FItemClass", "#|u,z", "7L7l7t7", "!ePJy", "%2?YI", "Sp\"BJ", "^=P/|", "8d{FaT", "e;pA#", "o:?kR#", "6%616@6]6c6o6~6", "koi8-u", "90X0h0u0", "Ayu8nK]", "EMathError", "K6SCp", "d'0O3", ":FFX7", "DTDictionary.TValueCollection", "`78|;", "6B/B)/v'", "1TCollectionNotifyEvent", "9'909j9r9}9", "UhXhF", "Z# I^", "B(9Q#", "'~*W0", "P)sU!", ":TDictionary&", "S2`t#q", "WFx1I", ")Jv:1", ";.;B;S;q;", "L)\"$h", "6L6\\6`6d6l6t6x6|6", "#$dU_~V5", "sbC|~:0", ";EpDrs", ",xA/J", "9-f&yP", ".<-TV", "l9[u}", "F,C!Fj", "~d", "TM&1R", "@U#-u", "]jIk7", "S6\\'p", "dSystem.SysConst", "I02!9", "?c) =Q6", " 3-%}", "5pUzH", "pLE<hqjkOsR61", "|#T,m", "Se!(pI", "Ai:}My)", "u{RY,i", " }n)W)", ".X$5<~", "X}rr)", "aBF]\\", "f{K2n", "2%232G2^2o2", "9JZ+EU", ")X7u{ ", ")te&b", "R ;lK", "\"vDNJ", "g0d#cb[E", "zAW*G", "Windows Server 2003 R2", "5$51595J5Y5a5o5", "Bd]?we", "", "yBAoA", "$!W'd>", "[%})t ", "_oRTP]", "j(=pL", "oM>p]", "#oSVX", "iso-8859-13", "Nqcl A^", "6gMK'", "[lXs_", "?c", "Jn&N^", "1}F= ^?I", "VGp$G;", "XtX6%", "g?`I^j", "2$2,272@2q2|2", "*RyEs", "{;NRc", "k`lTa", "~t@\\p8` >=e", "[dHR#oL$N", "KW&Dk}A", ";yZtj", "'qAf|\"", "M4.6y", "_4ySq", "L &}Tp", "f\\mwt", "~d#,9", "TOrdType", "IzXW{", "Y= g7un", "X6Q6f6|6", "$Z@'H", "PlXlD", "<1p[=0", "xsZ{u", "Winapi.Windows.PkgHelper", "t}|t[", "TList&", ";v$r_0", "'tOgB", "sKex1", "mP/wY", "_Qt@z", "EBZL8", "8Bz{M", "ECompressError@bJ", "Item2", ".w2|Ze", "TPropSetV", "#:R[uK", "5qfP+R/k v", "H+85Q", "Q;Cq2[", "@F^+]", "vh;H'", "Y5Wc,", "~W56T", "Error", "Bo(Qe", "VFOt-,", "7>&G$", "H(pH3", "*O:Zg", "ok&6x^", "+edEBY2[V", "vmSJs", "UhHPC", "pqdddddddddddddddddddddddddddddddddr", "/xp]$", "5JiTw", "ddz@5l)T", "U=%v\\;", "h,g\"\"", "4SbR'", "]ym)'6Ho@`", "GUaHi", "G0D.B", "FromSeconds", "gMG(<", "Nv2KA", "`Z(6^", "uK|+#", "ITDictionary.TPairEnumerator;", "858G8O8]8o8", "8.82868:8>8B8F8", "`uR1:D", "TPropSet", "grw(r", "CR5lxg5", " zd:u", "#HVz~", "`a4k]", "DWAl{J", "IsMoved", "K\"i 7", "*ly,3", "['pyf", "u:>(~b:-", "'Nb}3z", "O'>\\;", "TRttiMethod", "]]H]hp8", "&oRd&", "Rg\\QJ(", "M^U1\"y", "?-!B6%", "Y9jSw", "UH+E*S", "ActiveClass", "4WiOR", "D2`jM", "% d4o", "f3ZzI", "8y9~?", "w.<4&", "IsArO", "$mgF(;", "MaL_m@", "TGre_:", "kU%m$", "}dl%-S+", "%n}\\?z", "5t#oyw", "$ms61C1", "4wfX", "0T1v1", "G;$s/", "|g3PFO?", "OwnsObjects", "Group1", "t{E3!", "U514&", "Pu/{Vi", "t?", "FThreadID", "k9K=_7", "|;+", "(b@l}c_", "w2`-.b", "\"D;cJ\\~", "T\\VFb", ":wmBO", "U=;E`", "$9*:h2", " ^G*z", "FJci4", "O9.gU", "~y#}y", "$u", "c>TW&", "L&{5T", "ISYuo", "k,", "BF#zr", "o#5n28@", "Ob}C~", "M-A<[", "f/7t\\", "iso-8859-15", "9FX_R", "xB[le=", "{*g28", "6BB$b", "C.", "Bk .(", "n!$.M", "cp861", "t\\hp0", "8pAzQcUE", "nE93DG", "VarSub", "/7Vp?@z}S^", "$Gb%4", "66xdm", "{!/NA", ",*G&O", "g@.J1", "%[gez", "kMFnW", "Rd!$x", "`oFgn", "$M4uH", "W{$i4", "9V&w'", ":9:C:G:h:t:x:|:", "_ay!68", "-T0mcX9+", "|zHPU", "|Nh'J", "c%tf1i", "H*:i7B", "N'ZE}", "e^6E,", "t$_L<", "6X2q=", "eT#G9 ", ",e,|F", "hy+6D", "NZ8Aw", "pV+xg", "p.KH,.", "*,BF}", "^5zeS", "4)2Wi", "3pHrV", "h*?ir", "2Vkg)", "F2eCV", "o&O2n", "$Sx>|", ":{ll@", "FOnFindAncestor", "QF-{gR^", "AXVK\"f", "*TMethodImplementation.TFirstStageIntercept", "T8GtX", "}m%Tx", "]YKOV", "vz7_4", "pKG/!CZ", "6].HFD", ",y [yJ", "vMRI5", "-t{{E", "yxOJ4c", "g4{3Fs", "brCKg", "-^G7&", "%I&/f$", "$MZDA~", "ATUf]I", "/\\KTJ*", "System.Classes", "2Mh.ti", "1y<.H", "f)D#N", "mt_[?p_E", "HasName", "*=qYW", "=I>[>o>", "= =$=(=,=0=4=8=<=J=\\=z=", "]p-", "V{e!f2", "CurrentH5H", "[+3H0", "L bR9", "5Xglt_S.", "HPPGENAttribute5", "zo6~z![(", "vaFalse", "nWD'8", "VWVGQ", "WsEC!`4", "9?;~KF", "^E\"aW", "r<$cX", "!EXG#n", "\";Y\\hmHU", "^/O[a", "FTypeInfo", "(YgyR", "P,wE^", "](^Khu", "n7R&t;*", "L'y).", "gYY_g`", "daL{u", "Ch #Q6[>R", "p5e/c", "^VcuTU", "Y.y&D", "kSw%#Sy", ">H_f\\", "UTF8Length", "Z`4)q", "q[3, U#", "bW(1Q", "of4CC", "w\\tJ3", "OrdType", "wa~ne", "_Tw7a#", "ZL[uz", "EL%j8", "V>6 Im", "(fto;q", "Y[e?(xZ", "`ahv1X", "^yV9+", "rn)u-", "GetUserDefaultUILanguage", "aTEnumerator>", "DynUnitNameFld", "V6_:J", "HC{z-U", "djW6CS", "&TCollectionNotifyEvent", "iY??~", "8Cfw:", "TWriter'", "NW!KS", "5'565L5^5f5t5", "%p!8\\=", "\"))S$", "0,TO%g", "#6RBYQ", "VObject", "[_'R^", "Property '%s' is write-only=RTTI objects cannot be manually destroyed by application code\"%s (Version %d.%d, Build %d, %5:s):%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)", "YtX", "2-efC", "9s:|:", "jzL?M", "?2?:?K?Y?a?o?|?", "O#@&t", "0.060G0U0]0k0x0", ">qUzGz#", "5z-X+", "tis620-0", "UGZ\\\"", "CurrentMinorVersionNumber", "mAAa3", "0#0F0N0V0^0f0n0v0~0", "8\"}ZbB", "e6/U&=", "VarCyFromStr", "TZL/>$", "SGvU>9", "fd;}kc", "3),fX", " W\\HB", "X$HS/L*", "]@_*&qU", ">=_3W", "_u|`b", "windows-874", "384H>", "< 2>^>t>", "c.>[%", "P 6[J%>", "hpJ5f'", "4 4?_T?", "rDM+[", "MP6W'", "ASpinCount", "5D'Y_", "@bsGZ", "*TEnumerator(", "G!^fPB", "6wvAK", "lNP", "2TList&", "L\"'fgDE#", "VirtualAlloc", "'TMethodImplementation.TRuntimeTypeInfos&", "zK+/35X", "VChar", "Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread", "k>>#;", "fV}-5", "x)LIC", ".;3nl", "z:1Hy|", "j*s>l+", "SZ_99", " JH;FOi", "\\J{8<", "#,'q0z", "9\"9*9A9", "{{/@,^=", "}GT(r", "FReadMethod", "/w2Q\"", "/+dN*", "VKg&Y", ",__zn?", "x) w{/", "+6ryw", "x.P{#Z", "$TEnumerator", "W-rCV", "CryptKey", "MinVersion", "oH@|(h", "Go}@<", "@1Qpf", "l!]a'.m", "#SLiU'", "{Da\\['?", "YPX}#u", "F!@UN", "fsWrite", "$fjNj", "VmQ3n", "~\"+S\\", "gW)?iZ", "/tbnW", "TTypeInfo", "&TEnumerable'", "PpUxi", "5TList.TEnumeratorpyD", " 4]na", "~ ,2x", "a-nl4", "v*C8I", ".TKeyEnumeratorp", "C\"bwU5", "GNB{D", "p=Gb)", "'Dy3)c", "*'@-x", "G4lx?", "_9%H{", "j[w'L", "CurrencyDecimals", "v|Svd", "B|rX3w", "7\\4", "KubPe", "a`21E?", "K%\\#>+>9>H>", "{iV@|", "$r\\{r", "7@!Kc", "FUseBOM", "}7]:Z", "kAI%_", "UPM7Ea", "Z{]Qv", ");_qe\\", "TEnumerable", "m^x(4R[", "&U\"V$", "-SA2='C", "o`OA.Pu", "2j&df", "+YH|L", "WgbS>*\"f", "AfterConstruction", "At{\\M", "(8Nn`", "The unexpected small block leaks are:", "En[!?", "*TEnumerable'", "20OdFJ$", "`i<{fu", "fo'->Z", "Q,el$E6", "38}I^", "z.W8C", "iP{O6", "{RU6%", "9M+60h", "NAFO4:", "TMultiWaitEventImpl", "GULi@", "u^Q0`", "!HApI", "FFatalException", "$b;lc", "3 35393P3^3d3", "=ExtNBtD", "|W9xrP>M", "o~Yf0", "Jtl^3|", "^F .w", "%6h.)", "S]BP,p", "RGdn:z", "OnError", "X-21_", "Rxg@,", "_C+,[", "@'v&81)", "Q,|bH", "=&=<=N=`=n=", "oYPI>", "GetUserDefaultLangID", "8@9I9", "8t@ABl", "tW}MD", "fL%($A", "80a", "XQ02B", "AppId", "VT-jW", ".ecdN", "t*`^8", "Tn&37", "v\\kMy'", "a,*!O", "rFuXW", "]|G99S", "* Fe;", "FOnReferenceName", ">Zb@h", "9ZN/1R", "Comparert'D", ";\\sJV", "<|x|CK", "k(K.`", "ToniG", "^z)6n", "_*|fB _", "!9&2*", "sXYcS", "TryAsOrdinal", "2%2B2T2e2{2", "p/LC4", "R[p3g", "p/)&J&SO", "ZSZ :%", "&k:>F", "DLe7<~", "dhW4b", "[Or.h", "KTDictionary.TValueCollection", "<;=B=", "*&iZ{", "Gn4zZ", "2rq~~|", ",><9z", "tT<;v", "tttT7", "14/]q", "b~m}w", "2$272P2e2l2", "cGl6{-P", "3[l-3", "z:IpJ", "n&:3!", "z@DaZ@", "/HFT$", "d7&glrq", "%XTK1n", "U^Rpv", "6 6$6,60686<6D6H6P6T6\\6`6h6l6t6x6", "Y_1-9", "ef=5y", "%Sectigo Public Time Stamping Root R46", "`y4TC", "9J[{H", "Y`,05", "uvzDi", "b$:\"1", "J(yF<&n", "ZEAF'", "B]6/OW", "wCt@/", "_8yIp", "W9ZwT", "L0Tp9", "RaiseOuterException", "Glq\"*", "lRfE;", "L;.U[", "WuPtR", ";KV&.-", "IU>78", ",*!B2m", "3g{9f", "Nm;#\\", "*KHF&", ";\")Km,N8", "v)_x=", "vj`lT", "1*1=1K1_1l1t1", "#fpJ$/", "^:r!Tx", "3Ft_C", "\\o9aZ", "R\">m,", "fSYw&", "\"%0[D", "FrId'm", ":,:A:O:c:y:", "}?=O:", "I:w`F", "=!Cj>", "EOverflowH}A", "+Q*$W", "ys>`@M", "4Da;T", "ibm775", "i.TEnumerator5", "@\\S-<+", "jJFu{", "K[e@O", "Uhc1J", "fgc-c", "{C!OL:7", "WJs]w5d", "*bn}Q", "AChildPos", "h2yAM<*", "VSingle", "cKLu7", "J=2>)\\", "AJ,HV", "'@}*,?", "3g#flF]", "c<$QS", "JHX1q", "|F$i7", "}mt>J", "F`3A^x", "Cp)Yr", "#%&`;", "I_;NVh", "&Zp/w\\", "*T nC", "QkYwW;", "( OiF", "SZ:M?\"+", ":_s2\"", "@;e\\j", "R~@R=", "@ sM f", "#c* C", "FOffset", " S9U", "^}kUr", "Dsas+,", "Y1U?sv", "X.E?ME", "nI]c#", "[i,y#", "8+8;8O8W8e8w8", "R@I!Qp", "5,5<5N5V5d5q5", " :5n7", "oX\\$C2", "EndUpdate", "f'(5_", "b&s`l", "KfmoP`L", "3#%Ej", "C6W9N", "u28^C", "Specifies a custom exit code that Setup is to return when the system needs to be restarted.", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "<2,>L", "[/xp@s", "*DMjEP", "JYk@E", "sr-Latn-BA", ",6@sJ", "m=Cd`", "6K&'m", "p%~Yo", "4Y 8p", ";NRlze", ":UGzi", "#9*G&", "gQ2T^", "9vJEK", "6'aaI", "l=uE4Vg=", "> >(>0>4>8><>@>D>H>L>P>T>X>\\>`>d>l>", ":r!+;", "ONR&[", "6Fss3", "(\"'&|", ";#;-;7;?;E;S;n;", "~ww;8l", "HR%m66", "Hllw1", "a1eZLu", "TlyUU)", "uOB;Q", "\\>vZ<", "iso-8859-14", "lG\\hT", "5z5^II.", "HP?W,", "[:1Gux", "iso_8859-8", "VAH:5", "=k}W/", "CLmNl", "GetReturnType", "y_Mfw", "8(%9$ ", "%TEnumerable'", "6)2]JQz", "2)272?2M2_2q2y2", "&Push", "EArgumentExceptionlpA", "macgreek", "-exWK", "8.y1/", "6T%b_9", "i>]FQ", "Ox\\7P", ".nS]i", "E>2jGT", "tkInteger", "GK{Sg", "N_(yr", "X0:b)", "fFo?V", "rzvy%n\"i+", "aC|Za", "2kCnO", "Cfp%W,ltI", "8?9|9", "T#Ue9", ":%A#&", "f:8s6", "D*j/|", "^4l|A", "/ICJM", "h0G1)2N3X4l4", "lYnN0", "?,?0?4?", "$Fuyy", "\\!^0v5", " %IV9b", "UPt9\\", "n?2%9", "`!/T_", "System.VariantsH}B", "1jJG0", "H/\"c4", "RHf'f_", ".jo?'", ". %s is empty+Out of memory while expanding memory stream)%s has not been registered as a COM class", "(27Zs", "L: loE2oi=", "Rkjp[B|", "I`OT|", "f1_FR", "$Xmhh", "c>6sV", "EX@cE", "@msBO", "AA5^q", "Y%359", "C5l_Z;", "NumRunEntries", "LI[8|x", "kP+4%", "0C>CZ", "ffk9G", "\\`", "R=RER9", "jI/WE", "mSu/}", "1 111G1X1g1o1", "^g_Pu", "System.SysUtilsL", "FAb> $", "s3%^ ", ".+~XF", "1{bon", "sMm)|7", "u,.sc", "vh#SH", ",IZ)$", "xRQ` e", "DON\\S", "mn-Mong-CN", "Gy;ie3", "3.32363:3>3B3F3", "],4Z^", "9+}=(m", "yeh\"[", "xOLk|", "3z_{\\^", "||si&", "X]hGkZ", " ", "d xc.", "6Xo9Q\\", "VPJ~&", "bc-bi$", "I[:8j", "1&w0W", ";!WFl\\", "d|3MF", "3*3;3O3W3h3v3~3", "4RXv(", ",5J;\";", "$6JMI", "^N%=C", ">HXJ8", "BR[KZ", "LnsH>", "&t$O(", "5Y'TP1", "9T0y#", ":Z:hR", "Gr9]+", "Sd6R<", "V:rRpD", "mLoF>", "_=e;$#", "OnSetName", "2G{AHM3", "S?oAX", "N1!*Q", "Shpn", "?#?+?3?;?C?K?S?[?c?k?s?{?", "{0#tT", "\"5uhzL ", "NaJQ0v", "Xz>_g", ";-m|6", "GFPEzls4", "=tq/h", "RZ)Yl", "fdOpenExisting", "!R+[R9", "@#3m7>", "QggU1", "US\"p{", "\\;)ys\\y", "$/ixR", "2\\PI&", "S(_^[", "=kL$7A", "a&$L-o", "Ir*o6", "w-{8h=", "I:G]?", "[|d-B<", "CreateAnonymousThread", "H>]pO", "If00Q", "YYYq\\", "yG[l;", "!AR>3", "iuG;'", "!yUl+?", "zG@yn", "Ji(P@", "IdHPI", ">\"g`&", "E&Or2", "jW_C6", "W(i@f4w", "]z#V)V,", "J0wBfZ", "CgYC)", "'2\\vpv!", "wjM66k", "1z6/Z", "$TEnumerable'", "XXgfI", "/{r&1", "STu)}", "#?yT_", "SetSearchPathMode", ".okj=", "l]&W(", "lm(", "X'=;0", "V6/9}l", "\"(!Yu3*Sb", "\\g^3/", "NSLnb", "TLZMA1SmallDecompressor", "a}KY)y", "TMultiWaitEvent.TWaitInfo", ".x=pg", "VVgyoQ", "):TMethodImplementation.TInterceptFrame.:1", "aPx7z", "iJ|ha", "J9N.b", "590N]", "O7B,J6", "~8%v=", "1/1I1c1", "0/`#\\", "az\"/>", "M=KH8", "AUserData", "$Dc-z", "8IEnumerable", "C.:S[_a", "%TEnumerator(", "6 6(6", "~>\\3}'e", "4nS~x", "/@&?PHV", "oDb8c", "v[c_R ", "qC^wI(!", "$zd\"G", ",.GRg", "yy\\;\\P]", "zKOta", "ur:6~", "m*n6] ecC", "10181F1T1l1p1", "%4b{9o", "L {]}", "9wg q", "QuC=L", "1qoe}}", "B0vRy", "t*zQ{", "F&`;k", "N8=5S&", "fKC=|", "%`^myq", "advapi32.dll", "A>,&g?", "dF]`o", ":'qw/O", "OnTerminate", "ZdA*#", "`xyCh", "1", "FUpdateCount", "wE?AH])5=f", "67YY;", "35o|2a", "eb|6(G|", "C^J?3", "<(<8.TEnumerator", "=4GJHc", "QjvmgK", "J!#&!", "x\\Ed9", "h*r.zwOaI", "+\\k6?", "8JznE", ";-B18", "2$i/kM", "Bn2mn]", "S/[ug", "j\"F%s%s", "windows-1251", "[6[-E", "5bp;_", "h\\cg:c", "yO/e z", "iuJh7", "*{AEt,", "fY(nH", "\"#DLK", "akhrrr", "+T:H%", "7\"[>_7g", "&U*7`(", "&;mas", "A{YPL", "AzdT%", "M8 ", "s&fkD", "(Q{\\`", "<;*P^", "\\j>9m", "|}LD]", ".=@YGLZ", "QpAN+", "!E-VR", "((`G ", "MTdh3", "5wFJs", "u:a0b", "c%Y]P", "*-veU", "}bMhc", "29-CPe", "&^[lM", "B~R@O", "Overrides the default component settings.", "Fu:b:", "s-[&(", ";|uC>", "fW4", ".TArray", "AIntToIdent", "$Pu\"(", "P7Qa{", "vUg,biV>", "Ja$,|", "c|\"#[", "6 .,*", "el:e|X", "G1?X%@1", "k \"4rVc", "PropCount", ":|oi<", "m29=RT", "lHA[r&", "@[utc", "7+^QL", ")AY7&", "o-^$^", "$TList&", "'TCollectionNotifyEvent", "RL8=g", "DH})~", "iso_8859-11", "gyL53", "+/QZ9", "12;5-%", "SafeArrayGetElement", "", "P6thU", "aCKyd.G", "&aId+", "K|8kM", "uEwX<2", "SetLastError", "Z<>}R", "-_+fKs", "FR?A`sM1+", "L1Ee5", "9&{c$", "y1gv3", "Shared.FileClass", "tqtLS", "BqIjJ7`9", "z\"l Sv!oO", "l%^?\"n", "68o5G", "N!v'SG", "5$565:5Q5X5b5f5", "Q5sX9i+", "w#ehz", "CompareOp", "g)5$xuy", "\\lQ>3:", "v#Wjo", "cp950", "9]G3[", "`/5c.", "kmKeW7NB", "zHg$Z", "w-+'j", "System.SysUtils", "%`z;o", "g8'YiY", "|/Lpm(Y", "[])Q=", "A~O&b", "=9=U=\\=k=z=", "!g/27,(", "; ;$;(;,;0;4;8;P;`;d;", "UV&l_", "ih,^TK", "0gq@2", "Jbq@}", "ucL|/Q", "<:J&>", ":|eNY", "W+ly^#", "9d~Ui", "?U%y%", "Indirect", "9K=]=c", " z;(9", "Runtime error at 00000000", "<-^P7[", "Rs}s}", "-rU5)O4", "\"d)W<", "uQl!j", "^Qu[j", "x:+J}", "-\\K&h", "))OC4%G~", "oqy+^", "UseQualifiedNames", "FLKUU$A", "k34zl", " /s.-)", "ISZ)7m", ";)z2mO:", "k/uoj", "i[Ku/K", "-71\\q", "? W0&", "GZ'Om", "MJm~M", "!S73Z", "fPbw6=~", ":X](V", "N41#I`*=Lh", "@GetPackageInfoTable", "DcuEp", "isHl)", "n%W%}", "G!xRh", "j,2N?", ".^&Q`", "RegExtended", "{%I)^x", "\"5alpW", "0$060A0H0O0Y0a0y0", "/j&$;'", "\"!@9~", "5&Whd", "Aid6YHf_", "ViUI]g", "\\JFf+", "ml3$N", "FWriteMethod", "NJoGk/v", "ys*+=", "8-{\"SXm", "1b}4V6", "U2'G9", "}QEJY", "T$KY?", "fsNaN", "=D>Z>d>", "H:s_bc", ";hxJJ", "N_\\D-", "!i{Yx", "1mZt(", "k5 9E", ")_W!24&J", "&>Q;e|", "mIh2uE", "GX7W+", "FVN.b", "Y6!D|", "SdjrJ", "m8Ne?$", "lFi[4", "ye5z$", "}TY|/fK", "kX7U+", "zh=O@", ".4W$]*x", "`lD-62", "c61_(", "2r[O>c&)", "8DD!vT", "Lbh-r+x", "uG,b6c", "EcCU!&}`", "Rm6^o]M", ",.kv2=ne;", "\\EBO-", "Uh<}I", "TEnumerable'", ".eMjr", "hU]3[", "P/_[o", "N}:O:_:g:x:", "wh[0F-h", "C_fx'r", "5IS~=X$K", "6>3q)", " version=\"1.0.0.0\"", "2OGhU", "380118235959Z0W1", "/5_)c0", "8 8(80888@8H8P8d8y8", "9?A:j", "J-uA5", ">'rm!", "526L6g6", "4*484O4d4r4", "6<7K7", "Cpe8)6L01", "Q&`.?", "0r1Z4", "lBBc7", "TProc", "I/O error %d", "A@}9!4", "\"Zyo{", "IsSet", "<}+Sp)u", "!MKc+", "PGoe ", "~<,rd", "xZu,IK", "&qS6eP", "$0CPX_", "Fl\\L}", "vn}Jz", "Gox.K", "PDn7E{", "#U4?c", "Y:Hppm", ";K30l", "5Q@KxK", "l*|oy?", "sQ.8Ogh`", "T\\Y!M", "hx?2|", "ZtMR69", "A2.%L", ")KaU~", "<)G L", "Q'i_`&eW", "Bz(b]", "48*v-K", "\\U%Y3Q,", "/gHeyp", "/9&Mr", "_]Hjp", "wK/4|", "')wFv", ">pt)6", "2\\.N9", "2%cEN", "tUL)c", "\":Ixv", "[.eTR", "e]'tmU", "_tS&O", "TArray", "Systeml#D", "TListAssignOp", "COunk", "1^o-%", "bF#4u", "BDK@v", "TArray", "og(#97|", "*f_B;i", "hN#oL", "", "?-?=?P?c?q?", "hT|CD", "I+B#U)P", "jEbO(", "^Sr23X", "\"qGW>", "PByte", "<$<,<4<8<<<@5O5^5f5w5", "0y>", "\"b :T", "0\"040S0a0x0", "OON(:", "c^ )\"", "IKts7", "A~]r=", "5a1,M", "'EW&X", "6s6w6{6", "aZ^/D", "H$|Z|", "O=2Qh", "d#Zvm", "IQ09V", "xBZ#M", "VkKp e", ">w]0n", "k`CMp!G", "sICrM", "Options", "Causes Setup to create a log file in the user's TEMP directory.", "TArray", "n*L]xNg", "IsReadable", "DdI5P", "IEnumerable", "csDesigning", "F=\",`", "bUMv8", "mg'di", "t/eDK", "F^+/slNe", "c|&QF", "\"TList.ParrayofT _G", "LVnaO", "W3^_u", "SCt]dKP", "fY&<:", "`?68yT", "L9Ro-", "Ow#qk", "B{b6v", "i 'e/7", "n})$p", "#IComparer", "1jC]!", "6}\"l\"0", "I3%\"wcP", "jhJDW", "%b,a.<", "s#'.D*", "/\\5E=", ", *\\.U", ")v|*", "\"Sectigo Public Code Signing CA R36", "Gv+]xxyd", "ab<:j", ";\";&;@;P;X;`;h;l;p;t;x;|;", "|+kx#", "KGC6T", "0TDictionary.TItem", "iso_8859-3", "+TC,X", "/SL5=\"$%x,%d,%d,", "V2]Y3a", "[W%U%^", "LOO355E", "A%i$`j<_%", " {rJwN", "`=S)X$m", "~bEyO'l,4f4va", "sohJhy", "}|-X3", "MsgWaitForMultipleObjects", "vW`yEb", "75{L$x5Q", "929I9W9n9", "51r0D", "3w%}osbj", "#`$nS", "A}x4s", "BinarySearch", "gWd2X", "6\"666T6", "mG{'SkS", " M~iI", "ZCa'5", ",BNwed", "November", "+LCN9/PV", "lAlWj\"", "{$X5J", "3xea1", ";0Fa", "9\"919A9G9V9e9k9u9", "535R5", "sma-NO,sma,se", "1$1:1H1W1h1", "#svn?", "SHA256", "O&1KVQ", "?gbd!", "jnhs^8", "UFL3H", "September", "Qt/EKT,", "f {pm", "VarDiv", "D4oa{", "nX5G4p", "mm(:!", "-9}]0", "ITt7Z", "L=jBZs", "Rb`^zz", "QcD6X", "jWS7#", "'M7r@", "#w8#B7h", "4E4d4u4", "dsb-DE,dsb,hsb", "'nX]\\", "SetReturnValue", "?|}5j", "MQ^bh;tF<", "L&His", "!HXsI", ":,:<:@:D:L:T:X:\\:`:d:h:l:p:t:x:|:", "kb&ADjH", ";0;E;M;", "TExceptionRecordP", "u6Pzj", "Lo:$E", "8#8=8G8K8l8x8|8", "f.TKeyCollectionTvH", "K-3H/", "4K{h&", "YA&#A", ",Vi/Q", "Kh9Ih", "w)P?t", "=%4CjKX", "GKM%h", "r:8YG", "?@ABCDEFG", ";:k+.ParrayofT", "<(4tm}V", "4;8zWl", "^!(&L", "~i7,p", " TList.TEnumerator5", "_f[/+", "AC\"t:", "A0p0}0", "ExitProcess", "JnAcL", ")8xa0;", "?:n-N", "O&KYm", "?=QH/]", "5T7>NO", "(mzlI", "^~bp$", "jN@bE", "2;YUT", "M*B4nvy", "k.TKeyCollection;", "MYnv(", "dXclp9", "-8$hY1", "_>VAB", "[s6)y", "vEl/.", "wAv}v", "\"+21R", ";VJi;", ".TCollectionNotifyEvent", "M^w-q", "=%=K=k=", ":2:A:S:l:}:", ">mp>:", "FDRnP", "U%Y\\o", "EnumCalendarInfoW", "S=.H5j", "r8Wrj&", "H;N{N1", "CreateDuplicate", "M;V'6~1i", "#QS;:$", "ZB7.Qe", "qBFst", "8N/dJ", "e)/#1", "6.6<6O6e6v6", "E7`p[", "m#4o*", "TGetDeltaStreamsEvent", ".1F2g!", "xZ\\Ac", "ResolveReference", "D7q/;M", "7aWZr", "e%D <", "GetCurrent", "z{F&Ub", "=#Y3RcZE", "K^2o3", "YavVhusf", "&Q#fu", "<'Ml#", "0!0*0[0c0", "fIc%f", ">_)7L", ")9ZQ{", "TCollectionItem", "[@fF]C+/", "-NsvZ", "}BJFRS", "r,Tmn", "^yhH+", "ZCjL%'U[", "|RcG!>1b", "'vp&lv", "`X7r9", "WLu*e", "!llVd", "BEO=e", "F@tV3$", "*pAmY", "krRBA", "96sV~u", "l3l+B<", "m@\\N0", "{Uy}g", "Vo}fk", "lCW0-a?`", "q@}@$", "n#^ays", "-$K's", "?|i2y", "Y^z9!", "|4WC-6", ">WjwW", ";c*i$", "whVg%", "DefineOpenArray", "F8<#,LN(#", "ltI\\\"", "FComponentStyle", ">!>8>M>[>n>", "TRttiSetType", "8BB=y", ",$Zqv", "RegEDX", "qU7~w", "S}9[A.!", "-a38e", "EConvertError", "9A1En;-", "OaR^RI", "p}jU@", "nDT,m", "VCurrency", "8*:0FBg", "z6f/A1", "(Q>S?", "RtlUnwind", "k6sMA", "3H3P3", "\"Q2a=", "VN4NX", "constructor ", "MiJg@", "Yw+Q2", "k", "~`;dB", "M. !|;", "|:@bHW", "V{1N8d", "]i(*:", "=Vs+j", "; ;$;(;,;0;4;8;<;@;D;R;Z;l;~;", "Cngoh\"", "E?J]wzZ", "4RF3I}", "^gFGM", "k;5hg", "`?Z`S", "z&CRZ", "-&yq2YD", "d=h@w", "Qfn_gi+", "XDa,7h", "!ju\"z", "2ykj_", "FAsSWord", "&2#&x", "RuLK^*", "Sk]g.", "!^)UZn", "$5|)}", "+n@pA?]1", "OI/3]|e", "a_T}Q0\\#", "(N&'#", "fi4}N", "JP,+gD", "Au\"`D$", "9?9_9h9", "B=6rx", "0B\\rV", "J=,bb", "J-w8\\.", ";c-HH", "u_&oAn", "wAT}9", "GetDimension", "ks_c_5601-1987", "H$/(2", "|&fI+", "mA%{L", "e1v}Dc", "1Ycu ", "fL[6Z", "ODwh:", "eaMWaX", "9y/NB", "pDz4f", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "L2>1G", "yd\"-EZv;", "p])w>", "(9yPF", "FCanHandleExcepts", ",[+H8;}>a", "BaseAddress", "`X HhLT", "CL_q#", "EndFunctionInvoke", "<\"6m3G", "NE`y@LW", "iWdVP", "Z{p9k", "UU+L]a", "LzmaDecode failed (%d)", "z@U5v", "ITDictionary.TPairEnumerator8", "P\\$nd", "SQQ5I", "7e-a<", ":*:B:P:`:x:", "|,{ZF", "]1tYvi", "5hfb@", "`M8#my A", "J1f:.", "oF,#/d}", "84EJ}", ",%/Eb", "&:jnR", "](0TA5;", "Uh)LI", "/TEnumerable'", "L^H0p'X", "/TZ4,", "0)0;0U0c0r0", "2^!RE", "]D/E0", "h`aSD3", "/?-!Nb", "^0L]r7", "i:hEB", "FeFq,", ":6WaO[", "Uqs_Ln4", "HQ9ck|", "2o;|1", "Q_24!", "&p4;@", "0$0,040<0@0D0H0L0P0T0X0\\0`0d0h0l0p0", ".\"tiK", "lV]X}", "b.svBH}H", "<, ", "Cpnb(", "<$zw)f", "\"p{@8", "sFk%t", "Ti}h:", "[Y7x59", "R4sa-", "Dq<>_", "aFSPf", "$]zeYRxY", "FromVariant", "ON-:j", "7:_/J", "s6&l{", "<'<54NA7", "-2.~\\", "505J5X5h5{5", "|g;|qW", ">,>H>L>l>|>", "uavG&", "l2)c ;rF", "RqHk^B/ M`", "AY%8:k", "VBy\\?pu", "&TArray", "=9=L3", "fi_e-", "bUrdH", "t@G;}", "GT;T~", "\"86DjK", "TPersistent", "^YL\"=", "elKn>", "-%PHU", "/_(sF", "Iterations", "?4p\"v", "a&HeA", "\\q)$f", "atODH", "skUnicodeString", "><>G>", "f#&]lf", "GetByteCount", "t^L*)", "HJE%k", ")Snqo!", "^Gjx)", "Ph=i", "5b*lM$E", "?C6FSO", "Htu8|9", "1200 (Unicode)", "SFf83", "pDFYXI", "~@ohp", "00S6Q", "PA:b`P", "DkUNq]", ":9;6n", "ekj}&", "\"@cpCP", "!`/k3", "}g7]a", ">G!VY", "@zI#q", "@]oUK])", "95+\\b", "wvldL", ";QYFV>", ",3>X^", "yU?~Qp", "GetEncoding", "Read beyond end of file", "UU;bv", "ParamType", "nlIv&", "DTObjectDictionaryM", "rF%kzPek", "USm]ui", "*+nki", "A}j#m", "y:\"uh", "o?hO,", "~DULvTM!4;", "2XB=~", "q=DOy@", "sR sTM", "q1oY8u", "xbe_I", ";$oXC", "YMp+j2", "YrNB3C", "qPqd$", ">WWwn", "D^tja", "rBcuj", "vHY /", "z\\}\\>;*vk", "i#q2A", "5^$6/[", "L1J^y0T0", "cPPUb", "w*8dt}", "3:^yu", "DvCq=H", "ovu1@ ", "]FCCC>", "$)vwa", "dX*\\s", "\\T>/S", "iH1O6n", ",}a'7![", "BZ^8D0f", ">3-`{", "8.8G8c8", "x(Aag=8", "lY{{y", "!r E3", "2#222:2H2Z2h2p2~2", "][wKs", "LZ6kk", ")7B s", "/@[EvQ_", "\";eI<", "Zw&P&", "|Q*RV", "[L%]gk", "h9zz2", "z*-SV)", ",#Ix9", ")q=yX", "Wp^T5", "j;5,D+", "T&7j?C", "]l<|+", "\"Y&66R", "lk\"?ST^", "3Zu<<", " bytes: ", "__", "P\\]TD", "::4gu", "'RC>}}j0", "6,.19J;~", "5K5w5", "6f7Z_", "X4[3\\K", "w@tJd", "B`e&K", ".Id&.TKeyEnumerator", "Ma8d`}", "@$~OX", "D@N]zk", "0,Rx?", "3G'o\\", "RemoveInstItem", "&O_#%dA", "_n\"ZS", "8Rg%d4", "EFK29", "3'j.q", "ZKK^TJ", "fkh;OT", "x:O@6", "ui]FRm/", "@IG9'bc", "Ur{s@", "4'474?4S4a4o4w4", "|_%FT", "`0-Y0", "EOSErrorx", "wfTC]", "Nly\".", "ErrorCode", "KeWFZ\"", "2'?%qY", "v!\\Vr", "<6wagM5nB", "B%.|$", "4&|6{?", "<8<[[X\\V)", "OnAncestorNotFound", "W+vbB@tbQ", "csascii", "c6Bbyu", "gP=S[", "rayY+", ".DTK^m", "I\\P>.b", "SxJNE", "cCE+w", "*0nAN$", "Xg^T[", "L2bU~Y", "XgSZt", ".@X_N", "j=@32", "johab", "CuLk2[", "W#hNU", "yK;ay&", "}|{Ci", "2^=2h", "'oOgV<3", "bXv32", "(U&CQSM", "].S0r", "k.?|Z\"", "kl*dK", "\\]X^B^", "o.MX^", "HlEg)", "Y)Je7", "*]-T.", "DkC/vI", ">&>:>O>g>o>w>", "tJ?%S", "Ah>6#", "ok],kE<", "4A{`I", "OqKCGL/4", "?WTtG", "2!2)232;2J2_2p2", "J*/Cn", "0d,qbd", "CreateResHelp", "VC\"\"4{", " Kuqi8", "/\"D#0", "R@yr|6", "8ErQ}", "G41j;", "*^o%da", ":JM5J`", "ErRX0", "O!Oo[", "RK&7nZ", "3sskK", "F.Cgy", "@Mg{>", "G@C]K", "/Pv&xM", "&u)v,S", "$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)", "].Q!D", "oD9,.", "7/7B7S7f7t7", "$o,Y?", "DNBd!", ")i!E7", "7\\8WI", " [d1x}", "x=/*;", "$ZXsB", "=2=@=O=f=", ">$>9>G>^>s>", "C Kbo", "#]hJU/Ge", "|Hy#y", "G5@b(&P", "O(Cl+", "4`>nF?", "MbJSde$", "p>,EY", "cp1256", "gT:Ne", "<'$y7", "tC\\:o", "Vzq|E%W^", "rk!):", "@vc5J", "8B_FD", "'ZqcNP?", "@9,Qeim", "DE&O>", "x)b++", "OJMd-", "OKF_{", "TFieldsCache.TFields8kH", "[1+VvB", "M76$n", "7_QPp7M", "ekOd-i", "#=M;VI", ">/ye_", "V5z7Y", " VxGuwC={", "T/J_E", "EVariantUnexpectedErrorp", "P_pPZ", "AddObserver", "", "F);NB~", "B5uk$u", "C69qy", "Y^4K9", "JX74e", "t8QL3", ")p!w}", "=,=0=4=8=<=@=I=b=y=", "y5r?:p", "4&474T4b4y4", "WE%+z", "p?~x#", "8 8-8s8z8", "Gr4/a:", "SP^&t", ",/0ruct6Y", "A:NWn", "(Ln", "AppVersion", "&PL@^hD", "1*121P1b1{1", "7VQv]", "c|Rr2", "`Q?ba", "FParent", "CYX0\"", "3(~z~W", "-[VB%{", "Y}#H-H", "ENoMonitorSupportException", "252S2e2y2", "~Y./R", "zU@l4", "f;O", "Populate", "2c,fty", ". #!=8", "pBNsv", "@JF!R", "9G1p|", "|:8r%b", "> >$>(>,>0><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "eX>>B", ";,LIz", "UninstallDisplaySize", "^x0)h", "atRn.l.i", "MLAVzg", " vS+D", "RO@L8F", "i=.78", "8a(K'", "5 575;5R5Y5`5g5q5u5", "lVVt]", "<0V0~0", "Fmw+5", "nBeEb", "!:<_BM", "W1 Qb", "B,!|ozn", "gG,Dy-", "CTDictionary.TPairEnumerator;", "-qOKS1", "EObjectDisposed", "\".(", "_{*jS", "2*Lj<", "Xb/C2", "\\er0Vd", "f!d]m", "2'`;S", "xT&rA", "3#3-3E3M3v3~3", "O-gN$", "?ukXR", "Object lock not owned(Monitor support function not initialized", "R5mdm", "T0:N1j", "!K:-4l", "tub ?", "I*!{`|GOy", "3~2?<{*S", "^53jg", "TFreeInstItem", "-hI89", "FieldAddress", "W>f:t", "N$QF#.", "kqJ^t", "=oqQc(", "U!I%k", "y8w$^", "9{aS}", "Ee]um", ";)BA#", "._W-u9", "y%B'2", "ZzQ!|oGl", "\\i%JE", "rI@k#V", "2@;p>gJq", "GC4K*3", "141T1d1x1", "WmV@TXy", "KernelTime", "AsObject", "74_'i", "su.Rp", "}7f' G", "w$I+0", "5d905", "`Neoq", ", ZFs", "A^Z7s", "4:Mg5", "[M4a?coZ", "\"h8s=", "ROoFH", "7\\*`R", "Error reading %s%s%s: %s", "%E:qa", "SuspendThread", "z(ky~Ll}", ";D JG", "W=P3&St+", "?\\Tb>)u", "8O87@", "'\\jLl:", "Hpfi(", "(3~yi", "6?rhW", "?KAhf", "hh}SQ", "S~1l+", "tkClass", "Zj0Q|", "Q-5 7", "RRY-@,", ";YH:l", "oYS.z", "ShI2", "FFreeOnTerminate", "YM Jg,G", "vaString", "Tuesday", "!wFy?", "l.mk7r", ")OT{,b", "Gf\\5*7", "IP8@q", "-lTJ^", "Cp[,N", "!(;pl:", " Nd%*X", "R-IFH", "\"u^U-", "{Y/rj\\_", "IOSS:p;y ", "foePo", "r-[;/", ",R2pB+`]n", "x%r_xD", "?U]GF", "cKWd(", "QCCg\"", "wbon1;", "2v@_Lx", "^HUAtLbt``", "Gu`3M", "#TW>w", "CreateWithoutCopy", ")TList.arrayofT", "VwrPt", "MONiS", "QSHe7", "iso8859-5", "bx9.#", "z%'su", "41DGb", "g$^vVZ4", "Xaf~+`", "TVarRec", "[k[Wf", "pIH%V=", "2y`8p", "%TEnumerator`.H", "p+So(", "v>V_ R>-", "[n3'@0", "*,Qk=cF\\", "?EE", "'oEd9", "fwotD", "uT^X!", "NumCustomMessageEntries", "CuZh8", "heWWT8z", "Vm%6O", "cOD;$|", "(0\"W=", "}\"pd4", "'G~sjd", "b2y*.62", "wfc8S", "TInterfacedObject", " }=lVf", "7<@n6", "%?\\6JBs", "7&uZP", "?xe+p", "2<2L2T2\\2d2h2l2p2t2x2|2", "?,?>?U?]?e?", "SM;1_NL", "sk'r^:", "M2v5?", "NumDirEntries", "\"q@V<", "4 WOP", "TRttiPool@", "Z7>(Fn2", "[AirU", "(X%{n", "fuYch", "4$474?4M4_4r4z4", "zE2}_", "Ws^So", "<", "nVs[s", "j%Q1g", "izO2.", "q*P.|", "fa]~,qU", "oGIg#H#", "0j%Mu", "6\"4ld5", "F(ez`", "fc=W}Z'k;", "z>.)a;4", ">lv~a", "M/;z(\"", "BTDictionary.TKeyCollection;", "7+.\"]i-v", "[LP!A", "5)6?p;", "G51500", "5^6&8g8", "xp^qX", ">akD}", "c~6Sd", "Q8)=:", "$-fo4", "ALock", "jw.2>", "*MB7/", "/,:zW", "cw~lK}", "", "[b[]7", "/{/St", "<\\=z=", "3 3$3(3,303=3N3_3y3", "1 1$1(1,10151<1C1J1Q1-23292?2E2e2k2q2w2}2L3i3", "avI&Q_", ")5d2$", "fvvv[$~OO", "*Ff-6", "NewSize", "li8k0", "$G]bG", ",Ybq*", "v9xf|", ": :=:S:d:r:z:", "IsManaged", "\"Qu{P", "7CW+X", "~|U.[", "PEW&>", "ZpeX.", "6*656;6J6W6h6z6", "8*80858E8K8O8%9U9", "L#WUs", "mS+E,#", "fcGfL:", "l+\\(5", "\"qBEC", "AType", "!I/8Y", "ReadComponents", "T;6gA", "ZNm/r", "sjFR(w", "Yo>N.5", "[3L'u", "`DN'\"", "6]6y6", "d->u:", "(EUh9", "0<1C1Y1]1a1e1i1m1q1~1", "L:!L?CM", "TVariantBoundArray", "(.a8T", "T7*D$b", "gjr]'/LZ", "wEu_\"{p", "y-Y@o", "41/;!n", "Y&dYa_y", "g5esO", "1$1,141<1D1L1T1\\1d1l1t1|1", "rr>2:", "5)0Xv", ";v2(`", "A=r#5v", "Ogx;_", "/7\"_J", ",G^^0[", "1 161G1Z1k1~1", "&`q}:", "t).bTV", "]'j,*", "DMiSJ", "=#=+=3=;=C=e=z=", "Q:k(r", "1Hc*7B", "2L[b9", "0#0.080^0q0", "X0uw%CXr@", "qh$C9#}", "6[3=E", "CEdah]", "yDSn2", "Invalid numeric input", "x>(9sMs", "7Obj:", "Ccu&>%", "0B0Y0`0j0n0", "H+l(s", "ZZ)d#3", ":.S,b", ")o04](", "PIntfMethodEntryTailx$C", "M^C!-", "ELc>O", "TRttiStringType", "ir!]&", "}dRgF", "2$2L2[2c2t2", "CSaa(p ", "{g*>M", "9h(V'`", "4/\\Wj", "cp857", "2Ve>\\", "r&9vK%f", "~;(>0r", "-Ct%vks", "Y{wbC", "zi", "6/676E6W6n6|6", "s:o7y", "DTDictionary.TValueEnumerator;", "iYX<0", "Z2!2^w", "p=3HO", "vmJY\"", "|v(~Q", "\"VyC>", "BZCwu", "MkPRH", "PInt64", "wrIu6", "y|,W~2", "%?)^\"", "gkDtC", "Qj!Cw", "N_a:3-", "V?y~V", "Ao V)", "f&M2D:", "&jr(", "@@\\tZ", "LoadLibraryExW", "AVI`|", "/PCm'", "*S_t9", "tijv}/", "NGG!;", "iCrtr!", "^Kgu=", "#swle", "10171N1R1V1Z1^1b1", "varType", "`;8(>0>A>P>X>f>t>", "e<,O\"", "-ctx:W", "cqv;wE", "`J,Fa", "\"w@C;", "V5?E%", "AInterfaceList", "vaInt64", "Bnw[_b", "mYMg-", "*3kO,", "!)@}&", " ", "-*Dpo", "5!6)6", "VSxH**", "uMI=FH", "3lR[%(-", "3X9J/\\", "Bto+s", " >/H|", "q1LJ[", "C_s,I{", "@hr6Z]", "#,{,O", ":mEZ;iy[-c3", "1JYy3", ">(>0>>>L>", "ZS66k;~it", "aBUu<", ",c?egz", "H68-p", "vc(,a", "p^3~$k", "wok8l", "FV,,i3", "/+54N", "T~{\"tz", "+ w-r&F", "FHandleCreated", "^m,U%", "$K0R}", "OPasC_B", "|B%bo", "%$~tW57u", "D~5(U", "ElType", ":fRbI", "QGlBz~", "e*zVQ", ";-;L;W;", "6j.0Pk", "Qg?m\\", "+ftV&", "''TF6B", "~cx^]", "U_)$[", "Windows Vista", "csisolatincyrillic", "FxOco", "@PYNa", "H@ u-", "_Xie=", ";zzLV", "Ht[$ 4", "3DXkUe`", ":TFormatSettings.:4", "fgD,A", "~nM@Yb", "&!YRK7[", "5qmLf", "MTHsdpZ", "$s 7S", "\\dn.ky", "g\\ZMjU", "3\"0'd$", "+YJDf", "? #Uu", "macroman", "aL{)(V", "> >$>(>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>", "k8xeV>", "T4`~=^", "~sbNf", "ThreadProc", "kFk+ ", "M\"AD}", "vL=3A", "3^&@R", "daNVS", "0hYTe*", "RY\"W3", "j4.K/r", "_Pdd]", "TypeInfo", "$p24n", "A", "1%161{1", "C9t?kcFd", "/k]&%>H{", "|fKKk", "@,Bx(", "8=Gy%\"-", "VIPW%S", "ibm850", "GetSystemMetrics", "IAsyncResult(", "V^kzJI", "x>k2tt", "=`\\qa6", "ID`w/r", "~OyS`", ">+>j>", ",*-B ", "#H^7'", "TInstItem.TBucketArray|", "|)n*}f", "33_ O ", "W=8\\N|#", "ke &{VQ", "]>x[m%C", "t3cJ5n", "> z:X", "R{Ej*iO", "l6k#J", "6Rvd;", "&BaR$", "-TArray>", "1w#Qw\\", "@Cl8 ", "J=+(@", "tKB;p`", ".D..9", "\"uQdT`", "@<:o<", "3h3l3", "9pf~z", "s+om:&1", "-G/I`}J", "IV*I%\\", "FCallConv", "a(M~0", "WriteCollection", "$IrQ?D;/Y", "J-K)K", "l5@\\~", "|3z\"E", "EVariantOutOfMemoryError", "Xh&(r", "k*6rI", "U'MJg\"", "a3\\%N2", "^Phvzg", "TUq;\\", "D9x[_", "-8dNj", "\\8DJT", " 6TVQ", "L w>U", "{}re83", "EzN0xB", "opaque_State", "sZ5~.", "mZCr!", ")9Qk E", "S,.$&y", "becqw", "proCommandLine", "#-f7-", "\\5en(", "Cex{/1", "J~c{#", "J\"KB;P", "-_ZpAA_", "%%9?>", "9.Ro0", "2*)SB", "MultiByteToWideChar", "rcT/N", "VL:XtgF", "tcQ5J~", ";,;<;L;m;", "-?T4~", "mLr^y#", ";18IQ", "5#545U5Y5", "4P]RC", "d2IGg", "q;lqY", "=`o%q", "T)W{G", "-qv2-", "i?[+PCzM&xd", "!c9aK", "]%O2V", "2lJ,|", "16^RI", "hq]D", "bk.H-", "T 8eS", "@FE{J", "%LX;#", "!hD4<7", "!Xl0Y", "Kx(\"k", ":ULnG", "VWords", "yw9a!", "ps", "1#111?1K1X1", "w5V]rI", "McHkWN", "k'PD_", "PACKAGEINFO", "V5:\"l", "i-:c:,", "q#]7auY", " -o38", "b9v!1", "n{F:L", "JyS&#aK", "?e\\'U", "fp=s!", "5^nLd", "H^IFQui", "]v*wa", "_| K'", "_P%r'", "EA2*(", "S%8o6r", "0'0C0R0Z0h0w0", "Hp X?hm", "jsY7>", "L7s=&9x", "2Y&{p", "TRttiInstanceMethodClassic6", "q-IK\"G", "VDispatch", "z=U5,Z", "zW33^$", "Q.n4qB", "^3Q%{j", "/igP>", "Feature not implemented Method called on disposed object", "k{(4N", ".0ps)", "9l$n.", "3->*.t", "]{k\"!", ";%pB*", "~|G @f[", "DTDictionary.TItemArray", "$$T]/e", "m:#.I", "_I|'M", "W6+4SB", "TCollectionItemClass", "zuW/V", "GS#ma", "X;L-r", ";5y_;", "`wuV/", "Y7(Fi", "0Kx_x", "\\IHXX`", "+(`[7", "]JfY`N`", "]pV-`b['", ">OA}CP", "t0_PYA", "4>uR-", "pfResult", "ugNF!", ")V5wG", ">p?D^I", "FComparer", "{9@d~JQw3", "(qS>}y", "&!B%7", "xk4Ic", "qdF'k", "=G3>R", "NegCurrFormat", "G$Sc^", "S-&-%", "c&2a?", "\"HXP'$Y", "-D-wt", "Z +Ol", "='=:=L=T=b=q=", "1,1F1T1c1z1", "888G8j8y8", "]3'lzP", "FVaF(", "Y=iGN", "d<{wg", "^[}sj", "VzDB!", "=+=3=>=D=^=", "t>k1V", "UK-gH", "';+Ys", "nZXcn{", "*w0>#", "Ih':$", "5yMxx", "Double", "muVeZa", "=$=b=f=", "o^7cR", ":yz{{", "AM`Sj", "O(RMX~", "U:Jj!", "SystemP:B", "Z/V[k'+", "Cu8=*", "U)gLWld", "TOrphanPackage", "%{o&`", "?;w>p", "3ZiLO", "vp2r|[7", "Ug_#J", "4'I[v", ":p0mt", "2/YJ7u<", "GetEraYearOffset", "0<{EO", "+TEnumerable'", "0TEnumerable", "8qm2;I:j", "E&t,S", "<1<9&", "SN `q6,", "_BL4D", "Enter", "QQQQQQQQS3", "_XY7`r", " 8gq`", "%mpt\"|7", "15j\",", "$+?1r", "iq:)hxO", "Oy9Wp", "?F&9!", "g|NW`", "(E<$", ">8>f>n>y>", "CN", "crSp#7", "msgryx", "<9WLV7", "q?aH:", "LtR1B", "wY`3!", "AppUpdatesURL", "0R0\\0t0z0", "h3z0A", ">?7>;", "_:xwxR", "v=37h", "AContext", "5n3=P", "ilor%", ".HB3]", "2i(Hl", "FCompare", "1{\\JJZ", "ZjBlf", "udL=JwK", "Mb'in", "%;~}XO", "ggfWn", "3.3<3O3c3q3", "@,:x>6", "5J/]}", "LegalCopyright", "Disables the \"This will install... Do you wish to continue?\" message box at the beginning of Setup.", "!)-A([%d;", "B]Z^[", "u-A\\f W", " :i_T", "ReadChar", ") v'S", "@dan0`D", "PXrTZ", "ykmU=", "#!C/.", "Um_,J", "\\oG 9U", "~7BUs", "RDxp^", "IInterface", "AIIy_A", "6]SPb3r0", "5TCollectionNotifyEvent", "p:M cI", "7m[mg", "CW[\"1", "Windows Server 2022", "J+ ]ew^", "P5|e]", "HjRReJl", "5\\5`5", "C\\lN#", "7+7O7S7W7[7_7c7", "aB'WPa+", "t!!pw", "3!3;3P3t3", "GetLongPathNameW", "-bdQy", "=;>r>", "PVmtFieldEntry", "Ar^%>", "-my_`IK;Q:", "[s5Fc", "Cbs,|e", "#+:Q.I8(", "u=yiXf", "CPe_5", "7Uu6[", "LfWa=", "cmStored", "v0et]q", "Z<;X.", "OriginalFileName", "Yl,j ", "(w%cGB", "B_CJV", "jPFg.", "Y;7F^", "+`^\"4/", " kOQwH", "212T2", "w4R,P", "jA;&;", "P&Krn0,3", "@ly/Q", ":/bw1", "h'yf2", "{3LO8<", "}W=w(", "QC:^p", "D*se<", "0h8[^^", "Monday", "5(585J5X5`5n5~5", "1O2^2f2x2", "12\"^F", "393=3d3k3r3y3", "z4Fu.", "f|$#pm", "mRRMmU1", "%mp(\\", "QnQb2", "OpenThreadToken", "ldNone", "`p!ry", "/+KPq", "=P<>-", "[I\\~Y]", "Z4H5Z", "IndexOf", "w(ty~", "= =2r<", "LNN19y", "TBM/:Iq", "y9R/E", "'^9y!J", ": :B:O:`:j:r:", "fZzy[", "Q1m#YJ[^", "1 2L2m2", "JOA)G", "Nm>G~!", "Ty@/,", "TFindMethodNameEvent", "kiR0@", "H'IJW", "uuf0w", "J.>)o", "2&\\)I", "`^<&R", "fWr;<", "3%XhN", "\\;}/ci|", "QfC-N", ":v}eT", "H2_P/", "8zR6n", "11!7'", "EiWA ", "'~JAs", "QeJvD", "2wD*k", ":WV,$", "P*HQj@", "_x5JtQ", "?E|QM_p", "AO8mQ2", "*xt>.", "=?kDsS", "4} Ty=.", "\"Tk+q", "tI9c!", "ub{%*", "ReadDouble", "?O9pxWC", "}[R3+", "UcKXZ", ".TPfo:", "CS_?J", "[[&@'z", "H|JWH", "2OE<9x", "\"3D;{{g", "+vc>A", "faRead", "csInheritable", "):kee", ">l=a;", "\"QruKaS", "jQdnD", "sFakg2u", "=+=;=N=a=o=", "vXkR*", "kKg@g", "QQQQQQQSV", "sw3QX", "znjCK", "-uQT#", "Nsm\\oV", "#%o?k", "tZ#D\\", "@&Mq*", "TashI{6Xx", "\\-s>h3", "!iQ9{4", "F=[w0", "HW4ci", ".TList.arrayofT", "6(ZY;", "Yv37gE", "p#gmHo", "333E3M3[3i3}3", "TList.arrayofT", "=>Z_)[K", "O$|!S", "\\h@I0", "UN4\\vKi", "C:]{;IVG1$", "UhRYC", "y8Ut7", "v|CH\"", "9g3_4", "iso-ir-179", "Y[Mvs", "XZ_-%", "FOnAncestorNotFound", "9+:n:", "A3jC[", "ExitWindowsEx", "^XO`K2", "80FXC", ".4Go=", ",N&?_", "]G!S]c", "&h5}/?", "QZ9V1", "rItFC", "UnregisterWeakRef", "Ff`_7", "DR36[", "=-\"8|", "{==5h", "o3$ztkH", "}GepsY", "c5HW_EZ$", "e,qh3=", "Q>)!J", "Aob.R", "-L3_5", "AM/PM", " Rp)|", "*J3g*}p", ")Qbi ", "+SsoX", "System.Generics.Defaults", "x_!=D", "D)pai", "=Oy\"(e", "%TEnumerator4PH", "A;1u5S@U", "~Z4YS", ")pgJ2", "h#Mw!T", "r5E_|", "GC33*", "ppD,u:RtT>", "5k5r5", "$x,`6'7", "Yuhx+", "shift_jis", "~V/Z\"", "RandomXorStartOffset", "&l2D\"", "VS_VERSION_INFO", "QmaKt", "WV!Wa", "e>gZw", "U xh%Hi~", "q&Q&u}", "esZ ' @", ")5n$D", " TList&", "\\n+9^", "ou Hf\"", ";HFz_9+", "XbR-u(y", "3(A!|", "2 2$2(2,2024282<2@2N2V2h2z2", ":TSetupHeader.:4", "c(a3y", "%s (%s, line %d)", "Interface not supported", "&y*'0", "CreateEventW", "A7<8[f", "/qTnf", "ZVj{`wb", "KhJg\\1", "];)G-", "7.7;7L7n7{7", "8Fr{$\\t", "b^X]x", "j7HGe", "OEZ':", "jC5]G=u", "2H2X2\\2`2h2p2t2x2|2", "JKPB*", "x5%],TE", ";l-u;", "radqO", "?A26@", "~j(iZ", "tiKhG", "eG?S5", "Iz\"r&_", "Xi8Oc", "SE'<5", "5_1I", "Kt)d[", "Hx'\\`", "J-Zp_", "9vnX_", "h]D9l", "9+53`", "y*c#n/t", "u':LWy", "DisplayName", "arabic", "gb18030", "Te5!U", "O1NX1", "AData", "PW!4vy", "hk0:W", "Division by zero", "&9xv`", "csDestroying", "[{NC7", "W;AX$", "DeleteRange", "DisableDirPage", "j6PJ?", "4_i|+cu", "B967JSA", "7jffA", "R+Y+p;", "F.Z]8I", "4`W9?AIoFi", "MH4Sau", "V8N^P", "?>pEn", "hJ=KG", "(>t'rI^+", "*nFt", "BTDictionary.TKeyEnumerator;", "X]0,V", "@9@}4", "B^7R,e", "-V^\\&", "mib6m", "v a0o", "ud^dg", "C\\5=-", "($#0g", "J!:qT", "K-=LP.R", "9^22H", "hkS]1?", "F9R]W", "u`/7R>y", "2:IG<", "sdM-i(", "$\\=Zz~/T7", "($p~27", "7TD\\yr", "eq1lsg", "an,><", "FnG8z", "%)iyX", "phk_Vs2H", ">p?y?", "X[n&G!v#r", "!<%wQ", "5N.#g$", ";f*Uc+", "cw*$e", "5a`,f", "qH}t{}%", "d$G&!S", "(w<>l", "#EG1`l", "\\zV!U", "Instructs Setup to suppress message boxes.", "Bus &", "Wi0qu", "q-\"u}", "3I3m3", "tFBOl", "afJKi-=", "`aY/N", "X{kcU", "rM9/[", "GHq.N_", "L`}_[", "\"bHsyad`", "\\dB6~", ".PA9&", "b<:eJ6", "c)l-l", "ATypeInfo", "He]$'9\\~s", "Zb: Cm", "U#CT\"k(R", "K1<3,", "(bGgg<", "%;[>c", "Zb", "kS}ti@", "InstanceType", "w]k$h", "UK=9s%", "ISHA256", "FGroups", "F/v*Y", "}Td^'", "404<4@4D4P4T4X4`4h4l4p4t4x4|4", "5-TjK", "z1y;lG(", "4]RS7", "u|+*{", "v! |w", "%hfbu", "]l]hh", "TPropSetK", "d-n76n", "pXDmhA", ",^foE", "yO,bb", "uTyE#Y6", "pv2RHc", "jDA4+\\", "z*4eX}", "Cg(D-", "\"c5>Q", " ^*9;P", "xoH4o", "k}U<}k", "B!^Y0", "{f>[\"", "a'M4d", "L35he_", "~xbSy", "mVS^N8", "]Vl2,J", "Q8)Gq%", ":TListHelper.:3", "MiruW", "LpVBb", "Of t!8", "ck{|]", "\\~*0f3", "OAq%b", "x'nN(n", "zy[[P_", "7[u#1zs=", "1KpJ&", "TEnumerable'", "WOX$/", "+\\2T.jcGuU", "~H<5je", "gVBo89", "<75oib", "IF#61", "'u *\\", "SlfEc", "CJ>k9", "Qwl0BH", "WN*},", "FWCharToMBFlags", "iso-ir-157", "jW.qp", "qA3gI", "LFpL\\)", "8H8]8f8", "KhH$G", "3LJEZ", "&MXGs", "zWbdC&", "QZmeJ%", "*TList.TEnumerator5", "X44{0{", "\"Roby", "TypeTable", "GetCommandLineW", "ba~Iy", "edr4z", "Q(XD>[mU", "[t[WV", "Sm;je", "\\hx/}e%", "/o|i)1Z", "3Xi>x", "= >2>;>R>s>|>#?", "(v2\"#", "@S^jR", ";e\\)<1", "q,qI-", "f\"hC]", "bafIW<}", "lBs9!", "9!QF[", "1@U+l", "=-`bT", "EM9ca", "VarR8FromStr", "+1e7N%", "6V\\~r", "I!27/Z", "Oee_R", "YFFFH&", "fUrg-", "g7$yBS5o", "mNl(m", "^0BL.", "AReturnType", "b:M\\*_", "?4a:]", "1HS^[", "9ea*g", "eShp/", "i*Nocr%", "%<:!d", ",'7645hJ", "vg?b5", ";&,q^", "sdG\"#", "QkF#a9", ";sht'", "C7JGG", "9(ZHM", "d &JK", "(HVz#", "S`C$=F", "f|&5+", "FYg :", "QHilGM", "51!F.", "s[MEP", "t=F/08", "{?n#sg@-", "4fS&&u", "A2W]y~", "Sr!KN", "qv{#f", "MU6:;", "7<9UU$", "!$UJ&FM", "X1$Pc", "8&9*9K9O9j9n9", "&)F}ii", "Identifier", "$[W6K", "w5)XCH", "s-@pa", "]x`C}", "f5MM[", "S,1Sl", "iRcaSK(", "1YsX\"", "\\\"mP>", "Ident", "C_PDD", "---V'", "c[8Ks(", "c{H>f ~R", "TEncoding%", "Stream write error", "wxF^u#B7J", "k}jiT:Cb<", "u,3(k", "LMjIU", "[0sWi", "Q={VH", "]B#;y", ",.#$i", "y(x#U", "t)CCk", "O/t_M", "FLock", "AOperator", "V :N=", "Z!)%N*", "nC2Nc", "D|Ic(", "yEe_E4", "|(!!'", "?&?5?G?Z?b?p?~?", "bC$w 5d}", ">HD>l", "u*:9s", "pwN[j", "rMn3=", "){3#{", "}Pd[s", " @lub", "L#5DH", "d", "`%YdMT", "m3+]m", "!)vje", "BS*_?", "}y:I}", "x=|,pA", "MH-,Ih@a", "/p6jBvk", "6g,N2", "{T4}9", "k)e%d", "TKfh<", "nc/'TE0g", "%:u\"G;tx", "k3|Bm", "w`;/jP1", "HK<>;", "*),V}", "6%656H6S6[6i6y6", "0+N'o", "j@3G^", "'OVUz", "PFG'vx", "=@=I=", "323C3_3g3~3", "kY:)ha", "(IComparer", "AC]?4", "pBggXR", "c\\JF@", "(YT7%", "%w533", "[|Eh8u", "fM_^-+", "Yv_CK", ">TopF", ".TCollectionNotifyEvent", "NaT8Qs}r^;", "{ k|:W", "A@'b3", "B\"h%x", "R3-gc", "8PGBklU{MYI<[.uh", "@@n=t", "FOnValueNotify", "H0(P0", "[\\*o=", "G,k7x", "gz;", "Windows Server 2019", "EWriteErrord", "P)$'s", "YEf5ig", "_C'9X", "&||\"oa", "value", "OleStr", "v}Z,I", "U-v4#", "Wa5j6", "FCollection", "/V/d4", "5vvyIe", "Avu5,=", "O5L#d", "Duration", "korean", "\"h)a?[", "W]:ch", "?1 ^X", "l-5}u", "!dH|\"", "arnMh", "4)4-4I4l4t4", "JT%f1", "<'#.c", "\"k&Lnwi ", "Dispatch", "4R8Y8", "Vp-Oe<", "DVvNp", "8 888<8\\8l8t8|8", "po_I7*$'", "7+7E7M7U7w7", "(j0 #", "Yedf\\J", "`D{$A", "pK.Qg", "jZI=$", "TArray", "OnFindMethodName", "$UQX|X", "FOwningThread", "9\\sq^", "ELh=0an", "o%kqX'\\", "4)cw,", "4|~g}", "}EQW:", "CR~PY", "[xNbr", ">2>K>d>}>", "c/W8Uj", "WriteAnsiString", "DefaultGroupName", "3-Fx\"", "gpX8W", "'(e-'", ",e^r#", "?zHK+", "fMmD/M", "v(D|Bq", "`Y/^3", "W1li_", "s!BY(", "m1~\\j", "B@_G_L", "5-555=5]5r5", "A(CN4", "[!2Ao", "M\"b1Y", "29%bc", "I6R~#", "lxPguf", "*`H?B", "_iKo5", "Fd.P^", "+6!ff", "(Da=Q-", "8C*QF(", "?333333", "9mbbbH", "V)`0{", "<(+>[", "/9D|}L", "MtS':4", "PDN&|", "^74o3~", "pC4tDv", "n;umR", "n7#f#", ";I{1D1n1", "E#\"Q`p", "<&<;$!", "CollisionsxwH", "VTEnumerable>", "?_p&b", "2#>!^i", "M\\hAT", "&&OKW", "2'222", "!z!\"P", "<.<< D}", "#[]7`", "MT(d*A", "SMqIm", " gT|]", "0X?A#", "zh!N!", "wKXF;", "5IA4T", "0p-gS", "c0~'+", "< <0<", ",GB1 ", "H4Xfpw", ".Dv\"u", ",-:Dd", "{l4i'", "pX)(S4m", ".kl3.", "T$,#D$8#T$<3", "${:b{", "VSmallInt", "7:Im?a", ">x`|-", ";g[~6", "<]!!Z~/S", "List0", "|?3*)i", "5<\\OoId", "o=b-,", "AsInstance", "g=VNW}", "`c0GK", ")&4/y", "b1< u(", "xUG?I", "g')R;:", "v.GuX", "&r{.TValueEnumerator", "<`-]L", "4&444B4V4^4o4}4", "K_?0,", "u#vVj", "i2;;k", ";%;-;;;J;`;u;", "^!/Vm", "AN885", "aW_Q`#Y", "r1A50L", "e;J&D", "606v6z6~6", "Kw`=A&", "i2/RjX#,Z", "machebrew", "&IV4i_r;w", "[hR{@Ji", "kL%{/>pY", "RtlCompareUnicodeString", "Yly4a_A", "`DyyL=", "XXcuH", "Jo`-/", "(m$/;", "Dimensions", "9>To]", "C]t~h", "aH;u8f", "Prevents the user from cancelling during the installation process.", "mz]K ", "z?:h1", "Xo|H+2", "`wuJG", "C(8x+", ";!!Z", "ca}Q!", "oihvi^", ">\\?v?", "pC1Be", "t'Ho|*aj", "lsnFK", "JEiNu", "/pC6i", "R^:6jo7&", "~ 5gn#H", "80N?7/B", "b4(!fR_W", "qK/vq", ">ct9M`", " true", ":(:v:", "FullHash", "F[` x", "PuqfU", "RawByteString", "6s@-H`", "?#3bj?", "@e#42", "S0oP*cr", "Uy3*t", "iSeo6", ":g#7/q", "&[m\\I", "YQiB6", "]xIn)", ";7y,k", "7#7;7C7K7S7[7c7k7s7{7", "R9a&(eL", "Seconds", "JV;,y&Q", "zHpPv", "?3*G>", "bjr;@", "}h[S]?", "|}o[yq", "7y&XM", "V6,H7", "^,tkN", "3%l4N", "]>\"Y'", "0R(?L", " XDj{x](", "WriteComponent", "i),uy", "GBRB}", "VarRec", " m|fa^", "4OS470s", "/Vmf[<", "tkMethod", "<=2Je>", "pRQVC", "zUS^_", "|E;5GB", "}|.\\|", "J@IC/f", "0T>;J", "2p9Z)_", ",LDZH", "ef!18", "4_I]XT", "bSM0\\", ">,><>@>D>L>T>X>\\>`>d>h>l>p>t>x>|>", "roh?X", "mAX1z,N", "w?k~l", "PV&da", "KB_ T%9", "i<{_ ", "wPE)BA", "_3uk%Z", "d'?La", "R|xWA", "\\kv4S", "n+u|Il", "AzD@H", "Aa#aY", "+KSu?", "48`0u", "^W>$xH", "LU8ua.?", "TSetupCompressMethod", "E{j&~", "yR$3^", "R5GC3", "1]q\\N", "TCustomMemoryStreamC", ",='6/", "y|0==", "System.Generics.Collections8", "({iJ;", "I\">.5", "ExceptionAddress", ")/Iu8", "ShortString", "g|QE`", "TPropSetK", "6iK9_", "QueryPerformanceCounter", "+8`?6!", "wi@\"Y", "; <0<4<8<@P;clt?", "8$858C8K8Y8k8", "_P=s\"", "oxC;5", "'F{@DE", "xgO@5", "585E5Y5", "x=B?=", "SbT2D", "z00% ]&&V[", "o,2Ns", ":Da>o", "HbRCS", "NU+G>", "LJM\\R", "+EE>%", "nR/r`", "tj2o[c", "wdOJ%4", "t|\"bx", "2nIx.", "bHq9hO", "&op_LessThanOrEqual", "Ip (z", "'dL,x:", "d 6+$", "4N5c5q5", "~ze3W", "?5mh.", "TEnumerable", "2t~>~", "Pc_A~", "+xm3!", "~nRAIM?(", "Close", "q{tV2", "9+_=5", "tNhK\\", "TRttiInstanceFieldClassictjE", ",,#kU^B", "S3A\\\\c", "@W5zw(", "e=|?I", "_9|ii?", "ho4kJ", "D^2+4S", ">,><>D>L>T>X>\\>`>d>h>l>p>t>x>|>", "pCXd7", "e%vRu", "Kc0yO", "j4gTb", "rRNe)D", "ParentD", "hks;z", "7&747", "FComponent", "wdT=~", "mAps4", "|~&srIU", "/g+6q", "Jv$8#", "7!?Z2[", "5.5X5n5t5", "e{3Z6", "K`!U`", "GjU{(K-", "8aFbWx", "]8|La", "3*3;3P3^3w3", ";.oL(", "8|g!vdl", "WT5~U", "pfS$t[", "6RW^U", "zRBx}", "9!9V9", "%$bBE", "$YL8G", ";Fi >", ",]_^[", "Mn//-]", "\\>y)b7S", "MessageBoxW", ";3l<(", "!b9", "GLh^m", ".p6LH", "`3Xv\\)", "Hdk`/@", "n#%8fN", "25393=3A3E3I3M3Q3U3Y3]3a3e3i3m3q3u3y3}3", "rG~l)Ul", "g%8lC", "Q6vw&HQb", "?\\8r U}", "_&DYpy9>Z", "(?&&#", "EAssertionFailed0", "PushEBP_55", "Gs788", "[tE3=1", "2%272G2O2]2p2", "7}!5}", "X\"C:q", "E?_2C,r", "'#a.TEnumerator5", "7eH6@n", "oZd*5", "utf-7", "+I[oc", "pENNoi", "4+4A4R4j4{4", "M`6C!", "TCollectionNotification", "r\"&y\"", "5 5$5(5,5054585<5@5M5d5y5", "FJh>;", "M'fE\"V", "Rz.^j", "z?A8s6", "PResStringHashItem", "v6=-RLR", "*2O64k", "J4WHUF\\", "](Adf!", "Q&6sg", "1P#Nt8", "WinVersion", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "o;74_6)", ":hcen", "?P= F", "gql32", "DFn+{Y", ":[BMo", "mWYq#{", "!ME[iR0", "S*ia^%", "[sCo$G]C", "GEp;m", "g1K0M", "Fd=lR", "9_>", "JSIw ", "1IA0.", "EEncodingError", "PResStringRech4@", "pe+\"n", "LzOb9", "?7U%^B", "6iqfAD", " S0i=", "M3dhP\\", "U/.:=", "cp850", "iso8859-7", "Vv9A8", "pL cB}+", "d$f=*", "OJ_3B", "x", "cp1258", "FState", "dgpb[d|", "D8Hx*", "ResName", "VTEnumerable>'", "./UOi^", "`>@mO", "rIi@v", "Control-C hit", "[Lyg|", "&Zou5" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "c366d922d824c56819cb2959ee7d6f9f37adf7844d1b2b277035583598c8ca25", "path": "/opt/CAPEv2/storage/analyses/109/selfextracted/c366d922d824c56819cb2959ee7d6f9f37adf7844d1b2b277035583598c8ca25", "guest_paths": [ "overlay" ], "size": 6090440, "crc32": "A4AA8D50", "md5": "2ff124b613183ffd66b24f89e9f1eda8", "sha1": "0de72e6f977dd772a156a372f9caf71dfcd893d8", "sha256": "c366d922d824c56819cb2959ee7d6f9f37adf7844d1b2b277035583598c8ca25", "sha512": "ba434b49e479c5146715b07b0d13fbdb559bf568b9c8c91130a72cb19777f6832dbd3e29f51e8904077e2d79e39e7befa1ae9525a75bb26e3e24de9624613e92", "rh_hash": null, "ssdeep": "98304:WvqWPXtovUpAJLPMdYUnTzlLuT7wuxb/0exb6JAoMBgYV6E0wf98Ms3lGM6o0:Wv+nJLP9qflCP7B3088MGlGMG", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1165633663C16921B77B43C94598C1D34BA290805C9F82B869B20F2AC79DD7FE77F0E08", "sha3_384": "6c692bbe01b59708429e8ade44698e955f729d7d60a1852cfcd26d43c4c3b850028d860625123a30b711e66edb2ce9b1", "data": null } ], "extracted_files_time": 0.01515189299971098, "password": "" } }, "cape_type_code": 0, "cape_type": "" } }, "dropped": [ { "name": [ "preferences.xml" ], "path": "/opt/CAPEv2/storage/analyses/109/files/0237bf82b7610c21bf77e99037ba18d73c9fccec531b49f08e9b821825cbfa00", "guest_paths": [ "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" ], "size": 2015, "crc32": "AB90CD34", "md5": "23618daa6d7d186c500d713997df0031", "sha1": "aec490f22c95101f8dc2f6c7d6c6d04bb32b966f", "sha256": "0237bf82b7610c21bf77e99037ba18d73c9fccec531b49f08e9b821825cbfa00", "sha512": "fc2045ae65cb289ea1a89a908f0598ba6c78279ae092e41e4966504a5aef6927ad4825d142f4a88c1c54da6f531e6ace0a9588930f037416fe154256dffedf73", "rh_hash": null, "ssdeep": "48:ch8Vfz8VWkv8VrlR66kzR3ejzV/3O2Pkyi4RuHkbkyiZ8gk2DKip+F/X28n1X1Yj:lgWLHHBBkHipBzcLEE", "type": "XML 1.0 document, ASCII text", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T18E41D88371B4DAF62357409C46415D0B4A6CEFD327122C8874D5D422FBEA5E38167BAC", "sha3_384": "0a6c0481a2222233f144b821dfaa32f86012d6841e688b1d644fac8126f17d74ab9dd8f39385c567052f67e2158de53e", "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce", "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e", "data": "\n\n 1\n 1\n 0\n 1\n 0\n 0\n 0\n 0\n 0\n English\n 1\n 1\n 1\n 1\n 1\n 1\n 0\n 1\n 0\n 1\n 0\n 0\n 0\n 0\n 0\n 0\n 0\n 0\n 0\n 0\n 0\n 0\n CRect(0, 0, 0, 0)\n 0\n\n", "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": 4056 }, { "name": [ "uninstalltool_setup.tmp" ], "path": "/opt/CAPEv2/storage/analyses/109/files/eb7a6ec9e86a224f0b807e79c19126ba04e60090490c0af794530efb0f2e9a68", "guest_paths": [ "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" ], "size": 4372376, "crc32": "6DAAC385", "md5": "b9e96428c53636a90a72c92fe26c3753", "sha1": "d5ba8780e65b6d1d63c50768d421543053633250", "sha256": "eb7a6ec9e86a224f0b807e79c19126ba04e60090490c0af794530efb0f2e9a68", "sha512": "e9a62be7e4f75f722022aa9dee4ab5cd9b65970d715494359b1ac502fd95fc75f7bb62048c541d6afd9f415ca8ca2de46a743b87abeb596f61f3fdcca858405d", "rh_hash": null, "ssdeep": "49152:6vwA0lXFPZJaSut5C+5VtqMA9OYcE0CLxf+MEyq6XPU+moz333p333tKaQ:6IASXh29VtqMA9OYgCMedmC333p333IH", "type": "PE32 executable (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T15C168D13B3C9613FD06B1A3A5837935498BF7AA03916AC979BF41A4C4F7D1802D3A787", "sha3_384": "ccad818355dc026fb8f007c27e4b6f92eb4e53657d8a36c66cbb438992f774aadc5943a6b47fc26f3ae81f466f5a67e4", "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce", "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "File not found: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\109\\uninstalltool_setup.exe", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x00378a74", "ep_bytes": "558bec83c4f0535657b8a4357600e821", "peid_signatures": null, "reported_checksum": "0x00434f6e", "actual_checksum": "0x00434f6e", "osversion": "6.1", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "mpr": { "dll": "mpr.dll", "imports": [ { "address": "0x7aaaf4", "name": "WNetEnumResourceW" }, { "address": "0x7aaaf8", "name": "WNetGetUniversalNameW" }, { "address": "0x7aaafc", "name": "WNetGetConnectionW" }, { "address": "0x7aab00", "name": "WNetCloseEnum" }, { "address": "0x7aab04", "name": "WNetOpenEnumW" } ] }, "comdlg32": { "dll": "comdlg32.dll", "imports": [ { "address": "0x7aab0c", "name": "GetSaveFileNameW" }, { "address": "0x7aab10", "name": "GetOpenFileNameW" } ] }, "comctl32": { "dll": "comctl32.dll", "imports": [ { "address": "0x7aab18", "name": "FlatSB_SetScrollInfo" }, { "address": "0x7aab1c", "name": "InitCommonControls" }, { "address": "0x7aab20", "name": "ImageList_DragMove" }, { "address": "0x7aab24", "name": "ImageList_Destroy" }, { "address": "0x7aab28", "name": "_TrackMouseEvent" }, { "address": "0x7aab2c", "name": "ImageList_DragShowNolock" }, { "address": "0x7aab30", "name": "ImageList_Add" }, { "address": "0x7aab34", "name": "FlatSB_SetScrollProp" }, { "address": "0x7aab38", "name": "ImageList_GetDragImage" }, { "address": "0x7aab3c", "name": "ImageList_Create" }, { "address": "0x7aab40", "name": "ImageList_EndDrag" }, { "address": "0x7aab44", "name": "ImageList_DrawEx" }, { "address": "0x7aab48", "name": "ImageList_SetImageCount" }, { "address": "0x7aab4c", "name": "FlatSB_GetScrollPos" }, { "address": "0x7aab50", "name": "FlatSB_SetScrollPos" }, { "address": "0x7aab54", "name": "InitializeFlatSB" }, { "address": "0x7aab58", "name": "FlatSB_GetScrollInfo" }, { "address": "0x7aab5c", "name": "ImageList_Write" }, { "address": "0x7aab60", "name": "ImageList_DrawIndirect" }, { "address": "0x7aab64", "name": "ImageList_SetBkColor" }, { "address": "0x7aab68", "name": "ImageList_GetBkColor" }, { "address": "0x7aab6c", "name": "ImageList_BeginDrag" }, { "address": "0x7aab70", "name": "ImageList_GetIcon" }, { "address": "0x7aab74", "name": "ImageList_GetImageCount" }, { "address": "0x7aab78", "name": "ImageList_DragEnter" }, { "address": "0x7aab7c", "name": "ImageList_GetIconSize" }, { "address": "0x7aab80", "name": "ImageList_SetIconSize" }, { "address": "0x7aab84", "name": "ImageList_Read" }, { "address": "0x7aab88", "name": "ImageList_DragLeave" }, { "address": "0x7aab8c", "name": "ImageList_Draw" }, { "address": "0x7aab90", "name": "ImageList_Remove" }, { "address": "0x7aab94", "name": "ImageList_SetOverlayImage" } ] }, "shell32": { "dll": "shell32.dll", "imports": [ { "address": "0x7aab9c", "name": "SHGetFileInfoW" }, { "address": "0x7aaba0", "name": "SHChangeNotify" }, { "address": "0x7aaba4", "name": "Shell_NotifyIconW" }, { "address": "0x7aaba8", "name": "SHAppBarMessage" }, { "address": "0x7aabac", "name": "ShellExecuteW" }, { "address": "0x7aabb0", "name": "ShellExecuteExW" } ] }, "user32": { "dll": "user32.dll", "imports": [ { "address": "0x7aabb8", "name": "MoveWindow" }, { "address": "0x7aabbc", "name": "CopyImage" }, { "address": "0x7aabc0", "name": "SetMenuItemInfoW" }, { "address": "0x7aabc4", "name": "GetMenuItemInfoW" }, { "address": "0x7aabc8", "name": "DefFrameProcW" }, { "address": "0x7aabcc", "name": "ScrollWindowEx" }, { "address": "0x7aabd0", "name": "GetDlgCtrlID" }, { "address": "0x7aabd4", "name": "FrameRect" }, { "address": "0x7aabd8", "name": "RegisterWindowMessageW" }, { "address": "0x7aabdc", "name": "GetMenuStringW" }, { "address": "0x7aabe0", "name": "FillRect" }, { "address": "0x7aabe4", "name": "SendMessageA" }, { "address": "0x7aabe8", "name": "EnumWindows" }, { "address": "0x7aabec", "name": "ShowOwnedPopups" }, { "address": "0x7aabf0", "name": "GetClassInfoExW" }, { "address": "0x7aabf4", "name": "GetClassInfoW" }, { "address": "0x7aabf8", "name": "GetScrollRange" }, { "address": "0x7aabfc", "name": "SetActiveWindow" }, { "address": "0x7aac00", "name": "GetActiveWindow" }, { "address": "0x7aac04", "name": "DrawEdge" }, { "address": "0x7aac08", "name": "GetKeyboardLayoutList" }, { "address": "0x7aac0c", "name": "OemToCharBuffA" }, { "address": "0x7aac10", "name": "LoadBitmapW" }, { "address": "0x7aac14", "name": "EnumChildWindows" }, { "address": "0x7aac18", "name": "SendNotifyMessageW" }, { "address": "0x7aac1c", "name": "GetScrollBarInfo" }, { "address": "0x7aac20", "name": "UnhookWindowsHookEx" }, { "address": "0x7aac24", "name": "SetCapture" }, { "address": "0x7aac28", "name": "GetCapture" }, { "address": "0x7aac2c", "name": "ShowCaret" }, { "address": "0x7aac30", "name": "CreatePopupMenu" }, { "address": "0x7aac34", "name": "GetMenuItemID" }, { "address": "0x7aac38", "name": "CharLowerBuffW" }, { "address": "0x7aac3c", "name": "PostMessageW" }, { "address": "0x7aac40", "name": "SetWindowLongW" }, { "address": "0x7aac44", "name": "IsZoomed" }, { "address": "0x7aac48", "name": "SetParent" }, { "address": "0x7aac4c", "name": "DrawMenuBar" }, { "address": "0x7aac50", "name": "GetClientRect" }, { "address": "0x7aac54", "name": "IsChild" }, { "address": "0x7aac58", "name": "IsIconic" }, { "address": "0x7aac5c", "name": "CallNextHookEx" }, { "address": "0x7aac60", "name": "ShowWindow" }, { "address": "0x7aac64", "name": "SetForegroundWindow" }, { "address": "0x7aac68", "name": "GetWindowTextW" }, { "address": "0x7aac6c", "name": "IsDialogMessageW" }, { "address": "0x7aac70", "name": "DestroyWindow" }, { "address": "0x7aac74", "name": "RegisterClassW" }, { "address": "0x7aac78", "name": "EndMenu" }, { "address": "0x7aac7c", "name": "CharNextW" }, { "address": "0x7aac80", "name": "GetFocus" }, { "address": "0x7aac84", "name": "GetDC" }, { "address": "0x7aac88", "name": "SetFocus" }, { "address": "0x7aac8c", "name": "ReleaseDC" }, { "address": "0x7aac90", "name": "ExitWindowsEx" }, { "address": "0x7aac94", "name": "GetClassLongW" }, { "address": "0x7aac98", "name": "CharToOemBuffA" }, { "address": "0x7aac9c", "name": "SetScrollRange" }, { "address": "0x7aaca0", "name": "DrawTextW" }, { "address": "0x7aaca4", "name": "PeekMessageA" }, { "address": "0x7aaca8", "name": "MessageBeep" }, { "address": "0x7aacac", "name": "SetClassLongW" }, { "address": "0x7aacb0", "name": "SetRectEmpty" }, { "address": "0x7aacb4", "name": "RemovePropW" }, { "address": "0x7aacb8", "name": "GetSubMenu" }, { "address": "0x7aacbc", "name": "DestroyIcon" }, { "address": "0x7aacc0", "name": "IsWindowVisible" }, { "address": "0x7aacc4", "name": "PtInRect" }, { "address": "0x7aacc8", "name": "DispatchMessageA" }, { "address": "0x7aaccc", "name": "UnregisterClassW" }, { "address": "0x7aacd0", "name": "GetTopWindow" }, { "address": "0x7aacd4", "name": "SendMessageW" }, { "address": "0x7aacd8", "name": "GetComboBoxInfo" }, { "address": "0x7aacdc", "name": "SendMessageTimeoutW" }, { "address": "0x7aace0", "name": "LoadStringW" }, { "address": "0x7aace4", "name": "CreateMenu" }, { "address": "0x7aace8", "name": "CharLowerW" }, { "address": "0x7aacec", "name": "SetWindowRgn" }, { "address": "0x7aacf0", "name": "SetWindowPos" }, { "address": "0x7aacf4", "name": "GetMenuItemCount" }, { "address": "0x7aacf8", "name": "GetSysColorBrush" }, { "address": "0x7aacfc", "name": "GetWindowDC" }, { "address": "0x7aad00", "name": "DrawTextExW" }, { "address": "0x7aad04", "name": "ReplyMessage" }, { "address": "0x7aad08", "name": "EnumClipboardFormats" }, { "address": "0x7aad0c", "name": "GetScrollInfo" }, { "address": "0x7aad10", "name": "SetWindowTextW" }, { "address": "0x7aad14", "name": "GetMessageExtraInfo" }, { "address": "0x7aad18", "name": "GetSysColor" }, { "address": "0x7aad1c", "name": "EnableScrollBar" }, { "address": "0x7aad20", "name": "TrackPopupMenu" }, { "address": "0x7aad24", "name": "DrawIconEx" }, { "address": "0x7aad28", "name": "GetClassNameW" }, { "address": "0x7aad2c", "name": "GetMessagePos" }, { "address": "0x7aad30", "name": "GetIconInfo" }, { "address": "0x7aad34", "name": "SetScrollInfo" }, { "address": "0x7aad38", "name": "GetKeyNameTextW" }, { "address": "0x7aad3c", "name": "GetDesktopWindow" }, { "address": "0x7aad40", "name": "SetCursorPos" }, { "address": "0x7aad44", "name": "GetCursorPos" }, { "address": "0x7aad48", "name": "SetMenu" }, { "address": "0x7aad4c", "name": "GetMenuState" }, { "address": "0x7aad50", "name": "GetMenu" }, { "address": "0x7aad54", "name": "SetRect" }, { "address": "0x7aad58", "name": "GetKeyState" }, { "address": "0x7aad5c", "name": "IsRectEmpty" }, { "address": "0x7aad60", "name": "ValidateRect" }, { "address": "0x7aad64", "name": "GetCursor" }, { "address": "0x7aad68", "name": "KillTimer" }, { "address": "0x7aad6c", "name": "WaitMessage" }, { "address": "0x7aad70", "name": "TranslateMDISysAccel" }, { "address": "0x7aad74", "name": "GetWindowPlacement" }, { "address": "0x7aad78", "name": "GetMenuItemRect" }, { "address": "0x7aad7c", "name": "CreateIconIndirect" }, { "address": "0x7aad80", "name": "CreateWindowExW" }, { "address": "0x7aad84", "name": "GetMessageW" }, { "address": "0x7aad88", "name": "GetDCEx" }, { "address": "0x7aad8c", "name": "PeekMessageW" }, { "address": "0x7aad90", "name": "MonitorFromWindow" }, { "address": "0x7aad94", "name": "GetUpdateRect" }, { "address": "0x7aad98", "name": "SetTimer" }, { "address": "0x7aad9c", "name": "WindowFromPoint" }, { "address": "0x7aada0", "name": "BeginPaint" }, { "address": "0x7aada4", "name": "RegisterClipboardFormatW" }, { "address": "0x7aada8", "name": "MapVirtualKeyW" }, { "address": "0x7aadac", "name": "OffsetRect" }, { "address": "0x7aadb0", "name": "IsWindowUnicode" }, { "address": "0x7aadb4", "name": "DispatchMessageW" }, { "address": "0x7aadb8", "name": "DefMDIChildProcW" }, { "address": "0x7aadbc", "name": "WaitForInputIdle" }, { "address": "0x7aadc0", "name": "GetSystemMenu" }, { "address": "0x7aadc4", "name": "SetScrollPos" }, { "address": "0x7aadc8", "name": "GetScrollPos" }, { "address": "0x7aadcc", "name": "InflateRect" }, { "address": "0x7aadd0", "name": "DrawFocusRect" }, { "address": "0x7aadd4", "name": "ReleaseCapture" }, { "address": "0x7aadd8", "name": "LoadCursorW" }, { "address": "0x7aaddc", "name": "ScrollWindow" }, { "address": "0x7aade0", "name": "GetLastActivePopup" }, { "address": "0x7aade4", "name": "GetSystemMetrics" }, { "address": "0x7aade8", "name": "CharUpperBuffW" }, { "address": "0x7aadec", "name": "SetClipboardData" }, { "address": "0x7aadf0", "name": "GetClipboardData" }, { "address": "0x7aadf4", "name": "ClientToScreen" }, { "address": "0x7aadf8", "name": "SetWindowPlacement" }, { "address": "0x7aadfc", "name": "GetMonitorInfoW" }, { "address": "0x7aae00", "name": "CheckMenuItem" }, { "address": "0x7aae04", "name": "CharUpperW" }, { "address": "0x7aae08", "name": "DefWindowProcW" }, { "address": "0x7aae0c", "name": "GetForegroundWindow" }, { "address": "0x7aae10", "name": "EnableWindow" }, { "address": "0x7aae14", "name": "GetWindowThreadProcessId" }, { "address": "0x7aae18", "name": "RedrawWindow" }, { "address": "0x7aae1c", "name": "EndPaint" }, { "address": "0x7aae20", "name": "MsgWaitForMultipleObjectsEx" }, { "address": "0x7aae24", "name": "LoadKeyboardLayoutW" }, { "address": "0x7aae28", "name": "ActivateKeyboardLayout" }, { "address": "0x7aae2c", "name": "GetParent" }, { "address": "0x7aae30", "name": "InsertMenuItemW" }, { "address": "0x7aae34", "name": "GetPropW" }, { "address": "0x7aae38", "name": "MessageBoxW" }, { "address": "0x7aae3c", "name": "SetPropW" }, { "address": "0x7aae40", "name": "UpdateWindow" }, { "address": "0x7aae44", "name": "MsgWaitForMultipleObjects" }, { "address": "0x7aae48", "name": "DestroyMenu" }, { "address": "0x7aae4c", "name": "SetWindowsHookExW" }, { "address": "0x7aae50", "name": "EmptyClipboard" }, { "address": "0x7aae54", "name": "GetDlgItem" }, { "address": "0x7aae58", "name": "AdjustWindowRectEx" }, { "address": "0x7aae5c", "name": "IsWindow" }, { "address": "0x7aae60", "name": "DrawIcon" }, { "address": "0x7aae64", "name": "EnumThreadWindows" }, { "address": "0x7aae68", "name": "InvalidateRect" }, { "address": "0x7aae6c", "name": "GetKeyboardState" }, { "address": "0x7aae70", "name": "ScreenToClient" }, { "address": "0x7aae74", "name": "DrawFrameControl" }, { "address": "0x7aae78", "name": "SetCursor" }, { "address": "0x7aae7c", "name": "CreateIcon" }, { "address": "0x7aae80", "name": "RemoveMenu" }, { "address": "0x7aae84", "name": "AppendMenuW" }, { "address": "0x7aae88", "name": "GetKeyboardLayoutNameW" }, { "address": "0x7aae8c", "name": "OpenClipboard" }, { "address": "0x7aae90", "name": "TranslateMessage" }, { "address": "0x7aae94", "name": "MapWindowPoints" }, { "address": "0x7aae98", "name": "EnumDisplayMonitors" }, { "address": "0x7aae9c", "name": "CallWindowProcW" }, { "address": "0x7aaea0", "name": "CountClipboardFormats" }, { "address": "0x7aaea4", "name": "CloseClipboard" }, { "address": "0x7aaea8", "name": "DestroyCursor" }, { "address": "0x7aaeac", "name": "PostQuitMessage" }, { "address": "0x7aaeb0", "name": "ShowScrollBar" }, { "address": "0x7aaeb4", "name": "LoadImageW" }, { "address": "0x7aaeb8", "name": "EnableMenuItem" }, { "address": "0x7aaebc", "name": "HideCaret" }, { "address": "0x7aaec0", "name": "FindWindowExW" }, { "address": "0x7aaec4", "name": "MonitorFromPoint" }, { "address": "0x7aaec8", "name": "LoadIconW" }, { "address": "0x7aaecc", "name": "SystemParametersInfoW" }, { "address": "0x7aaed0", "name": "GetWindow" }, { "address": "0x7aaed4", "name": "GetWindowLongW" }, { "address": "0x7aaed8", "name": "GetWindowRect" }, { "address": "0x7aaedc", "name": "InsertMenuW" }, { "address": "0x7aaee0", "name": "IsWindowEnabled" }, { "address": "0x7aaee4", "name": "IsDialogMessageA" }, { "address": "0x7aaee8", "name": "FindWindowW" }, { "address": "0x7aaeec", "name": "GetKeyboardLayout" }, { "address": "0x7aaef0", "name": "DeleteMenu" } ] }, "version": { "dll": "version.dll", "imports": [ { "address": "0x7aaef8", "name": "GetFileVersionInfoSizeW" }, { "address": "0x7aaefc", "name": "VerQueryValueW" }, { "address": "0x7aaf00", "name": "GetFileVersionInfoW" } ] }, "oleaut32": { "dll": "oleaut32.dll", "imports": [ { "address": "0x7aaf08", "name": "SafeArrayPutElement" }, { "address": "0x7aaf0c", "name": "LoadTypeLib" }, { "address": "0x7aaf10", "name": "GetErrorInfo" }, { "address": "0x7aaf14", "name": "VariantInit" }, { "address": "0x7aaf18", "name": "VariantClear" }, { "address": "0x7aaf1c", "name": "SysFreeString" }, { "address": "0x7aaf20", "name": "SafeArrayAccessData" }, { "address": "0x7aaf24", "name": "SysReAllocStringLen" }, { "address": "0x7aaf28", "name": "SafeArrayCreate" }, { "address": "0x7aaf2c", "name": "SafeArrayGetElement" }, { "address": "0x7aaf30", "name": "GetActiveObject" }, { "address": "0x7aaf34", "name": "SysAllocStringLen" }, { "address": "0x7aaf38", "name": "SafeArrayUnaccessData" }, { "address": "0x7aaf3c", "name": "SafeArrayPtrOfIndex" }, { "address": "0x7aaf40", "name": "VariantCopy" }, { "address": "0x7aaf44", "name": "SafeArrayGetUBound" }, { "address": "0x7aaf48", "name": "SafeArrayGetLBound" }, { "address": "0x7aaf4c", "name": "RegisterTypeLib" }, { "address": "0x7aaf50", "name": "VariantCopyInd" }, { "address": "0x7aaf54", "name": "VariantChangeType" } ] }, "WTSAPI32": { "dll": "WTSAPI32.DLL", "imports": [ { "address": "0x7aaf5c", "name": "WTSUnRegisterSessionNotification" }, { "address": "0x7aaf60", "name": "WTSRegisterSessionNotification" } ] }, "advapi32": { "dll": "advapi32.dll", "imports": [ { "address": "0x7aaf68", "name": "RegSetValueExW" }, { "address": "0x7aaf6c", "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW" }, { "address": "0x7aaf70", "name": "OpenThreadToken" }, { "address": "0x7aaf74", "name": "GetUserNameW" }, { "address": "0x7aaf78", "name": "RegQueryInfoKeyW" }, { "address": "0x7aaf7c", "name": "EqualSid" }, { "address": "0x7aaf80", "name": "GetTokenInformation" }, { "address": "0x7aaf84", "name": "RegCreateKeyExW" }, { "address": "0x7aaf88", "name": "SetSecurityDescriptorDacl" }, { "address": "0x7aaf8c", "name": "RegEnumKeyExW" }, { "address": "0x7aaf90", "name": "AdjustTokenPrivileges" }, { "address": "0x7aaf94", "name": "RegDeleteKeyW" }, { "address": "0x7aaf98", "name": "LookupPrivilegeValueW" }, { "address": "0x7aaf9c", "name": "RegOpenKeyExW" }, { "address": "0x7aafa0", "name": "OpenProcessToken" }, { "address": "0x7aafa4", "name": "FreeSid" }, { "address": "0x7aafa8", "name": "AllocateAndInitializeSid" }, { "address": "0x7aafac", "name": "RegDeleteValueW" }, { "address": "0x7aafb0", "name": "RegFlushKey" }, { "address": "0x7aafb4", "name": "RegEnumValueW" }, { "address": "0x7aafb8", "name": "RegQueryValueExW" }, { "address": "0x7aafbc", "name": "ConvertSidToStringSidW" }, { "address": "0x7aafc0", "name": "RegCloseKey" }, { "address": "0x7aafc4", "name": "InitializeSecurityDescriptor" } ] }, "msvcrt": { "dll": "msvcrt.dll", "imports": [ { "address": "0x7aafcc", "name": "memcpy" }, { "address": "0x7aafd0", "name": "memset" } ] }, "winhttp": { "dll": "winhttp.dll", "imports": [ { "address": "0x7aafd8", "name": "WinHttpGetIEProxyConfigForCurrentUser" }, { "address": "0x7aafdc", "name": "WinHttpSetTimeouts" }, { "address": "0x7aafe0", "name": "WinHttpSetStatusCallback" }, { "address": "0x7aafe4", "name": "WinHttpConnect" }, { "address": "0x7aafe8", "name": "WinHttpReceiveResponse" }, { "address": "0x7aafec", "name": "WinHttpQueryAuthSchemes" }, { "address": "0x7aaff0", "name": "WinHttpGetProxyForUrl" }, { "address": "0x7aaff4", "name": "WinHttpReadData" }, { "address": "0x7aaff8", "name": "WinHttpCloseHandle" }, { "address": "0x7aaffc", "name": "WinHttpQueryHeaders" }, { "address": "0x7ab000", "name": "WinHttpOpenRequest" }, { "address": "0x7ab004", "name": "WinHttpAddRequestHeaders" }, { "address": "0x7ab008", "name": "WinHttpOpen" }, { "address": "0x7ab00c", "name": "WinHttpWriteData" }, { "address": "0x7ab010", "name": "WinHttpSetCredentials" }, { "address": "0x7ab014", "name": "WinHttpQueryDataAvailable" }, { "address": "0x7ab018", "name": "WinHttpSetOption" }, { "address": "0x7ab01c", "name": "WinHttpSendRequest" }, { "address": "0x7ab020", "name": "WinHttpQueryOption" } ] }, "kernel32": { "dll": "kernel32.dll", "imports": [ { "address": "0x7ab028", "name": "SetFileAttributesW" }, { "address": "0x7ab02c", "name": "SetFileTime" }, { "address": "0x7ab030", "name": "GetACP" }, { "address": "0x7ab034", "name": "GetExitCodeProcess" }, { "address": "0x7ab038", "name": "CloseHandle" }, { "address": "0x7ab03c", "name": "LocalFree" }, { "address": "0x7ab040", "name": "GetCurrentProcessId" }, { "address": "0x7ab044", "name": "SizeofResource" }, { "address": "0x7ab048", "name": "VirtualProtect" }, { "address": "0x7ab04c", "name": "TerminateThread" }, { "address": "0x7ab050", "name": "QueryPerformanceFrequency" }, { "address": "0x7ab054", "name": "SetHandleInformation" }, { "address": "0x7ab058", "name": "IsDebuggerPresent" }, { "address": "0x7ab05c", "name": "FindNextFileW" }, { "address": "0x7ab060", "name": "GetFullPathNameW" }, { "address": "0x7ab064", "name": "VirtualFree" }, { "address": "0x7ab068", "name": "GetProcessHeap" }, { "address": "0x7ab06c", "name": "ExitProcess" }, { "address": "0x7ab070", "name": "HeapAlloc" }, { "address": "0x7ab074", "name": "WriteProfileStringW" }, { "address": "0x7ab078", "name": "GetCPInfoExW" }, { "address": "0x7ab07c", "name": "GetLongPathNameW" }, { "address": "0x7ab080", "name": "RtlUnwind" }, { "address": "0x7ab084", "name": "SetFilePointerEx" }, { "address": "0x7ab088", "name": "GetCPInfo" }, { "address": "0x7ab08c", "name": "GetStdHandle" }, { "address": "0x7ab090", "name": "GetTimeZoneInformation" }, { "address": "0x7ab094", "name": "FileTimeToLocalFileTime" }, { "address": "0x7ab098", "name": "GetModuleHandleW" }, { "address": "0x7ab09c", "name": "FreeLibrary" }, { "address": "0x7ab0a0", "name": "HeapDestroy" }, { "address": "0x7ab0a4", "name": "CompareFileTime" }, { "address": "0x7ab0a8", "name": "ReadFile" }, { "address": "0x7ab0ac", "name": "CreateProcessW" }, { "address": "0x7ab0b0", "name": "TransactNamedPipe" }, { "address": "0x7ab0b4", "name": "GetLastError" }, { "address": "0x7ab0b8", "name": "GetModuleFileNameW" }, { "address": "0x7ab0bc", "name": "SetLastError" }, { "address": "0x7ab0c0", "name": "GlobalAlloc" }, { "address": "0x7ab0c4", "name": "GlobalUnlock" }, { "address": "0x7ab0c8", "name": "FindResourceW" }, { "address": "0x7ab0cc", "name": "OpenMutexW" }, { "address": "0x7ab0d0", "name": "CreateThread" }, { "address": "0x7ab0d4", "name": "CompareStringW" }, { "address": "0x7ab0d8", "name": "CopyFileW" }, { "address": "0x7ab0dc", "name": "GetFileSizeEx" }, { "address": "0x7ab0e0", "name": "CreateMutexW" }, { "address": "0x7ab0e4", "name": "LoadLibraryA" }, { "address": "0x7ab0e8", "name": "GetVolumeInformationW" }, { "address": "0x7ab0ec", "name": "ResetEvent" }, { "address": "0x7ab0f0", "name": "MulDiv" }, { "address": "0x7ab0f4", "name": "FreeResource" }, { "address": "0x7ab0f8", "name": "GetDriveTypeW" }, { "address": "0x7ab0fc", "name": "GetVersion" }, { "address": "0x7ab100", "name": "RaiseException" }, { "address": "0x7ab104", "name": "MoveFileW" }, { "address": "0x7ab108", "name": "GlobalAddAtomW" }, { "address": "0x7ab10c", "name": "GetSystemTimeAsFileTime" }, { "address": "0x7ab110", "name": "FormatMessageW" }, { "address": "0x7ab114", "name": "OpenProcess" }, { "address": "0x7ab118", "name": "SwitchToThread" }, { "address": "0x7ab11c", "name": "GetExitCodeThread" }, { "address": "0x7ab120", "name": "GetCurrentThread" }, { "address": "0x7ab124", "name": "GetLogicalDrives" }, { "address": "0x7ab128", "name": "LocalFileTimeToFileTime" }, { "address": "0x7ab12c", "name": "SetNamedPipeHandleState" }, { "address": "0x7ab130", "name": "LoadLibraryExW" }, { "address": "0x7ab134", "name": "TerminateProcess" }, { "address": "0x7ab138", "name": "LockResource" }, { "address": "0x7ab13c", "name": "FileTimeToSystemTime" }, { "address": "0x7ab140", "name": "GetShortPathNameW" }, { "address": "0x7ab144", "name": "GetCurrentThreadId" }, { "address": "0x7ab148", "name": "UnhandledExceptionFilter" }, { "address": "0x7ab14c", "name": "MoveFileExW" }, { "address": "0x7ab150", "name": "PeekNamedPipe" }, { "address": "0x7ab154", "name": "GlobalFindAtomW" }, { "address": "0x7ab158", "name": "VirtualQuery" }, { "address": "0x7ab15c", "name": "GlobalFree" }, { "address": "0x7ab160", "name": "VirtualQueryEx" }, { "address": "0x7ab164", "name": "Sleep" }, { "address": "0x7ab168", "name": "EnterCriticalSection" }, { "address": "0x7ab16c", "name": "SetFilePointer" }, { "address": "0x7ab170", "name": "ReleaseMutex" }, { "address": "0x7ab174", "name": "FlushFileBuffers" }, { "address": "0x7ab178", "name": "LoadResource" }, { "address": "0x7ab17c", "name": "SuspendThread" }, { "address": "0x7ab180", "name": "GetTickCount" }, { "address": "0x7ab184", "name": "WritePrivateProfileStringW" }, { "address": "0x7ab188", "name": "GetTempFileNameW" }, { "address": "0x7ab18c", "name": "GlobalDeleteAtom" }, { "address": "0x7ab190", "name": "GetStartupInfoW" }, { "address": "0x7ab194", "name": "GetFileAttributesW" }, { "address": "0x7ab198", "name": "GetCurrentDirectoryW" }, { "address": "0x7ab19c", "name": "SetCurrentDirectoryW" }, { "address": "0x7ab1a0", "name": "InitializeCriticalSection" }, { "address": "0x7ab1a4", "name": "GetSystemWindowsDirectoryW" }, { "address": "0x7ab1a8", "name": "GetThreadPriority" }, { "address": "0x7ab1ac", "name": "GetCurrentProcess" }, { "address": "0x7ab1b0", "name": "GlobalLock" }, { "address": "0x7ab1b4", "name": "SetThreadPriority" }, { "address": "0x7ab1b8", "name": "VirtualAlloc" }, { "address": "0x7ab1bc", "name": "GetTempPathW" }, { "address": "0x7ab1c0", "name": "GetCommandLineW" }, { "address": "0x7ab1c4", "name": "GetSystemInfo" }, { "address": "0x7ab1c8", "name": "DuplicateHandle" }, { "address": "0x7ab1cc", "name": "LeaveCriticalSection" }, { "address": "0x7ab1d0", "name": "GetProcAddress" }, { "address": "0x7ab1d4", "name": "ResumeThread" }, { "address": "0x7ab1d8", "name": "GetVersionExW" }, { "address": "0x7ab1dc", "name": "VerifyVersionInfoW" }, { "address": "0x7ab1e0", "name": "HeapCreate" }, { "address": "0x7ab1e4", "name": "GetWindowsDirectoryW" }, { "address": "0x7ab1e8", "name": "DeviceIoControl" }, { "address": "0x7ab1ec", "name": "LCMapStringW" }, { "address": "0x7ab1f0", "name": "GetDiskFreeSpaceW" }, { "address": "0x7ab1f4", "name": "VerSetConditionMask" }, { "address": "0x7ab1f8", "name": "FindFirstFileW" }, { "address": "0x7ab1fc", "name": "GetUserDefaultUILanguage" }, { "address": "0x7ab200", "name": "lstrlenW" }, { "address": "0x7ab204", "name": "QueryPerformanceCounter" }, { "address": "0x7ab208", "name": "SetEndOfFile" }, { "address": "0x7ab20c", "name": "lstrcmpW" }, { "address": "0x7ab210", "name": "HeapFree" }, { "address": "0x7ab214", "name": "WideCharToMultiByte" }, { "address": "0x7ab218", "name": "FindClose" }, { "address": "0x7ab21c", "name": "MultiByteToWideChar" }, { "address": "0x7ab220", "name": "LoadLibraryW" }, { "address": "0x7ab224", "name": "SetEvent" }, { "address": "0x7ab228", "name": "CreateFileW" }, { "address": "0x7ab22c", "name": "GetLocaleInfoW" }, { "address": "0x7ab230", "name": "EnumResourceNamesW" }, { "address": "0x7ab234", "name": "GetSystemDirectoryW" }, { "address": "0x7ab238", "name": "DeleteFileW" }, { "address": "0x7ab23c", "name": "FormatMessageA" }, { "address": "0x7ab240", "name": "GetEnvironmentVariableW" }, { "address": "0x7ab244", "name": "GetLocalTime" }, { "address": "0x7ab248", "name": "WaitForSingleObject" }, { "address": "0x7ab24c", "name": "GetFileInformationByHandle" }, { "address": "0x7ab250", "name": "WriteFile" }, { "address": "0x7ab254", "name": "SetFileInformationByHandle" }, { "address": "0x7ab258", "name": "CreateNamedPipeW" }, { "address": "0x7ab25c", "name": "ExitThread" }, { "address": "0x7ab260", "name": "CreatePipe" }, { "address": "0x7ab264", "name": "DeleteCriticalSection" }, { "address": "0x7ab268", "name": "GetDateFormatW" }, { "address": "0x7ab26c", "name": "TlsGetValue" }, { "address": "0x7ab270", "name": "SetErrorMode" }, { "address": "0x7ab274", "name": "GetComputerNameW" }, { "address": "0x7ab278", "name": "IsValidLocale" }, { "address": "0x7ab27c", "name": "TlsSetValue" }, { "address": "0x7ab280", "name": "CreateDirectoryW" }, { "address": "0x7ab284", "name": "GetOverlappedResult" }, { "address": "0x7ab288", "name": "GetSystemDefaultUILanguage" }, { "address": "0x7ab28c", "name": "EnumCalendarInfoW" }, { "address": "0x7ab290", "name": "GetProfileStringW" }, { "address": "0x7ab294", "name": "LocalAlloc" }, { "address": "0x7ab298", "name": "GetUserDefaultLangID" }, { "address": "0x7ab29c", "name": "RemoveDirectoryW" }, { "address": "0x7ab2a0", "name": "CreateEventW" }, { "address": "0x7ab2a4", "name": "GetPrivateProfileStringW" }, { "address": "0x7ab2a8", "name": "WaitForMultipleObjectsEx" }, { "address": "0x7ab2ac", "name": "GetThreadLocale" }, { "address": "0x7ab2b0", "name": "SetThreadLocale" } ] }, "ole32": { "dll": "ole32.dll", "imports": [ { "address": "0x7ab2b8", "name": "StgCreateDocfileOnILockBytes" }, { "address": "0x7ab2bc", "name": "CoCreateInstance" }, { "address": "0x7ab2c0", "name": "CLSIDFromString" }, { "address": "0x7ab2c4", "name": "CoUninitialize" }, { "address": "0x7ab2c8", "name": "IsEqualGUID" }, { "address": "0x7ab2cc", "name": "OleInitialize" }, { "address": "0x7ab2d0", "name": "CoFreeUnusedLibraries" }, { "address": "0x7ab2d4", "name": "CreateILockBytesOnHGlobal" }, { "address": "0x7ab2d8", "name": "CLSIDFromProgID" }, { "address": "0x7ab2dc", "name": "CoInitializeEx" }, { "address": "0x7ab2e0", "name": "OleUninitialize" }, { "address": "0x7ab2e4", "name": "CoDisconnectObject" }, { "address": "0x7ab2e8", "name": "CoInitialize" }, { "address": "0x7ab2ec", "name": "CoTaskMemFree" }, { "address": "0x7ab2f0", "name": "CoTaskMemAlloc" }, { "address": "0x7ab2f4", "name": "StringFromCLSID" } ] }, "gdi32": { "dll": "gdi32.dll", "imports": [ { "address": "0x7ab2fc", "name": "Pie" }, { "address": "0x7ab300", "name": "SetBkMode" }, { "address": "0x7ab304", "name": "CreateCompatibleBitmap" }, { "address": "0x7ab308", "name": "GetEnhMetaFileHeader" }, { "address": "0x7ab30c", "name": "RectVisible" }, { "address": "0x7ab310", "name": "AngleArc" }, { "address": "0x7ab314", "name": "ResizePalette" }, { "address": "0x7ab318", "name": "SetTextColor" }, { "address": "0x7ab31c", "name": "GetTextColor" }, { "address": "0x7ab320", "name": "StretchBlt" }, { "address": "0x7ab324", "name": "RoundRect" }, { "address": "0x7ab328", "name": "RestoreDC" }, { "address": "0x7ab32c", "name": "SetRectRgn" }, { "address": "0x7ab330", "name": "GetTextMetricsW" }, { "address": "0x7ab334", "name": "RemoveFontResourceW" }, { "address": "0x7ab338", "name": "GetWindowOrgEx" }, { "address": "0x7ab33c", "name": "CreatePalette" }, { "address": "0x7ab340", "name": "PolyBezierTo" }, { "address": "0x7ab344", "name": "GetStockObject" }, { "address": "0x7ab348", "name": "CreateSolidBrush" }, { "address": "0x7ab34c", "name": "GetBkMode" }, { "address": "0x7ab350", "name": "Polygon" }, { "address": "0x7ab354", "name": "MoveToEx" }, { "address": "0x7ab358", "name": "PlayEnhMetaFile" }, { "address": "0x7ab35c", "name": "Ellipse" }, { "address": "0x7ab360", "name": "GetBitmapBits" }, { "address": "0x7ab364", "name": "GetSystemPaletteEntries" }, { "address": "0x7ab368", "name": "GetEnhMetaFileBits" }, { "address": "0x7ab36c", "name": "AddFontResourceW" }, { "address": "0x7ab370", "name": "GetEnhMetaFilePaletteEntries" }, { "address": "0x7ab374", "name": "CreatePenIndirect" }, { "address": "0x7ab378", "name": "CreateFontIndirectW" }, { "address": "0x7ab37c", "name": "PolyBezier" }, { "address": "0x7ab380", "name": "GetObjectW" }, { "address": "0x7ab384", "name": "GetCurrentObject" }, { "address": "0x7ab388", "name": "GetWinMetaFileBits" }, { "address": "0x7ab38c", "name": "SetROP2" }, { "address": "0x7ab390", "name": "GetEnhMetaFileDescriptionW" }, { "address": "0x7ab394", "name": "ArcTo" }, { "address": "0x7ab398", "name": "Arc" }, { "address": "0x7ab39c", "name": "SelectPalette" }, { "address": "0x7ab3a0", "name": "SetGraphicsMode" }, { "address": "0x7ab3a4", "name": "ExcludeClipRect" }, { "address": "0x7ab3a8", "name": "MaskBlt" }, { "address": "0x7ab3ac", "name": "SetWindowOrgEx" }, { "address": "0x7ab3b0", "name": "DeleteEnhMetaFile" }, { "address": "0x7ab3b4", "name": "Chord" }, { "address": "0x7ab3b8", "name": "SetDIBits" }, { "address": "0x7ab3bc", "name": "GetViewportOrgEx" }, { "address": "0x7ab3c0", "name": "SetViewportOrgEx" }, { "address": "0x7ab3c4", "name": "CreateRectRgn" }, { "address": "0x7ab3c8", "name": "RealizePalette" }, { "address": "0x7ab3cc", "name": "SetDIBColorTable" }, { "address": "0x7ab3d0", "name": "GetDIBColorTable" }, { "address": "0x7ab3d4", "name": "CreateBrushIndirect" }, { "address": "0x7ab3d8", "name": "PatBlt" }, { "address": "0x7ab3dc", "name": "LineDDA" }, { "address": "0x7ab3e0", "name": "SetEnhMetaFileBits" }, { "address": "0x7ab3e4", "name": "Rectangle" }, { "address": "0x7ab3e8", "name": "SaveDC" }, { "address": "0x7ab3ec", "name": "DeleteDC" }, { "address": "0x7ab3f0", "name": "BitBlt" }, { "address": "0x7ab3f4", "name": "SetWorldTransform" }, { "address": "0x7ab3f8", "name": "FrameRgn" }, { "address": "0x7ab3fc", "name": "GetDeviceCaps" }, { "address": "0x7ab400", "name": "GetTextExtentPoint32W" }, { "address": "0x7ab404", "name": "GetClipBox" }, { "address": "0x7ab408", "name": "IntersectClipRect" }, { "address": "0x7ab40c", "name": "Polyline" }, { "address": "0x7ab410", "name": "CreateBitmap" }, { "address": "0x7ab414", "name": "CombineRgn" }, { "address": "0x7ab418", "name": "SetWinMetaFileBits" }, { "address": "0x7ab41c", "name": "GetStretchBltMode" }, { "address": "0x7ab420", "name": "CreateDIBitmap" }, { "address": "0x7ab424", "name": "SetStretchBltMode" }, { "address": "0x7ab428", "name": "GetDIBits" }, { "address": "0x7ab42c", "name": "CreateDIBSection" }, { "address": "0x7ab430", "name": "ExtCreateRegion" }, { "address": "0x7ab434", "name": "LineTo" }, { "address": "0x7ab438", "name": "GetRgnBox" }, { "address": "0x7ab43c", "name": "EnumFontsW" }, { "address": "0x7ab440", "name": "CreateHalftonePalette" }, { "address": "0x7ab444", "name": "SelectObject" }, { "address": "0x7ab448", "name": "DeleteObject" }, { "address": "0x7ab44c", "name": "ExtFloodFill" }, { "address": "0x7ab450", "name": "UnrealizeObject" }, { "address": "0x7ab454", "name": "CopyEnhMetaFileW" }, { "address": "0x7ab458", "name": "SetBkColor" }, { "address": "0x7ab45c", "name": "CreateCompatibleDC" }, { "address": "0x7ab460", "name": "GetBrushOrgEx" }, { "address": "0x7ab464", "name": "GetCurrentPositionEx" }, { "address": "0x7ab468", "name": "SetDCPenColor" }, { "address": "0x7ab46c", "name": "GetNearestPaletteIndex" }, { "address": "0x7ab470", "name": "CreateRoundRectRgn" }, { "address": "0x7ab474", "name": "GetTextExtentPointW" }, { "address": "0x7ab478", "name": "ExtTextOutW" }, { "address": "0x7ab47c", "name": "SetBrushOrgEx" }, { "address": "0x7ab480", "name": "GetPixel" }, { "address": "0x7ab484", "name": "GdiFlush" }, { "address": "0x7ab488", "name": "SetPixel" }, { "address": "0x7ab48c", "name": "EnumFontFamiliesExW" }, { "address": "0x7ab490", "name": "StretchDIBits" }, { "address": "0x7ab494", "name": "GetPaletteEntries" } ] }, "ntdll": { "dll": "ntdll.dll", "imports": [ { "address": "0x7ab49c", "name": "_allshl" }, { "address": "0x7ab4a0", "name": "_aullshr" } ] } }, "exported_dll_name": "SetupCustomStyle.e32", "exports": [ { "address": "0x411f7c", "name": "__dbk_fcall_wrapper", "ordinal": 2 }, { "address": "0x788648", "name": "dbkFCallWrapperAddr", "ordinal": 1 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x003b0000", "size": "0x00000079" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x003aa000", "size": "0x00004048" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x00400000", "size": "0x000518d8" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x00426800", "size": "0x00004f98" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x003b3000", "size": "0x0004c3e8" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x003b2000", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x003aaaf4", "size": "0x000009b4" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x003af000", "size": "0x00000e50" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x0036c6b0", "size_of_data": "0x0036c800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.45" }, { "name": ".itext", "raw_address": "0x0036cc00", "virtual_address": "0x0036e000", "virtual_size": "0x0000ac94", "size_of_data": "0x0000ae00", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.15" }, { "name": ".data", "raw_address": "0x00377a00", "virtual_address": "0x00379000", "virtual_size": "0x0000b830", "size_of_data": "0x0000ba00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "6.23" }, { "name": ".bss", "raw_address": "0x00000000", "virtual_address": "0x00385000", "virtual_size": "0x00024890", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "0.00" }, { "name": ".idata", "raw_address": "0x00383400", "virtual_address": "0x003aa000", "virtual_size": "0x00004048", "size_of_data": "0x00004200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "5.22" }, { "name": ".didata", "raw_address": "0x00387600", "virtual_address": "0x003af000", "virtual_size": "0x00000e50", "size_of_data": "0x00001000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "4.13" }, { "name": ".edata", "raw_address": "0x00388600", "virtual_address": "0x003b0000", "virtual_size": "0x00000079", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.39" }, { "name": ".tls", "raw_address": "0x00000000", "virtual_address": "0x003b1000", "virtual_size": "0x00000058", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "0.00" }, { "name": ".rdata", "raw_address": "0x00388800", "virtual_address": "0x003b2000", "virtual_size": "0x0000005d", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.38" }, { "name": ".reloc", "raw_address": "0x00388a00", "virtual_address": "0x003b3000", "virtual_size": "0x0004c3e8", "size_of_data": "0x0004c400", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.73" }, { "name": ".rsrc", "raw_address": "0x003d4e00", "virtual_address": "0x00400000", "virtual_size": "0x000518d8", "size_of_data": "0x00051a00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "6.77" } ], "overlay": { "offset": "0x00426800", "size": "0x00004f98" }, "resources": [ { "name": "VCLSTYLE", "offset": "0x004010e4", "size": "0x0001de46", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.94" }, { "name": "RT_CURSOR", "offset": "0x0041ef2c", "size": "0x00000134", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.62" }, { "name": "RT_CURSOR", "offset": "0x0041f060", "size": "0x00000134", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.80" }, { "name": "RT_CURSOR", "offset": "0x0041f194", "size": "0x00000134", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.00" }, { "name": "RT_CURSOR", "offset": "0x0041f2c8", "size": "0x00000134", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.56" }, { "name": "RT_CURSOR", "offset": "0x0041f3fc", "size": "0x00000134", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.69" }, { "name": "RT_CURSOR", "offset": "0x0041f530", "size": "0x00000134", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.63" }, { "name": "RT_CURSOR", "offset": "0x0041f664", "size": "0x00000134", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.92" }, { "name": "RT_CURSOR", "offset": "0x0041f798", "size": "0x00000134", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.66" }, { "name": "RT_ICON", "offset": "0x0041f8cc", "size": "0x00004228", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "1.05" }, { "name": "RT_ICON", "offset": "0x00423af4", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "1.46" }, { "name": "RT_ICON", "offset": "0x0042609c", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "1.09" }, { "name": "RT_ICON", "offset": "0x00427144", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "1.03" }, { "name": "RT_ICON", "offset": "0x004281ec", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "1.44" }, { "name": "RT_ICON", "offset": "0x0042a794", "size": "0x00004228", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "0.99" }, { "name": "RT_ICON", "offset": "0x0042e9bc", "size": "0x0000d3c4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.99" }, { "name": "RT_ICON", "offset": "0x0043bd80", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.06" }, { "name": "RT_ICON", "offset": "0x0043e328", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.32" }, { "name": "RT_ICON", "offset": "0x0043f3d0", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.10" }, { "name": "RT_STRING", "offset": "0x0043f838", "size": "0x00000278", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.11" }, { "name": "RT_STRING", "offset": "0x0043fab0", "size": "0x00000414", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x0043fec4", "size": "0x000002f8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x004401bc", "size": "0x00000234", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.38" }, { "name": "RT_STRING", "offset": "0x004403f0", "size": "0x00000728", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.35" }, { "name": "RT_STRING", "offset": "0x00440b18", "size": "0x00000b78", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.26" }, { "name": "RT_STRING", "offset": "0x00441690", "size": "0x00000444", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.30" }, { "name": "RT_STRING", "offset": "0x00441ad4", "size": "0x0000035c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x00441e30", "size": "0x000003e0", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x00442210", "size": "0x000000d8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.50" }, { "name": "RT_STRING", "offset": "0x004422e8", "size": "0x000000d0", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.41" }, { "name": "RT_STRING", "offset": "0x004423b8", "size": "0x000002f0", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x004426a8", "size": "0x000003f4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x00442a9c", "size": "0x000003e8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.30" }, { "name": "RT_STRING", "offset": "0x00442e84", "size": "0x00000578", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x004433fc", "size": "0x0000021c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.20" }, { "name": "RT_STRING", "offset": "0x00443618", "size": "0x00000440", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.46" }, { "name": "RT_STRING", "offset": "0x00443a58", "size": "0x0000058c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x00443fe4", "size": "0x00000484", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.27" }, { "name": "RT_STRING", "offset": "0x00444468", "size": "0x0000032c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.34" }, { "name": "RT_STRING", "offset": "0x00444794", "size": "0x00000350", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.31" }, { "name": "RT_STRING", "offset": "0x00444ae4", "size": "0x00000438", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x00444f1c", "size": "0x000001d0", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x004450ec", "size": "0x000000cc", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.36" }, { "name": "RT_STRING", "offset": "0x004451b8", "size": "0x00000194", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.42" }, { "name": "RT_STRING", "offset": "0x0044534c", "size": "0x00000338", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.31" }, { "name": "RT_STRING", "offset": "0x00445684", "size": "0x00000398", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.31" }, { "name": "RT_STRING", "offset": "0x00445a1c", "size": "0x00000310", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x00445d2c", "size": "0x00000328", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.25" }, { "name": "RT_RCDATA", "offset": "0x00446054", "size": "0x00000010", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "4.00" }, { "name": "RT_RCDATA", "offset": "0x00446064", "size": "0x00001800", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.72" }, { "name": "RT_RCDATA", "offset": "0x00447864", "size": "0x0000148b", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.93" }, { "name": "RT_RCDATA", "offset": "0x00448cf0", "size": "0x0000111e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.91" }, { "name": "RT_RCDATA", "offset": "0x00449e10", "size": "0x00000d8c", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.89" }, { "name": "RT_RCDATA", "offset": "0x0044ab9c", "size": "0x00001080", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.33" }, { "name": "RT_RCDATA", "offset": "0x0044bc1c", "size": "0x00000472", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.53" }, { "name": "RT_RCDATA", "offset": "0x0044c090", "size": "0x000003f2", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.49" }, { "name": "RT_RCDATA", "offset": "0x0044c484", "size": "0x000004b5", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.50" }, { "name": "RT_RCDATA", "offset": "0x0044c93c", "size": "0x000009ee", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.42" }, { "name": "RT_RCDATA", "offset": "0x0044d32c", "size": "0x000007e5", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.51" }, { "name": "RT_RCDATA", "offset": "0x0044db14", "size": "0x00000557", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.48" }, { "name": "RT_RCDATA", "offset": "0x0044e06c", "size": "0x00002a70", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.50" }, { "name": "RT_GROUP_CURSOR", "offset": "0x00450adc", "size": "0x00000014", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "1.84" }, { "name": "RT_GROUP_CURSOR", "offset": "0x00450af0", "size": "0x00000014", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.02" }, { "name": "RT_GROUP_CURSOR", "offset": "0x00450b04", "size": "0x00000014", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "1.92" }, { "name": "RT_GROUP_CURSOR", "offset": "0x00450b18", "size": "0x00000014", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.02" }, { "name": "RT_GROUP_CURSOR", "offset": "0x00450b2c", "size": "0x00000014", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.02" }, { "name": "RT_GROUP_CURSOR", "offset": "0x00450b40", "size": "0x00000014", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.02" }, { "name": "RT_GROUP_CURSOR", "offset": "0x00450b54", "size": "0x00000014", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.02" }, { "name": "RT_GROUP_CURSOR", "offset": "0x00450b68", "size": "0x00000014", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.02" }, { "name": "RT_GROUP_ICON", "offset": "0x00450b7c", "size": "0x0000003e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.55" }, { "name": "RT_GROUP_ICON", "offset": "0x00450bbc", "size": "0x00000030", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.63" }, { "name": "RT_GROUP_ICON", "offset": "0x00450bec", "size": "0x00000030", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.55" }, { "name": "RT_VERSION", "offset": "0x00450c1c", "size": "0x00000514", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.94" }, { "name": "RT_MANIFEST", "offset": "0x00451130", "size": "0x000007a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.19" } ], "versioninfo": [ { "name": "FileDescription", "value": "Setup/Uninstall" }, { "name": "FileVersion", "value": "51.1052.0.0" }, { "name": "Comments", "value": "This installation was built with Inno Setup." }, { "name": "CompanyName", "value": "CrystalIDEA Software " }, { "name": "LegalCopyright", "value": "Copyright © CrystalIDEA Software " }, { "name": "OriginalFileName", "value": "uninstalltool_setup.exe " }, { "name": "ProductName", "value": "Uninstall Tool " }, { "name": "ProductVersion", "value": "3.8.1 " }, { "name": "Translation", "value": "0x0000 0x04b0" } ], "imphash": "e4cd0109a7a401210b49e8ba5cbb3b85", "timestamp": "2025-11-10 17:25:54", "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAQ30lEQVR4nL2ZeXTV5ZnHP7/t7jf3Zg9rAgQpiwurKCIi1dZBra1YdabtiLa14wxWLKet1s6MU85pHXu0nY7OUJVi1SlSsFVRCFAQIZZUIWwhCVlIyH7vzc3dl986f9AbkhAwduw85+Tkd97z5rnf7/P9vs/z/nIFxhhFj+/5qV2NfmfO3yxNFRUVuDJZsyWVNTYamvbGruV5DWPN82mHMNaNJY9VpVxWwjnz3i/h0gzcoonTMrEMk6wlxvqj2f9RVfXFXbcWH/5rAh4ZYyJQ8IOqSTZDP1tY4mLSjTeghgewOdw4AJdlkS+b5IkWhm6QzJp0xvRfqbr+6o4vle39K+NHHssm05RvEM0M7nHjqCTFdLWRPcc7adWc5I2fQrhoHE7ZjgcolAXmFSurNU1cPX1XiFDE+n0ilXzxrfsq3vlrEBiTAkWP7d5s0+J3T115Y/YnV/rsS/LPrWuGzrYPm9h9rIW6sIqcPxFv4ThcDg9u0cQvQ5EdDM0kmTHpjxlV8UTm5W0PTt2MIFj/bwRKflCVdOhJV8WqO3jnKgHPRXR7v76dqtpW/tQaJm0rxFNYhsflxylZ5EkWhU4B0RSJJ0yS6dDhe2+uPeOV81ephko023m0KXlw7ZrLt773qRLwrKsqcUlGX0GRh8tvWsKWK8UxJT7TG+bNmib+dLqXswkFn388dmchxd4eFk4/bV03rUKwyz50I0FT7CDH+n9LVO3hqWs7x9xYYAxnQJFtNwlmEmdpMXM9Y088payAR75wNQCaBq/XVBEQfs/c8klMybteiAltnInv548dm8hYcdJhBYfvE2EfGwFJsG7DMnGWleiLfOKYDv3QqA+9z+G+d1GKBT474bOYcoK6gd+w/8wGTMEg1isSaDGY7J2VynhPuT51ApZo3YYAtrw8aW7e2JJm9BTHA1XUhfbhcNmonDIHm+Smvns7NZ2vgCAT6xIJtJosqFzO+m/+hCJHuWv1bm/oUyXgWVdVgqm7XAX55NsEocB26WT96Q6O9u2kLXqEwoIiZs6Yg66aHGvbQUP4D1imTLhdIdolsHT2rTz33f/ALjkASCYzxAXN/FQJKLLjJqw0zpJCFnkvvq89epzavncY0LooKypj7uRFDESC7Kv7FX3JFgxDor9ZJtvv5JZFf8fXv7r+ghxSJpx8pL6s5Y2ap+OEWxtp2nW38PDelv8TAVPgNsGw8JQUWlf7peEnzLI4HtrDib7dYNMZXzqByd4F9IXOsq3mKZL6AGpaItgCYjyPL9/wEHcu+vbIjzDY+4sj7Pm53aGrV1w//wvXMGMxySPG/N7W0ub2td/YWv7sC3f9xQQEwfo8WLiL8rlqiP+P9v2Bs/HDWPYkUyrLscsu2nvreOv4s5iCRiYq0Ndk4hcn8q0b17Fizr3DEx/d3sK76/sJtc1j6sKFLP0aGcNPoLqW0MavYsRVvE4Hntmz8i+F79IE1hzKs6ykz+H3kS+LQv4Q/z9dvY5SbxH/eO2/cSK0nT3N/40kyyRCIoHTBpP8s/iXO55kbsXy83/UeSLMW//aRMP+mVRcNY05K6YZvgqCHxwj8OIh0r1xPHYFv6jQYap0RVJ6ZUqYessta+w7dvwi+4kJePPMFZZhkVdSwFXe4VO/K9JFXyJEZ/Bsalfbc65UwE6w2WLmhHk8fv9PmFZ8+bmN8aDOuz+uo+a1IoqnTmD64qu56qf0154m+EY98aaD2GUJl6JgSAr1kaTmvm6pPP/Bbwq90ZTc/NQ/T7lxQVWosvya43Vd163Z+/bTRz6WwJo1a+xOUX3yd5GT3+v1VJJXWsiCEQNGFCRkU2Zf81tqX5PsuqLoZp599OfkOwrObdj3fAO7fiZgt81gxtIr+fJTxFu7Ce4/SfjEJkRDxG2z47M5aeofQL1sul75pTvkVX+7SgHACqPvWc3l//42Qj4eHG3Xtn0UP/y4dM0p2Tv7+VdeefG5HJYLRt+SJUus5rqjJB/4LZZsZ8HKxWxZ5KLEfn7PDS9MQkwrfKZwGl9f/h3mjf88/ft/Q8+2HzPLEUWcvRwqryEdMwi9X0t/bRtGXMdls6Mg0R1P0CvLVtmttwgL/+HrOAv95xJrQdT6tZB4DTkPxKJSssml9B5uJn76KFUBmU375zLrM1NObdmyZfaoCjTU16OLDoxUAk+hiM1mxzXi+qOnJIS4QtZtMWn85SRffgxvRw2Fa/4TLZsltP1tgm++Tbo7idPmwCs7SJgqdYEY7uuu5sqv3cv1SxadL56WQG38J4i9jOQFaVIxmrGMjuo2Qie2ItuAIojGbmfVnfNoOl0/66IWsjscOEyNUM1vLGPWAsHt+Rx3Hga/pTPPZ7C42A5ZET0pYmkSrc1nGdixl+KeBq68x8ap7/8MYSCFw2bHZvPQ1B9BmzSBKV/9CqtW3z2iEkm0xkewYpuQPDrSxDxUczldtSECR7Yi2UAugaqua61QYqUQjXURaT9OIpEYTHEBAcuysASZwu5qgY79HNj9i6x39jX24vkrCM68mg8qFyDpCtmkAKZCW2s7dsMkEoe2d/fhjlj0JA1Op1OU3LKC67/193gmjbsQePOjWJGNSG4dabwDXfgiXaeCdNa8iSKDrRTe61tEZ+cdVqS/Uwj3H0GSJCRJQhDOi3fRLmQJEsgSdrCnTxygsWZnxtBUh9tZwNyn8ol2JYjEY1iChaqq9KsaBZ3d1GcSXP/Mkyy98doLk44EPs6BLt9B54kAnTW/RZLBVQIHQ/No7VhlRfo7hf7gh4IoioiiOAz4xxIYJAKIsoLHl+8wTZNUIq0d2XhG+faaR1hz6w853dXG8UQCNINIOM6q997G5nEMT2Kk0JrWngdeJmMoK+mqz3D2g61IEjiK4Gh8DifP3mtFw91Cf/AjASwkSQIYFfxFCciyjGEYWNb5/m9ZFoIgoBmq8srj25g3bx6pTJJQsB81ncHSDf7U2cP+Z5+mpLCQB77xEHYFtKZHsfqfR3JnEUsEcK6kq1Gk/f23EUVwFcKxxGUca/8KiViA3p4aQRCEPwO/EPRIIqMSyLE2TRPTPH9BTKfTPPPMM8yeM4tUOomYFXnise8zPZBlmWXRmlL50UMPUX3gAG++8EXuWrQT0ZZBLAYcN9PXqtC6/9y7vTMfGrJTOdK5mthAgL7eI1iWiWVZGIaBJEkJwHOp6n8sAUEQEEURXdexLIvCwkJuv/12gsEgfr+fzZs309p4mna7Q3+915Tff/4HnGlp4dZb7+B793+RL99pQ7JuorfFTvN7O8AycHihzZhETff9JGJRujs/xDAMBEFAVVWmTZsWveeee3xr1671TJs2bdAFY7aQZVnI8vll0zSRJIlsNsvKlSuJxWJIksTAwAC//vWvURQFXc3KV1x5FaWVFcSiURQZuhqBM9P44weH0FJxXF7oEsaxv/M+tIzG2faj6LqGKIpomsbEiRMH7rrrrvwJEyb4BEGwSktLBcMwEEVxEFfueUwKCIKAIAiD1cmt5Szl8/lYvHgx27Zt4+677+aBBx5AU1X8fj/hcJgth+0sfqaea+ZDSCjiUM83SKUNzp45hWFog13F6XTGH3zwQW9FRUW+qqoANDU1GYqiyDngn0gBAJvNhqqqSJI0aCFZlqmvr0eSJCzrXOtct24dTz75JKZpkkqlEASBkpIS1q9fT4HPww+rvFrNjw4r+zf8F20tpwYrnqukpmmsWbPG6/V6MU2TeDyeeumll1wnTpyQ8/PzKSgouMAdYyIgyzKWda6FaZqGoigIgsDhw4dJJpMoioKmaUiSRDQaxTAMXC4Xfr+fo0ePsn37dhRFxuVSlM2vvkBbyymG2mEooLKyMgKBQOa1115zVFdXu5xOJ+Xl5YiiOKz6uS44ksSoZ8Butw92g9xvWZax2Ww0NDQwY8aMQYKKouD1enE6ndTW1rJx40bOnj2L1+vNdZNBO44MRVF46aWX2Llzp0MURSZPnoyiKJimeVHwuedLKpBLomnaYBJN05g1axaXXXYZmqYxc+ZMPvzwQ44dO0YsFqOjo4P29nYOHTqE1+sdJvlo0gOIokhtbS1lZWU4HOeG39C2PbKwOfBD94yqgM1mG9yUOwPZbJb777+fVCrFjBkz8Pl8HDx4kJ07d9LV1UVnZyd+vx+fzzdYLdM0MQxjVEC5GAo8V9mhFTZNc9BOOfCjKjBx4kSnpmlllmXhcDgG25amaZimybx585gyZQoApaWl7N69m2g0ykcffYQsy/h8Ptxu9zD5cwAupsBI4KOtDwU91D4ej2em3+9vG9lYSwVBIJPJ4HK5sNvt2Gw2RFHktttuI5PJUFlZSTqd5sCBA+zevRu73Y4kSbjd7sGuNVTNS4EfGbn9OdK555ySgiCQTqfJZrPIslxqmqYwzEJ/7j67amtrby4tLR2s+PTp05kwYQJ2u53i4mI2b95MJBLhzJkzKIqCZVk4nc4LbJcDMBbgl1rP5YvFYqRSKdLp9F6Hw5GCIRbq7OxMV1RUNGSz2cclSdoTDAYfDYVCZRUVFSxcuBBVVZk9eza9vb3U1dVx6NChQf8qijLYWnOgcy34UgRGAz604+S8H4lESKVSZLPZvnA4/FQymdxbWlra2tjYmBqmQFtbWwQ4PH78+IBlWcez2ew95eXl91VUVOD1eikoKGDDhg2Ew2F6enqw2WwYhoHX60UUxcF5MbTnj3YGRt5yRyNjmiaJRIJkMomu61oikdgYi8VeE0WxMRKJBCKRCMMUGBrd3d0dQGD+/PmRBQsW3GeaJpWVlTQ3N9PT00NzczOCIKAoCqIo4vF4sCxrcLgNbXU5K40cQiOBD92TyWRIJBLouk46nd4VCoWeE0WxLhgMtgHD2tqlXmiyy5Yt+2llZSV+vx+3282mTZtoaGigo6MDp9M5eLAcDge5e0zOOhdTYOjBHgleVVUSiQSZTAZd1xsDgcDTgiB8JAhCSyAQSDBKXJTAE088Md0wjOvsdjtTp07lxIkTRKNRq7q6+t1YLLbS5XLh8/nw+XzIsjwIIDe9cwrkhuGlgJumSTKZJJPJoGnaQCQSeS6dTu8RRbEhEAj0XaLIFyfQ39//zrJlyygqKkKWZXbs2EFfX9+m7u7uVrfbPaCq6ore3t5xdrsdv9+PqqqDJHKVH6nAaHZJJpOkUikMwzASicSWRCLxummadaFQ6Awj7DJmAg8//PByh8Mx3ePxUF5eTk1NDdlsVv/lL3+5DVBUVe3Xdb3H7XZPCYVCnxsYGPCWl5djt5/775coioMEhr6aDr0OZDIZ4vE4hmGQSqUODQwMbACOAs3BYHBUu4yZQCqVevWKK67A4/FgGAbV1dW0tLT8HEgATk3TjpeUlLyhKMo4XderDMO4p7m5eYXf76esrAxJkobNgaHAdV0f6vOOSCTynGmaNYIg1H+cXcZMQFXV8U6nE6fTyb59+9B1Pfb666+/CriAU0AwEAgA9E2cODFomuZZ4EAsFrsvFotVlJWV4ff7AYadiSE+T0Sj0Zez2ewfLMs6GQwGWxmDXcZMwGazIUkSra2t1NfX09TU9F2g988/w6Kzs7MLCE2aNKnbsqwW0zRv7OnpuTMSieTlJmgymSSZTGIYhpFMJt+Nx+O/B2qBpk9ilzETsNvt9508efJpVVWtVCq1fuvWrRs+Jk+2o6PjpMfj6fN6ve2yLO/LZrNLBEFYrWmaLRaLoev6G/39/b8TRbEDaAwGgxcU4y+JT/7F7MeHWFBQ4CktLZ2sKEop4DIMI2lZVl9vb29HOBxOAJ/4y7yLxf8Cqcce7B/KtMAAAAAASUVORK5CYII=", "icon_hash": "4740e8214f71a7b8bfa204b086a75d41", "icon_fuzzy": "1a1010aa6a1d01679c6b3c7d467dd16a", "icon_dhash": "7cfccce0d88ce672", "imported_dll_count": 15 }, "data": null, "strings": [ "TExtractionWizardPage", "+TArray", ";&;-;4;;;B;I;P;W;^;e;l;s;z;", "9+939A9T9b9s9", "3TDictionary&", "212?2S2i2~2", ">4>Y>", "erOutofRecordRange", "CoSuspendClassObjects", "808>8Q8f8t8", ":$:,:4:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:x:", "clMediumseagreen", "clGainsboro", "function GetSystemDir: String;", "NamingAttribute", "; ", ";H;X;\\;`;h;p;t;x;|;", "Invalid destination array\"Character index out of bounds (%d)", "<8<<<]e>m>u>}>", "tsLowerTrackHorzDisabled", "frelocs", "OnCanResizeL", "1@2O2", "sfCheckBoxTextHot", "<4.TEmptyFunc`'@", "667H7X7e7r7", "TReader", "7&747F7U7d7", "4.5g5", "GetContentLength", "ATicks", "SelectDirBitmapImage", "Internal error: Item already expanding", "FOffsets", "QueryCancelAutoPlay", ">1?U?", "scButtonNormal", "GTDictionary.TKeyEnumerator;", "taLeftJustify", "TReceiveDataExCallback`'@", "TList.TEmptyFunc`'@", "Property '%s' is read-only", "FAlphaBlendValue", "iso-ir-148", "G>N>", "0'0X0e0", "Expected CustomDestName flag", ".IEnumerable", "MoveToEx", "TabStopt:Q", "Uh`8L", ";&;B;P;];o;|;", "ttdPrimaryPanel", "EPNGMissingMultipleIDAT", "clWhite", "8 8(80888@8H8P8X8`8h8|8", "DrawTextBiDiModeFlags", "> >$>1>E>]>x>", "ptmNone", "fsStrikeOut", "%TPair", "kebcRight", "lTEnumerator>(", "*TEnumerator(", "ASourceHeaders", "ExtractRecData", "btnAudio", "2&2;2I2`2u2", "0@1o1", "FClients", "_CERT_CONTEXT", "5&5:5P5U5", "TPushButtonActionLinkP", "7$707u7", "TrackOff", "function IsArm64: Boolean;", "Positionxvb", "claAntiquewhite", "TStringBuilder.TEnumerator", "!TSimpleExpressionOnExpandConstant", "ReplaceWithColorXFA", "260709235959Z0e1", "ttbDropDownButtonGlyphPressed", "tmcNavPrevHot", "ParentWnd", "TMultiWaitEvent", ";D$H~'", "1TList.TEmptyFunc`'@", "TUxThemeTextLabelElements(", "GetScrollInfo", "PropInfo", "sms-FI,sms,se", "FreeEncodings", "FInternalCookieManager", "FSheetOfGlass", "BottomPanel2", "1d2Z3p3", "scEdit", "525K5a5", ";';5;H;T;X;x;", "SD+CH", "UpdateRunList", "GTList.TEnumerator5", "8&8.868>8K8e8", "RoundRect", "bhsBalloon", "9;9a9t9", "crGreaterThan", "ComparerpZK", ",TEnumerable", "KillTimer", "=Q=U=|=", "zcMax", "AObject", "count", "teEditBorderHVScrollNormal", "FOnCardChange", "AEntries", "erUnexpectedEof", "TOnIdleCall", "6!666B6J6[6f6n6", "WriteBufferData", "OnAnimate", "FTCollectionNotifyEvent", "FNeedsDefaultPaint", ":V;Z;b;", "@TDictionary.TItem", "TByteArray", "8/9B9x9", "GetDataModule", "3:3]3", "Will append to existing uninstall log: %s", "HZZ<*I", "9$9(9,9094989@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "Cancel", "Uh5xp", "tmpbStepNormal", "claLightcoral", "eeSunkenInner", ";\";&;D;H;c;g;", ";G@t!", "0f1m1", "MapVirtualKeyW", "=\"=2=B=R=b=r=", "SetArg", "7P7`7d7h7p7x7|7", "9)989^9b9", "mbLeft", "909P9p9", "ATitle", "bsSplitButton", "TRttiMethodTypeQ", "(basic) procedure ", "TProc`'@", "AElCount", "ATypeInfos", "PDispIDList YD", "1TList.ParrayofTh", "1j2_3", "GetSysPopupItem", "kbbcUp", "IntegralHeight", "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl05", "383F3U3h3", "STATIC", "GetValue", "InstructionText", ">7>A>K>U>[>e>k>u>{>", "\"TObjectList", "-- Archive entry --", "ReadResHeader", "TFavoriteLinkItems#", "ttTopTabItemBothEdgeNormal", "tttStandardLink", "TCustomStyleEnginec", "Uh)Ub", "VTArray>", "FReadFunc", ":?:N:e:", "TFileExtractor.ReadProc: Negative FChunkBytesLeft", "TLZMA2Decompressor", "btnPrev", "TNetEncodingE", "LongBool", "FHotTrackTimer", ";C >$>(>,>0>4>8><>@>D>H>U>j>", "1X2h2p2x2", "saRequiredEmpty", ":2:@:P:]:q:", " !\"#$%&'(!)*+,-./0'", "?\"?5?=?K?^?r?", "GetColor", "SVWUQ", "7,7@7Z7b7p7", "Invalid destination index (%d)", "6A7n7", "090_0", "cdRegister", "TWinControlX", "5TList&", ")]FTM", "csOverrideStylePaint", "Uhu-f", "8 8084888<8@8D8H8P8T8\\8`8d8h8p8t8x8|8", "TContainedAction", "btnCancel", "TStackPanelControlCollection", " TStackPanelHorizontalPositioning", "NewPageID", "Deleting the key.", "FSelectGroupBitmapImage", "5T6a6q6~6", "7 737;7I7W7k7~7", "Uhk_o", "GetDockClients", "FUserInfoNameEdit\\", "StatusLabel", "1#212C2\\2s2w2", "DrawTextW", "SetPixel", "8W;e;", "=.=d>", "TConversionFormat", "kgdsDisabled", "D$ )C", "444n4y4", "09L$,", "ssBoth", "? ?$?(?,?0?4?8?#>'>+>F>N>f>j>", "K\\+K,", "303q3", "GetPreamble", "FThread", "RedrawNow", ")TList.TEnumerator5", "tclCheckListBoxDontCare", "CustomForms", "1#1'1H1X1`1h1p1t1x1|1", "FDefaultExtension", "<)<0T.X", "ktrbdsDisabled", "W&qz$", "UhfTf", "3)3<3N3t3", "OnClickCheck", "3*3<3N3_3v3", "929:9B9J9R9Z9b9j9", ";!#>3>E>M>[>h>v>", "OnModalBegin\\oG", "AMinChars", "Uho$r", "AddHeader", "GetCurrentProcess", "1*1I1%2b2", "tsUpDisabled", ";!;6;D;T;j;", "AAutoSizeExtraHeight", "FExclusive", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$ActRec", "Time stamp of existing file: (failed to read)", "PressedImageName", "ttdButtonWrapper", "3%4<4", "<,=X=", "TSeStyleOption", "FWizardBitmapImage2", "t]gdt", ":):;:Q:`:r:v:", "8!8(8/868=8D8K8R8Y8`8g8n8u8|8", "$>6>:>T>d>l>t>|>", "SetThreadDpiAwarenessContext", "FileVersionLS", "434Y4u4", "TEncoding", "PopAbove", "AsOrdinal", "TSeButtonState", "Lines.Strings", "OnFindMethodInstance", "FFinished%", "6$7h7", "$O`nX", "TSeLabelInfo", "sfNormal", "FRTLFactor", "R$Z_^[", "9 969L9[9i9x9", "?+?0\\0n0y0", "LongInt", "kmgCheckGlyph", "PList", "NoCancel", "TSplitRectType", "FExpandedDestDir", "TChunkIEND", "TMargins7", "Uhg'c", "7J7X7u7", "iso-8859-2", "dwHighDateTime", ";A0v,", "Event", "Vcl.Formsi", "8 9F9j9", "Construct", "dwXCountChars", "FPaintOnEraseBkgnd", "EPngErrorHH^", "TSeToolSubclass", "AScriptFuncLibraryRegister_R.RegisterNewDiskFormScriptFuncs$0$Intf`'@", "ENonPublicType$", "D$dSP", "TLocalTimeZone.TYearlyChanges(", "{TEnumerator>>(", "GETSHA256OFSTRING", "HelpShowTableOfContents", "target.lnk", "8-858C8Q8e8{8", "claWhite", "pnU`Y", "?0?M?", "GetOle2AcceleratorTable", "?/?7?H?`?h?y?", "<2=A=k=;>n>", "1t1\\2", "RuntimeID cannot be empty", "BCryptOpenAlgorithmProvider", "TThemedTrackBar", "8 969d9", "AAllow", "> ><>R>", ":TSimpleExpression.:1", "Vcl.Imaging.pngimage", "SENDBROADCASTMESSAGE", "kmicExpandButton", "9!9%9)9-9195999", ":%:::R:`:n:", "fsNZero", "0)1C1G1K1O1S1W1[1_1c1g1k1o1s1w1{1", "BeforeDestruction", "5%585F5X5m5y5", "FDragHandle", "5)6X6j6}6", "1R2Y2", "5=5t5", "PrevSelectedTasks", "IFileDialogEvents`'@", "$TMultiReadExclusiveWriteSynchronizerD", "kTEnumerator>(", "GetDeviceCaps", "FrameExtended", "dwOrigin", ":@;D;H;L;d;p;t;x;", "Out of memory", "ITDictionary.TItemArray", "SetFocus", "InitializeSetup raised an exception (fatal).", "FButtonSize", "7,707L7l7x8", ">8>]>a>", "!TArray", "8+898M8c8v8~8", "%TEnumerable", "Exception while communicating with helper:", "NewName", "Proxy", "FTCollectionNotifyEvent", "2(3:3P3_3k3y3", "BarDrawItem", "020H0[0c0q0", "0H0W0[0|0", "TopIndex", "ttbSplitButtonChecked", "OleFormObject", "FFormHook", "clLavenderblush", "TSysReBarStyleHook\\", "Floating<$Q", "FOnMinimize", "tfFlyOutDivider", "*TArchiveExtractBaseCallback.TArrayOfUInt32", "StringFileInfo", "7TCollectionNotifyEvent", ";$;c;", "9$9>9B9\\9l9t9|9", "ttnTrayNotifyDontCare", "TList&", "function IsDotNetInstalled(const MinVersion: TDotNetVersion; const MinServicePack: Cardinal): Boolean;", "stfShadowColor", "InnerException", "QualifiedClassName", "=4>D>H>L>P>T>\\>`>d>h>l>p>t>x>|>", "3-3;3Q3f3t3", ";8;=;X;];x;};", "FCurrentCPUUsage", "HeapCreate", ":%:-:;:R:f:n:|:", "2+2;2", "js|V=", ":6:[:", "5&5;5S5[5c5k5s5{5", "5=5K5P5U5", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$5$Intf`'@", "FOnChange", "teEditTextDisabled", "fkCommand", ";!;=;a;v;~;", "eucjp", "_}QV9z", "caNone", "tgFixedCellNormal", "ModifyPath", "Uh/>p", ">&>M>V>", "aTEnumerable>'", "TImageMargins8", "caHide", ";r5B5i5s5w5", "FrameRect", "ktidsActiveHot", "sbHorizontal", "m1q1u1y1}1", ">I>v>", "AuthorURL", "t$4VU", "/UNINSTMODE", "ESafecallException", "cp869", "taskdialog", "9^9k9", "RichEdit20A", "ConsumeMultiToString", "5$555I5Q5b5{5", ",TEnumerable|", "1?2C2G2K2O2S2W2", "TURLSchemesa", ",TList.TEnumerator5", "GetShortCuts", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$19$Intf`'@", "SafeArrayAccessData", "DWRITE_LINE_METRICS", "UhQfr", "claWhitesmoke", "FocusEffect", "FFieldType", "0<0N0T0e0", "TChunkIHDR_", "0,060C0H0Y0c0m0x0", "TVarData", "6'656D6r6v6", "FPressed", "clNone", "FNeedClientCertificateCallback", "FullRepaint", ">TList>.ParrayofT", "ArchiveFindFirstFile: Unknown ArchiveFileName extension", "cxyg8", ".,x{|", "$TEnumerator(", "FLastList", "859;9", "FScaledBitmap", "BOOLEAN", "InnerPage0._", "9#939E9M9[9h9v9", "TSeCheckInfo", "rgsabound", "kttdsHot", "TCustomAction6", "ToolItemTextSelected", "FInnerException", "9aBcPaH&", "%TStackPanelControlVerticalPositioning", "AIndex", "?$?+?2?9?@?G?Q?Y?v?", "StartPoint", "Deleting INI section: %s in %s", "ETList.ParrayofT", "181D1^1g1", "949@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "6\"606C6a6o6", "7:7[7", "ClearspecialProcImports", "ControlIndex", "TCustomStyleEngine", "rkRight", "=$=4=<=D=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "AppPublisherURL", "?8?]?~?", "FActiveControl", "808<8@8D8H8P8X8\\8`8d8h8l8p8t8x8|8", "AddCredential", "tbPushButtonPressed", "9_9c9g9k9o9s9w9{9", "function RegValueExists(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;", ";#;:;H;P;^;n;v;", "ktfHeaderSectionTextUnderDrag", "Menu index out of range", "ttbThumbTicsVert", ":-:?:", ":%:,:<:D:L:T:X:\\:`:d:h:l:p:t:x:|:", "324m485H5L5P5X5`5d5h5l5p5t5x5|5", "3 3(3E3O3W3e3s3", ".NET Framework version %s not found", ">4?8?_?i?m?", "ATree", ";BP~(", "%TEnumerator", "FStackSize", ":(:;:P:^:p:", "K(_^]3", "ProcPos", "ItemRect", "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", "PResource", "tdbDateTextSelected", "FButtonPressedBackgroundColor", "Progress", ">4>E>]>k>z>", "StaticTextHot", "snReleaseAllStyleHooks", "434[4_4", "TFavoriteLinkItemsEnumeratort", "#CenterInsideControlInsideClientArea", "FMsgLabel", "ecUpperCase", "/TEnumerator", "ibm865", "ImageList_BeginDrag", "v4.7.2", "AlgSignature", "tdnbDeleteDisabled", "?4?8?", "/\\ tM", "AExtra", "GetMonitorInfoA", ";P;{;", "ByteBool", "function IsWildcard(const Pattern: String): Boolean;", "TWndMethod", "IStringsAdapter`'@", "TRichEditStyleHook", "FPreparingErrorBitmapImageh", "677I7R7l7", "Uh-qT", "Extracting archive %s to %s. Full paths? %s", "sfTabTextInactiveDisabled", "tipOpen", "BTAcceptValueListBase.TAcceptFunc`'@", "4H5L5P5T5l5x5|5", "tdnbEditNormal", "=3=M=g=", "FMultiSelect", "ttbTaskBarDontCare", "tmpbStopPressed", "VUInt32", "AButton", "9!999Q9i9", "function InitializeBitmapImageFromStockIcon(const BitmapImage: TBitmapImage; const Siid: Integer; const BkColor: TColor; const AscendingTrySizes: TArrayOfInteger): Boolean;", "7^7i7v7", "*TObjectList", "6 70787@7H7L7P7T7X7\\7`7d7h7l7p7t7|7", "ButtonTextNormal", "=6>b>q>", "THTTPDataReceiverm", "$IEqualityComparer`'@", "AUserStartup", "WNetEnumResourceW", "msi.dll", "npbsError", "MovEBP_ESP_2_E5", "ButtonHoverBackgroundColorpHA", "TCustomStackPanelH", "ContentType", "9 979;9?9Z9b9z9~9", "7$767D7Q7_7q7", "UhJ4t", "VerticalPositioning", "4R4r4", "Winapi.MsCTF", "Operation Cancelled\"'%s' is not a valid %s color value", "<.<]<", "psClear", "dsDragEnter", "0TList.arrayofT", "LContentStream", ":K;^;", "RttiDataSize", "Registration successful.", "6,6@6\\6d6v6", ":\":):0:::>:B:[:", "Unregistration failed:", "get_accParent", "FSaveStream", "FVisible", "3S3h3x3", "categorybuttons", "Default theme", "function GetComputerNameString: String;", "Button%d", "TMenuAutoFlag", "3 4;4L4l4}4", "858D8[8", "BiDiModel>N>", "717B7[7l7", ";%;-;;;J;X;k;", "User privileges: Administrative", "TLocalTimeZone@", "FReturnAddressType", "FChunkStartOffset", "0K1u1", ";\";0;D;W;f;x;", "5,5F5X5f5", "ktfCaptionTextNormal", "< <+<4.TEmptyFunc`'@", "BrowseButton", "4$4]4l4t4", "FPreparingNoRadio", ">0><>@>D>H>P>X>\\>`>d>h>l>p>t>x>|>", "vaBinary", "UhC'd", "THeaderValueList.TFlag", ":68>X>x>", "RichEdit50A", "ACancel", "UhR@C", "BevelOuterXmG", "MousePos", ">TObjectDictionaryM", "2'3+3N3R3", "aCapacity", "4(4:4R4`4o4", "AElType", "AllLevels", "TSeScrollButtonInfo", "465E5", "tcbControlBarRoot", "SelectProgramGroupPage,5_", "=;>O>^>t>", "7G8b8x8", "Uh2fr", "property ", "kedsNormal", "thHeaderDropDownSoftHot", "ImageList_Destroy", "TSePanelButtonInfo", "9*9;9R9", "9.9<9O9d9r9", "<.<=.TValueCollection\\LI", "2(2K2O2h2x2", "nFileSizeLow", "Notification", "SweepAngle", "b?j?w?|?", "Clear", "D$(+D$ ", "Maximum output length (%d) reached, ignoring remainder.", "FUser", "Blink", "+TDictionary", "tkRecord", "ShowCaret", ":TDirect2DCanvas.:6", ",8{hhh", "dyAY7", "8*8<8O8W8e8s8", "FCreatingMainForm", "tmpbBackDisabled", "3%4X4", "FClientWidth", "]TEnumerator>", "PtrAttrData", ">#>C>T>t>", "RmEndSession", "ERROR: ", "f;p u", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$5$Intf`'@", "aByteSize", "5-555D5w5{5", "102{2", ".TValueEnumerator", "k`+l$,", "IntersectClipRect", "", "bsFrame", "ItemCaption", "clLavender", "QK#=u", "mTDictionary.TPairEnumerator`", "ToUniversalTime", "FExplicitTop", "ccCdecl", "TSiteList", "Uhhzk", ":TFormatSettings.:3", "FInvokingThread", "procedure ", "TRttiIntfMethParameter6", "2B3T3", "Is not an archive", "Uh Po", "AVisible", "TCustomListControl", "5(5,50585@5D5H5L5P5T5X5\\5`5d5h5l5p5t5", "tsGripperPane", "TASMInline$", "NTDictionary.TValueEnumerator;", "<3<]1L1^1u1", "]TDictionary&", "FTempFileName", "KeysP4X", "7\"7*787T7b7w7", "yq&_e", "sphpRight", "csunicode", "ExceptionObject", "3 3(30383@3H3P3X3`3h3p3x3", ";*;I;t;", "tooltips_class32", "40484F4U4k4", "TPSTypeRec_Array(", "TTaskDialogButtonList", "'TList.ParrayofT`{F", "5\"5;5Q5b5|5", "OnDebugIntermediate0", "DisableFsRedir", "FLastActiveCustomForm", "charCount", "414W4w4", "tkVariant", "1D2H2L2P2T2b2p2~2", "IEnumerable", "thHeaderItemRightPressed", "=@=R=t=", "tbCheckBoxMixedHot", "sfEditBoxTextFocused", "6$636I6[6c6q6", "gTDictionary>.TKeyEnumerator;", "<(<,<3.TValueCollection;", "9c:{:", "ENetURIException", "QxGNu", "BarDockGetClientRect", "ImageDC", "ReadPtr", ":\":&:*:.:2:6:::>:B:F:J:N:R:V:Z:^:b:", "QTZ^[", "4G4c4z4", "tspUserPane", "IWICBitmaph", "101L1h1", "7,797J7X7g7}7", "TMultiWaitEventImpl&", "GetIndexedProperties", "OnClick\\oG", "060@0d0t0|0", "8#838H8^8m8y8", "EExternalException", ";1;];e;", "ftLastWriteTime", "FrameNoBorderCaption", "PTDictionary.TValueEnumerator;", "HintGradientBase", "465X5", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$3$Intf`'@", "khssMiddle", ">#>+>9>K>b>p>", "3H3c3l3", "Widths", ";#;];r;", ",TEnumerator(", "F D_\\", "566B6e6", "=+=3===D=I=S=e=", "Uh`]n", "AngleArc", "ControlsFlipped", "GetSystemTimes", "bsDropDown", "tpHigher", "LinePosL", "KTDictionary.TValueCollection;", "kwbMax", "FAsClass", "<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "DataObject", "4V9f9x9", "MajorVersion", "TArray", "3\"373O3W3_3g3o3w3", "ADescriptionResID", "282H2L2P2T2X2`2d2h2l2p2t2x2|2", "=%>C>a>r>", "function GetWizardForm: TWizardForm;", "/TArray", "0TCollectionNotifyEvent", "0:0a0", "TNewDiskForm", "2,2>2e2r2", ".rdata", "tbCommandLinkDefaultedAnimating", ";ScriptFuncLibraryRegister_R.RegisterOtherScriptFuncs$3$Intf`'@", "XTDictionary.TPairEnumerator;", "tcbOk", "HACCEL", "FArchives", "AProc", "FBitmapOnRight", "2g3|3", "ResourceType", "03070N0V0Z0", "ListenerMethod", "fdoHideMRUPlaces", "KTDictionary.TKeyCollection;", "UnregisterGraphicClass", "UpdateAction", "DrawFocusRect", "VWord", "9)9C9V9h9v9", "LockSemaphore", "5S6_6d6p6u6", "Registering file as a font (\"%s\")", "AColorName", "IsScaled", "RegisterAttributeType", "<.<6:R:Z:k:y:", ": :$:(:,:0:4:8:<:@:D:L:X:\\:d:h:p:t:x:|:", "%TArray", ">.>E>]>s>", "FSubCaptionLabel", "Weight", "UhH~g", "ADefaultEncoding", "FillRoundedRectangle", "iso_8859-15:1998", "7}SEk", "?(?:?Q?_?r?", "2*2H2Y2q2", "Anchor", "Comparerd'P", ";);1;?;V;d;u;", "FColumnIndex", "4TList.TEmptyFunc`'@", "KbdLayerDescriptor", "5TCollectionNotifyEvent", ")1h:$", "; ;$;(;,;0;4;8;<;@;D;Q;b;w;", ":):8:J:]:e:s:", "TControlEnumeratorI", "TThreadPool.TQueueWorkerThread", "3 3/3B3T3^3f3t3", "9I9x9", "IOleInPlaceFrame", "1^2d2", "=#=+=3=;=C=K=S=[=c=k=s={=", "597S7[7t7", "CloseApplicationsFilterExcludes", "<\"<4", "FInitializeCOMFlags", ";0DGG", "SortedXFA", "InputQuery[2]$ActRec", "iso_8859-14", "MTEnumerable>P", "FPageNameLabelx", "3h$ig", "CheckMenuItem", "IDATK_cS|", "<7.TKeyEnumerator;", "GetCPInfoExW", "TPenMode", "BrowseFunc", "#L$4+L$,", ":\":J:", "Q|FOu", "HintColor", "667U7\\7", "tebIEBarMenuNormal", "TCheckBox", "TElementEdgeFlags", "MouseInControl", "DrawThemeParentBackground", "---------------------------", "ecGradientColor2", "7B7g7", "4\"464I4W4k4s4", "biBitCount", "3(3,3A3f3j3n3", "TListD", "5$575M5a5t5", ")TList.TEnumerator5", "Credentials", "{_\\EQ", "TBrushStyle", "/NOTIFYWND=", "1IComparer`'@", "AutoLineReduction", "TSeStyleFonts", "NameIndex", "AWindow", "TASKDIALOG_BUTTON", "ATrackMenu", "SafeArrayGetUBound", "0(0V0p0", "FSelectDirLabel@", "OpenThemeDataForDpi", "6:6Q6", "FStepOverProc", "TMonitorDpiChangedEvent", "6I6^6o6", ";T", "=$>4><>D>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "ENonPublicType", "ftLastAccessTime", "!TScrollingStyleHook.TScrollWindow6", "FDefListBoxProc", "QTArray>", "hMetaPict", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$21$Intf`'@", ">ScriptFuncLibraryRegister_R.RegisterMessagesScriptFuncs$0$Intf`'@", "FSelectDirPage", "ContextID", "Uh$9t", "Visibility", "GetNames", ":E,uk", "1%181H1Y1g1{1", "2/2C2{2", "9,9@9H9Y9g9o9}9", "323>3H3f3x3", "TDragDockObjectD/Q", "FUserStartup", "LicenseAcceptedRadioClick", "383T3p3", "1D1p1", "Skipping due to \"onlyifdestfileexists\" flag.", "Remove", "SetControlVerticalPositioning", "3-353C3V3p3", "CSetup.UninstallLog", "TUnicodeEncoding&", "FFont", "GetItems", "FZoneLimit", "ButtonTextHot", "ktscToolMenu", ":c;z;", "8!8B8I8u8|8", "AllocBypHA", "6W7|7", "MaxDestBytes", "405@5J5Y5", "ktfHeaderSectionTextDraggedOut", "TWIZARDFORM", "clGoldenrod", "WriteData", "FBufferSize", "424R4", "1,1A1E1Z1", "MSH_WHEELSUPPORT_MSG", "ShowSearch", "AlgEncryption", "6.6Q6Y6v6~6", "= =7=Q=Y=a=i=q=y=", "%s Decoder%s : Igor Pavlov", "5+555X5h5p5x5", "?0???F?t?", "?$?:?K?_?p?", "5/595=5\\5l5p5t5|5", "8!8%8)8-8185898=8A8E8I8", "RegisterExtraCloseApplicationsResources", "AColor", "teEditTextNormal", "uPSR_extctrls", "<8 >$>2>@>V>i>x>", "StgCreateDocfileOnILockBytes", "Uhrmc", "FRadioItem", "tebHeaderPinSelectedPressed", "InitializeSecurityDescriptor", "FPosition", "btnInsert", "tspLogOffButtonsHot", "ci'e}_", "FHost", "TFileRedir", "9l$$t*", "// NOP", "xC@:[", ";3;;;\\;d;", "GETCMDTAIL", "5(6?6g6r6", "TOleStrList", "ssTouch", "SplitButton", "FixupForREST", "Color8", "AListenerMethod", "UhlMr", "0 1'1", "HandleRedirects", "tkProcedure", "6,6A6[6s6", "D$HPj", "2.2>2M2c2r2~2", "9$929A9T9~9", "tpTransparentBarPartial", "060X0i0q0", "FIsDPIRelated", "FOnMouseEnter", ";$;x;|;", "twMinButtonNormal", "7(8E8", "ttdFootnoteSeparator", "ButtonSizepHA", "ktxsNoPrefix", ";\";1;7;I;R;n;};", "787A7W7j7", "KeyID", "=.===M=a=u=}=", "= ='=:=N=c={=", "kpscSingleProgressBar", "username", "bcNone", "UseSetupMessagesForErrors", "set_PopupParent", "%TMethodImplementation.PInterceptFramex", "WordWrapXZQ", "Title\\oG", "-TObjectList&", ">;???C?G?K?O?", "FOrigin", "Magellan MSWHEEL", "`.itext", "klscHighlight", "566x6", "HPALETTE", "#TEnumeratorPWK", ":*:=:L:^:q:y:", "0 0-0D0Y0a0", "5,5B5F5Z5b5f5z5~5", "tttWrenchHot", "3:4D4I4N4r4", "+WX+WP", "tbPushButtonDefaulted", "twSmallFrameRightActive", "2X3/43474;4?4C4G4K4O4S4W4[4_4c4g4", "6(696G6^6l6", "explorerbar", "TArchiveExtractBaseCallback]", "CheckingMasked", "7(8i8", "AddDisabledImages", "TEnumerable", "ecma-114", "ExecuteTarget", "9+:s;z;", "7/7H7Y7f7", "APublicKey", "ibm437", "6#626F6Y6a6o6", "kcscCheckBox", "KeyNames", "%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u", "0TList.ParrayofT", "FOnDblClick", "5\"545D5T5X5\\5d5l5p5t5x5|5", "FindButton", "FThreadsUpToDate", "2 2*222C2Q2Y2j2{2", "tiInteger", "tlListItemNormal", "kticComboDropDown", "=-=8=G=P=l=", ";!;);1;9;A;I;Q;Y;a;i;q;y;", "~{Ska", "Compression.SevenZipDLLDecoder", "TNewCheckListBox6", "PRTLCriticalSection.TEnumerator5", "253\\3", "TButtonControl6", "asmo-708", "CanClose", "OnHide", "TSetupUninstallLog", "ReadBoolean", "SCROLLBAR", "windows-1254", "TUIStateForm((_", "OwnsStream", "(TCredentialsStorage.TCredentialAuthEvent", "claSlategrey", "<+<0<5.ParrayofTx", "FSelectTasksLabelL", "8Z8V9", "Type: ShellExec", "FRemoveCount", "FDataPtr", "?#?1?A?R?g?", "MinHeight", "TRegDataInfo", "344;4", "VarDateFromStr", "Uh}?G", "ktcFocusEffect", "242I2Q2", "IsToolDefined", "=)=D=^=o=", "TSeSplitterInfo", "QuietUninstallString", "454C4R4b4t4", "555_5j5v5", "~QT?)l", "2$334?4V4B5T5", "FLazyWrite", "Running ShellExec parameters: ", "ktcPanelDisabled", "3-3?3N3V3d3w3", "ktcGenericGradientBase", "clLightpink", "GetClassLongW", "-J*9F", "EReadError", "UhIwN", "HTDictionary.TKeyEnumerator;", ":':/:[:s:", "InitDecryption", "ZE6?D", "<2 >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>p>", "<@<]d?t?", "9-959S9[9x9", "PTypeDataD", "7n048", "(TArray", "AutoCloseUp", "CreateFmt", "=(=6=N=\\=o=", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$16$Intf`'@", "FOverridePaintNC", "NormalizeRect", "BaseType ", "put_accValue", "9*9?9Q9e9m9u9}9", " EMFt", "TVmtFieldEntry", "SetWindowRgn", "PanelTextDisabled", "skAnsiString", "TWindowDisabler&", ": :$:(:4:<:D:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "Compressed block is corrupted", "HelpButtonRect", "TScriptRunnerOnLogFmt", "9,9C9o9", ":!:):~:", "GetMonitor", "=RSA1u2", "TPngImage", "GetCustomSetupExitCode raised an exception.", ">(>:>Z>h>}>", "TRttiProperty", "BeginDelete", "TNewNotebookPage6", "UhK?d", "useproc", "tpSysRight", "5:5>6E6V6c6i6q6}6", "~v8E]A=48R", "8K8X8g8z8~8", "TProc`'@", "FButtonHoverBackgroundColor", "ImplGetter", "ftComp", "(orphan package)", "TNewStaticText6", "Extension", "clFastest", "TObjectCache6", "WinHttpGetIEProxyConfigForCurrentUser", "TCustomEdit6", "GetUInt", "SysStyleHookClass", "Uh]sT", "DockClients", "WndParent", "ADVAPI32.dll", "304\\4}4", "Compression.LZMADecompressor", "non administrative", ":*;M;", "NoIcons", "npbsNormal", "BeginDrag", "Cannot call TOutputMarqueeProgressWizardPage.SetProgress", "> >(>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "Read64", "FMaxRedirects", "AListener", ";BL~8", "FSliderSize", "SelectDirBrowseLabel$", "1Y2n2w2", "klidsNormal", "CenterPoint", "DispatchMessageA", "bsRightLine", "bsCross", "KeepSizeY", "StartOffset", "TSeStyleFilter;", "LockDrawing", "OkButton", "lTaskbarProgressFunc", "42464R4u4}4", "DisabledImages", "teProgress", "SENDNOTIFYMESSAGE", "5%6A6", "TLightweightEvent&", "claDarkgoldenrod", "ProcessIdToSessionId", "6$696S6k6", "AAncestor", "FClass", "3,3;3C3Q3c3q3y3", "TWriterProc", "?b?q?", "default", "OnMeasureItem\\oG", "7)787F7]7k7z7", ">;>?>f>p>", "message", "8&848F8`8", "3/5=5P5", "Uh0)o", "tgClassicCellNormal", "NameAndVersion", "TPSRuntimeClassImporter", "0$040<0D0L0P0T0X0\\0`0d0h0l0p0t0x0|0", ",TEnumerator8", "ForceDelayLoad", ":6:K:Y:h:z:", "Topx=Q", "sfComboBoxItemNormal", "function UTF8Encode(const S: String): AnsiString;", "7*787@7N7\\7p7x7", "AString", "TSeWindowButtonClass", "323s3", "TCard6", "MaxWidth", "alloc_func", ";m;r;", "Track", ":N:f:o:", "BufSize", "HTDictionary.TPairEnumerator;", ">7>_>c>", "94:r:", "<%<7>(", "ssPressed", "cpMin", "ksbdsNormal", "TUninstallProgressForm", "twFrameLeftInactive", "TPoint", "TContextPopupEvent", "efDiagonalEndBottomLeft", "TPSExec", "wifPng", "ttsTextStyleDontCare", "767A7H7X7`7h7p7t7x7|7", "Right", "2=2J2W2w2", "152b2", "TMBCSEncoding", "RegisterWindowMessageW", ">*?@?u?", "606?6G6X6m6{6", "(TEnumerable'", "TSeTrackBarDrawState", "Winapi.MultiMon", ">&>4>K>`>n>}>", "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;", "UhOIo", "NeedsDefaultPaint", "twMinCaptionActive", "Uh3+L", "<$<,<0<4<8<<<@&", "cl3DLight", "scGenericBackground", "sfTextLabelFocused", "P+t$4", "euckr", "ABFHu", "?+?3?A?O?c?{?", "teEditTextReadOnly", ">#>7>?>M>`>t>", "FormStyle", "0 0$0(0,0", "kwscMessage", "646@6V6^6", "FAnchorRules", "@PPj`", ";(.arrayofT", "function FileSearch(const Name, DirList: String): String;", "< Q?s?", "FOnGetMainFormHandle", "FOnFindMethod", "Index", "6*6 7", "9=9L9s9", "MulDiv", "tcbButtonNormal", "dkInterface", "111)272", "Failed to delete directory (%d).", "Registration executable created: %s", "4#414D4Z4k4", "2.2@2H2V2e2{2", ". Path:", "7%7*767?7E7J7V7_7e7j7v7", "999I9`9p9t9x9", "FColumns", "SendDataCallBack", "ExceptObject", "Heightt", "uTimeout", "fdoNoTestFileCreate", "PanelGetClientRect", "tbPushButtonDisabled", "PVarArrayP-@", "TSeBarItemClass", "TMouseTrackControlStyleHook", "ufWizardModern", "FOnLog", "invalid block type", "ktigTray", "IHelpManager`'@", "Unexpected ISSigVerifySignature result", "TStoredDecompressorM", "Ph`kP", "ttTreeviewDontCare", "MouseDown", "WriteVariant", "_R_DV=", "FImeMode", "WorkAreaWidth", ":\":3:G:X:g:o:", "/DETACHEDMSG", "Chars", "CreateIconIndirect", "212[2", "FTransparentMode", "IsObjectInstance", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$16$Intf`'@", "FThreadSuspended", "WriteFile", "2!252H2h2v2", "8-:`:", "8)8V8", "Polyline", "IsAnimating", "TCanvasOrientation", "ComponentClass", "RlZ^[", "FByteSize", "MonitorCount", "EPropWriteOnlyt", "6!6.6F6M6d6l6r6{6", "Uhlcg", "EArgumentOutOfRangeException", " TArray", "UninstallLogMode", "TEnumeratort", "4$4q4u4", "FAsDouble", "5E6U6", "SmCaptionTextInactive", "clPalegoldenrod", "9+:m:Q;", "6&6;6R6j6r6z6", "AlignWithMargins", "FMinButtonRect", "TBase64StringEncodingP", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7r7z7", ":%:):H:Y:`:p:x:", "AppendDir", "AUnregister", "TArrayTypeData", "EncryptionBaseNonce", "TBZStreamRec0", "EPNGUnknownCriticalChunkPO^", "4!4/4B4R4a4r4", ";<;`;p;x;", "pvarState", "Kind8", "868K8\\8r8", "Boundary", "FSendTimeout", "SetValueFromIndex", ":;:p:", ";&;6;G;X;`;q;", "Basic ", "687<7c7m7q7", "UtcOffsetU", "BodyLabel", "h>", "IsImplementorOf", "DefaultRoundedCorners", "tcpChevronOpenedNormal", "OpenProcessToken", "UhgEr", "toIsCustom", "ImageWidth", "AppReadmeFile", " ", "0 0(000`0v0", "AYear", ":(:?:C:_:f:m:t:{:", "clIvory", "=$=@=\\=x=", "?'?-?3?8?H?\\?j?u?", "FClassList", "6/6d6|6", "$TCustomCheckBox.ObserverAdded$ActRec", "TextFlags", "TimePMString", "4&444H4V4d4", "2#212@2R2l2z2", "EXTRACTRELATIVEPATH", ">6>f>}>", "9$979T9b9u9", "FOnHyperlinkClicked", "ktidsDisabled", "2(2=2S2c2", "8#818D8T8e8s8", "=V>c>w>", "GetLevel", "CallStackCount", "9IComparer`'@", "TLabel|", "3>3B3F3J3N3R3V3Z3^3b3f3j3n3", "FOnDataFind", "PListP", "TSeMenuSubclass", "KTDictionary.TValueCollection;", "2$2V2f2", "=$=(=L=j=", "NewNotebook", "hpAutoFromTop", "TSysToolbarButtonState", "Month", ">ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$9$Intf`'@", "IPropertyStore::SetValue(PKEY_AppUserModel_ToastActivatorCLSID)", "TDirect2DPen5", "IsImageNameAvailable", "858^8", "UhbGl", "0&0;0d0v0", "=&>a>m>", "ProcAttrData", "NiceTime", "90:@:H:P:X:\\:`:d:h:l:p:t:x:|:", "3#3<3J3X3n3", "IgnorePaletteTLA", "HasSubMenu", "9,9=9I9o9", ":5:F:\\:j:|:", "tbCommandLinkGlyphPressed", "7X8/9:9", "TNewProgressBarStyleHookL{b", "PSStackHelper", "Winapi.PsAPI", "ElementMargin", "Truncate", "FKeyCollection", "TFindGraphicClassSource", "MouseMove", "4Compression.SevenZipDLLDecoder.Interfaces", "SmCaptionTextNormal", " processorArchitecture=\"x86\"", "=\\>q>", "Monitors", "Status", ">$><>D>`>h>l>", ";/;3;=;E;M;", "3 4j4s4", "4*5S5", "FindResourceW", ">6?M?", "FTCollectionNotifyEvent", "? ?$?(?,?0?4?8?(", "u|h]6\\", "\"TUxThemeCategoryPanelGroupElements", "ImagestFA", "FPanPoint", "function RemoveBackslashUnlessRoot(const S: String): String;", "Other", "`TEnumerator>dDX", "Caption", "Start", "2$3B3_3y3", "fTArray>", "DrawThemeBackground", "DownloadFile: Invalid Url value", ",TList.TEnumerator5", "Winapi.Winsock2", "616@6H6X6", "EnableNonClientDpiScaling", "taBottomLeft", "Uh!Qq", "FGrayscaleFactor", "< <$<(<,<0<4<8<<<@.TItemArray", "UhXsJ", "claGreenyellow", "COMBOBOX", "PngImage", "1TEnumerator", "MakeGlobalReference", "FormatMessageW", "Inno Setup: Deselected Tasks", ">TDictionary.TItemArray", "ShowException", "TMessageListener", "LOADDLL", "?'?>?J?d?p?", "CreateHalftonePalette", "%TEnumerator(", ":$:[:", "ListView", "dotnet4032", "ParentBiDiMode", "AAsyncResult", "PRQh<", "5/5D5R5f5|5", "ToolDraw", "Aborted", "mtidsDisabled", "uninstalltool_setup.exe ", "efDiagonalEndTopLeft", "GetCard", "1TEnumerator(", "UhASi", "APanel", "claViolet", "cp1254", "NoToAllButton", "Vcl.Mask", "3\"3&3*3.3A3V3d3x3", "LoadFromResourceName", "Position", "=6>e>", "G1R1Y1c1t1", "Suspended", "tspStartPanelRoot", "TrimExcess", "2D2n2r2v2", "748D8H8L8T8\\8`8d8h8l8p8t8x8|8", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$3$Intf`'@", "8&8A8W8h8~8", ":P:^:|;", "9!979S9r9", "525Y5b5", "=0>E>S>k>", "CaptureError", "TArchiveExtractBaseCallback", "?&?7?E?Y?v?", "FAllowCookies", "; List of files to be registered on the next reboot. DO NOT EDIT!", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4v4", "EPNGInvalidBitDepthXU^", "ScrollPos", "teEditBorderHVScrollDisabled", "6?6d6", "TPropFixup", "PCERT_CONTEXTX", ": :(:8:G:[:l:t:", "Shared.Struct", "ENetURIRequestException", "FImageName", "Glyph", "5'5/575?5G5O5W5_5g5o5w5", "FKeepSizeX", "IsText", "twMaxCaptionActive", "FQueueLock", "offset", "7 7$7(7,7074787<7@7D7H7L7T7X7\\7`7d7h7l7p7t7x7|7", "GetTempPathW", "Property %s does not exist", "THTTPSecureFailureReasons", "===j=", "0*191w1", "0\"0?0t0", "ACertificateList", "Z0_^[", "ttTopTabItemRightEdgeHot", "8IComparer>`'@", "9TDictionary.TItem", "SETINIINT", ";0;8;T;_;h;|;", "fInterlaceMethod", "EPNGUnknownCriticalChunk", "kpdsDisabled", "717V7", "sfEditBoxTextDisabled", "646I6W6i6", "7\"7*727:7Q7f7n7|7", "RadioButton%d", ">E>j>y>", "MaxRedirects", "Ph a_", "Minimize", "abcddddddddde", "+TEnumerator(", ">&>0>:>D>N>X>b>l>v>|>", "5\"5:5H5W5k5|5", ";D;S;\\;l;p;t;|;", "TScalingFlags", "rdExpandString", "D$0PW", "2(262=2D2I2]2e2l2w2", ">L?^?y?", ">TList.TEmptyFunc`'@", "TCompleteEventsWrapperd", "cnExtracting", "vFa6S", "3\"3B3", "Sizeable", "Uhd]p", "GetOverlappedResult", "7V7c7~7", "384?4Y4]4a4e4i4m4q4", ";%;k;z;", "DeleteParameter", "cp1255", "SetStandardGestures", "ParentShowHintL", "StyleName\\oG", "9TEnumeratorp", "TSysScrollBarStyleHook$", "erOutOfMemory", "7:7_7", "1T}O:", "ActionCount", "Quality", "FParentSubItemPainted", "ktfGridItemFixedPressed", "XZZbee", "9,9A9[9s9", "?(?>?T?b?r?", "twCloseButtonHot", "UhKoJ", "EnableAutoRange", "uPSRuntime", ":#:4:<:J:Z:u:", "FIndicies3", "QSVWj", "ttTopTabItemNormal", "IsBottomTop", "TRadioButton6", "LineTo", "Software\\Borland\\Locales", "rdInteger", "GetTimeZoneInformationForYear", "060115191=1A1E1I1M1Q1U1Y1%3)3-3135393=3A3E3", "~!dr9T", "<_", "skFMXEdit", "080u0", "ecLowerCase", "TBevelWidth", "sfComboBoxItemSelected", "SurfaceHeight", "Uh+bc", "DisableNCArea", "5g6u6", "Servicing", "rdBinary", "0*080N0c0q0", "TFNDrawText", "FSelectComponentsLabelH", "FAutoComplete", "tmPopupBulletNormal", "tcDropDownButtonRightHot", ":Q:V:l:{:", "FLastMouseMoveIndex", "999J9\\9d9r9", "ScreenToClient", "TRelocType", "Item TList", "CleanupInstance", "Tasks", "wizardhwnd", "3$4)454:4F4K4W4\\4h4m4y4~4", "Operation", "$TEnumerator(", "TSeStyleFont", "7)7F7]7}7", "UseRightToLeftAlignment", "<\\=j=x=", "GetThemeBool", "?^?|?", "twRestoreButtonPushed", "Y&&&XXX", "mtidsChecked", "StringSplit", "SystemParametersInfoForDpi", "0,0J0]0e0v0", "MenuFlag", "ktcButtonPressed", "?+???U?j?x?", "FAnchorOrigin", "TArray", "mtidsPressed", "Uh%qJ", "{43826D1E-E718-42EE-BC55-A1E261C37BFE}", "http://direct:80", "Owner", "HasExtendedInfo", "+0?0G0", "ScrollInView", "6%757", "F0O0A1", "3g4~4", "clDarkolivegreen", "controlbar", "(TArray", "TActionEvent", "'TList.arrayofT", "TMenuUpdaterL", "function ExecAndLogOutput(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer; const OnLog: TOnLog): Boolean;", "SendTimeout", "ControlStateX:Q", "<\"$>(>0>4><>@>H>L>T>X>`>d>l>p>x>|>", "+A'CCtuw;rjq", "OnBalloonClick\\oG", "clLightcyan", "1(1=1E1", "TaskbarCreated", "FDecoderState", "*IComparer`'@", "=,=@=\\=u=|=", "ComponentStyle", "OnMouseDown8[Q", "ImageAlignment", "rdLink", "ktfStaticTextFocused", "81989y9", "Application Error1Format '%s' invalid or incompatible with argument", ">'>/>7>I>_>p>z>", "commonpf32", "<6={=", "LinkType", "H/(@Bp 6", "9$9,9094989<9@9D9H9L9P9T9X9e9w9", "Ix;JDu", "ECustomStyleException", ">$>8>@>P>T>X>`>h>l>p>t>x>|>", "(:TFormStyleHook.TMainMenuBarStyleHook.:1", "161C1P1b1", "Invalid Opcode", "3T4i4w4", "TLibModule", "=/=@=\\=`=v=}=", "ETArray>", "fCompressionLevel", "HintHidePause", "HANGEUL_CHARSET", "FStrokeStyle", "UseCOMWait", "thHeaderDropDownFilterHot", "FFinishedLabel", "=!=3=I=Q=y=", "4!4/4>4N4`4z4", "Error querying headers: (%d) %s", "1%131?1P1[1f1u1", "7U8^8", "HKEY_USERS", "SetCharset", "TRttiFieldE", "Cannot evaluate variable because [Code] isn't running yet", "MemoDraw", "MouseInMainMenu", "5 5$515G5K5U5]5e5", "Compare", "2A2[2q2", "536D6,;C;", "StringOfChar", "6C6R6Z6l6", "Handle", "&TComparison`'@", "?.?D?Y?n?", "FLength", "5-6L6k6", "BCryptSignHash", "Unassigned", "GetArg", "C0;C,s", ": :6:>:Y:a:y:", "FCancel", "%F];PQ", "RegCurr", "TTaskDialogButtonItemX", "startpanel", "AnsiUpperCase", "FFlipControlsOnShow", "FButtonPressedForegroundColor", "]TEnumerator>(", ":$:E:x:", "ySldQ", "K;.NC", "tmbMenuBandDontCare", "FClassName", "MessageBoxA", "kedsSelection", "FBorderTileStyle", "+TList.TEnumerator", "ExpandButtonCaption", ":E:M:l:p:", "ktcComboBox", "1-1:1D1U1e1", "666D6T6f6", "FHintShortPause", "FBitSize", "=!>6>G>\\>j>", "ttTopTabItemBothEdgeSelected", ": :$:(:,:0:>:P:j:", "claMintcream", "Layout File", "1$2P2q2", "saInvalid", "Deletion skipped (not empty).", "PageIndex", "FAuthorEMail", "clMediumslateblue", "FFontHeightFor96DPI", "Comparerl", "kwdsActive", "0#0>0P0(1B1t1", "GetTheme", "Exception while setting permissions:", "JTDictionary.TPairEnumerator;", "skForm", "2TList.TEnumerator", "FListPos", "2$2+2E2q2", "5TList.TEmptyFunc`'@", "function GetOpenFileName(const Prompt: String; var FileName: String; const InitialDirectory, Filter, DefaultExtension: String): Boolean;", "G _^[", "ObjectName", ")TList.arrayofT", "TClassItem", "gr+Cw", "4TEnumerable", "UserTime", "6 6$6(6,6064686E6\\6q6y6", "GetLoginCredentialEvent", "%yf|!O", "DialogHandle", "FFontHeight", "TThemedGrid", "ktfComboBoxItemFocused", "&'jwRj", "6,6H6U6e6v6", "TEnumerable'", "TEnumerator(", "tebIEBarMenuPressed", "FReachedEnd", " !\"#$", "=*=2=F=J=N=R=e=z=", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$10$Intf`'@", "4,4`4h4", "twMDIMinButtonHot", ":*:@:V:g:y:", "Uhvml", "4?@?M?s?", "ImageData", "RegisterPropertyHelperName", "YesButton", "FPitch", "Topic", "HTTP/1.0", "=1>`>", " TSysPopupStyleHook.TSysPopupItemV", "ttpFlashButtonGroupMenu", ">'>/>7>?>G>O>W>_>g>o>w>", ">*>B>J>R>Z>d>j>r>|>", "procedure WizardSelectComponents(const Components: String);", "FBitmapDisabled", "ttbThumbTopDisabled", "9-9;9I9Q9_9w9", "5K5`5q5", "pullVal", ";7;E;T;k;", "< <}<", "FREEDLL", "TRttiOrdinalType", "9):1:9:A:N:d:u:", "TUTF7EncodingD>B", "MainPanel", "5#5'5+5/535", "UnregisterModuleClasses", "RichEdit30W", "AllocateHWnd", "EllipsisPosition", "<\"<1<7", "TPSTypeRec_Record", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$24$Intf`'@", "Replace", "4!50585H5~5", "Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs", "D$ ;D$0t/", "SystemT", "ParOff", "81:Z:", "0/03070;0?0C0G0K0", "GetTextLen", ">1?G?[?o?s?w?{?", "0\"090G0^0u0", "PPackageTypeInfo", "euc-cn", "FindObjectByKind", "252^2", "AHeight", "PUnicodeString", "223b3", "=ScriptFuncLibraryRegister_R.RegisterActiveXScriptFuncs$0$Intf`'@", "Abort", "StepInto", "TThemedTextLabel", "Uh}^g", "clInactiveCaption", "FDragMode", "Sl+Sp", "skRoundMask", "=X=j=x=", "UhX%K", "OnGesture", "GetTasks", ";BXu[", "EFOpenErrorPrG", "LogBuffer", "FSendTimeoutChanged", "TabLeft", "bmPlanes", "claDeepskyblue", "?$?N?k?}?", "#TEnumerable'", "7(969X9\\9l9", "ttsThumbDisabled", "9o9u9", ";0;A;Z;k;};", "6 7074787@7H7L7P7T7X7\\7`7d7h7l7p7t7", "x64os", "0'0G0P0", "tdbDateTextDisabled", "4F5M5l5y5", "7Z7f7", "CreateCopy", "ImageAlpha", "4q4z4", "Z_^[XX", "2 2/2Q203", "Resume", "kbscSpinMinus", "TZCompressionLevel", "InString", "cannot open input file", "2!3F3J3h3", "FRelativeSizes", ":^DtA", "020G0Y0k0", "TRegGroup6", "saValid", "9%9-959=9E9M9U9]9e9m9u9}9", "FillEllipse", "PrepareToInstall failed: %s", "CharNextW", "1$1(1,10181<1D1H1L1P1T1\\1`1d1h1l1p1t1x1|1", "/TEnumerable", "csPaintBlackOpaqueOnGlass", "get_accSelection", "4[4}4", "TPNGPointerList6", "tfFlyOutLabelDisabled", "UhlvS", "#TEnumerator(", "1;1`1n1", "Response!TFileDialogShareViolationResponse", "FImes", ">\">4>N>R>p>", "ktfRadioButtonTextDisabled", "FUserPrograms", "5*5:5H5`5h5v5", "FLastEditMousePos", "4<4H4L4P4T4\\4d4h4l4p4t4x4|4", "DELPHICLASS TRttiMethod; DELPHICLASS TRawVirtualClass", "B.rsrc", "AResponseContent", "PTDictionary.TValueCollection;", "AllowCookiesDCh", "%&'()*+,", "total_out_hi", "Z]_^[", ":\":>:S:a:z:", "lrDefaultSize", "CUSTOMMESSAGE", "Uh%{O", "Setup.UninstallLog", "TaskbarHandler", "tlListSortDetail", "TListP", "FOwnedStream", "Uhs#c", "ACredentials", "3(3,30383@3D3H3L3P3T3X3\\3`3d3h3l3y3", "Uh?tK", "TFavoriteLinkItem6", "MediaPlayer", "GetPaletteItem", "ttTabItemRightEdgeNormal", "3h8ig", "finalizer", "Ot1OtW", "mkClassProcedure", "FStartTimeStamp", "6m7t7", "+TCustomStyleEngine.TStyleEngineNotification", "~<<+\"", "SetupLdrAndSetup.InstFunc", "GetTabs", "+TList.TEnumerator", "Negotiate", "UpdateReadyMemo", ">!>)>1>9>A>I>Q>Y>", "=A>P>g>", "Uhu;F", "ftCurr", ".TEnumerator", "; ;$;(;,;0;=;U;];e;m;u;", "9+9E9S9b9y9", "5TSysListViewStyleHook.TSysHeaderStyleHook.TSysSection", "; ;$;(;,;0;4;8;<;@;N;`;s;", "FreeNotification", "tsLowerTrackVertDisabled", "YesToAll", "XTArray>", "2.3\\3o3", "0/1M1", "Cancelling", "OpenKeyReadOnly", "E PVW", "ToStringArray", "3K4O4S4W4e4s4", "FMBoxTextFocused", "0/0C0T0g0k0", "ifHasGuid", "VersionMinor", "clCornsilk", "7\\7l7p7t7|7", "8$868O8`8n8v8", "?$?2?:?H?Z?p?~?", "GetThemeSysColor", "Sh]_^[", "ShellExecuteEx returned hProcess=0", "PSetupTypeEntry", "5!5H5R5V5t5", "mailto", "FreeProc", "FOnSendData", "> >(>0>8>@>H>P>X>`>h>p>x>", "ttbDropDownButtonHot", "TabTextInactiveHot", "ttdContentIcon", "%TCollectionNotifyEvent", "FDesignOffset", ">4?|?", ":0N0X0]0", ".IComparer`'@", "*TDefaultLoginCredentials.LoginEvent$ActRec", "@sggg", "D$$;D$4t/", "0TList.TEmptyFunc`'@", "sfCheckBoxTextDisabled", ":,:F:N:V:^:f:n:v:", "SpacesAsPlus", "Operator", "FreeMem", "!TApplication.ShowException$ActRec", "ProcessMenuLoop", "8G9K9O9S9a9n9", " TSetupPrivilegesRequiredOverride", "$TEnumerator(", "=TWizardForm.PrepareToInstall.DownloadArchivesToExtract$ActRec", ">ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$ActRec", "Incrementing shared file count (32-bit).", "RequestedVarType", ":TListHelper.:4", "ktisLeftFirst", "929x9", "Comparer(", "TDockTree", "FCardList", "System.Win.ComObj", "GridItemSelected", "TReaderError", "POSTBROADCASTMESSAGE", ";@U>~>", "FUserInfoNameLabel", "4$4(4,4044484<4@4D4H4L4P4T4X4`4", ">'>7>I>X>`>n>", "$1@1(3B3", "808@8P8`8p8", "|q={{oM", ";4;@;D;H;L;T;\\;`;d;h;l;p;t;x;|;", "tsUpperTrackVertDisabled", ":,;A /E", "Uhl@d", "GTDictionary&", "=%=;=U=j=|=", ".TKeyCollection", ";(;?;P;f;y;", "CLSID_WICImagingFactory", "tsGripperVertHover", "SourceTimeStamp", "Authority", "saWarning", "4N5O7\\7k7", "tpLowest", "tmbNewAppButtonHot", "tsTile", "7/7J7e7", "1$2[2", "5(5E5S5i5", "000>0R0k0", "CloseGestureInfoHandle", "DefaultKbLayout", "clPalevioletred", "?021:1?1O1U1g1", "778i8", "6,6E6O6", "5%535K5S5a5q5", "VTArray>", "ACommand", "FObject", "UnregisterLoginHandler", "FOnSetName", "WriteStr", "SetSubItem", "kernel32.dll", "0/0=0O0e0t0", "0 0*0X0", "GetSubItem", "?\"?7?E?\\?r?", ";BXu_", "282@2N2Z2k2", "SET8087CW", "tdnbPostHot", "@? t/j", "FSpecialProcList", "<' >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>y>", "ecBodyTextColor", "DescResID", "FInfoAfterPage", "7#747M7Q7", "?(?>?B?`?p?x?", "UhScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$9$Intf`'@", "7#717?7S7d7q7y7", "FBevelKind", "TFormStyle", "GetThemeAppProperties", "<'<:", ":9:K:a:p:|:", "cmLZMA", "545B5R5d5l5z5", ":http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0{", "CustomUser", "RZY)C", "ConstraintsXHA", "fdoShareAware", "9 9$9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9", "WindowGetRegion", "saCalculated", "ktbcLeft", ">#>'>+>", "EFileErrorL", "Observers", "GetInstRes", "CHINESEBIG5_CHARSET", "NTDictionary.TValueEnumeratord", "TWICImageExA", "2!2/2A2W2h2{2", "3>3]3", "4\\5`5d5h5l5p5t5x5", "TCollectionEnumerator;", "WelcomeFontName", "CheckBox", ";D$`'@", "csibm864", "efTop", "Unexpected download flag", "PaletteModified", "809E9Z9l9~9", "q.te_", "FCancelButton", "TPSRuntimeAttributes1", "kspcGripperPanel", "tsThumbBtnHorzPressed", "1-1:1B1P1b1s1{1", "kticMin", "KTDictionary.TKeyEnumeratorp3u", "tsUpHorzHot", "snStyleHookUnregistered", "3\"343R3Z3b3j3r3z3", "MMHeight", "ascii", "=&=.=6=>=F=N=V=^=f=n=v=~=", "FFocusEffect", "TEnumerable>", "$TCustomCheckBox.ObserverAdded$0$Intf`'@", "TList&", "=/=A=X=_=u=", "TrackDrawThumb", "232O2k2", "FShowDelay", "Location", "ThumbHorzBottom", "ShowBalloonHint", "AInput", "5/595D5X5f5o5", "files:", "dwYCountChars", "m/d/yy", "Setup command line: ", "TFileStreamG", "ttDefaultCompact", "thHeaderOverflowHot", "@TObjectDictionaryM", "FFinishedHeadingLabelp", "?TDictionary.TItem", "FButtonsPainted", "?@?J?N?l?x?|?", "=.=C=[=n=v=", "TSeWindowGripperInfo", "TailHandleT", "grfMode", "=-=;=R=v=", "{app}", "FWidth", "7K8a8z8", "FoundIndex", "809@9D9H9P9X9\\9`9d9h9l9p9t9x9|9", "HBITMAP", "pcxWidth", "FInBufferNext", "ParametersAllowed", "TabTextActiveHot", "0-0?0Z0h0v0", "ListDraw", "4-555=5J5_5v5", "TMainForm", "TStackPanelOrientation", "tcBorderNormal", "DeselectedTasks", "ASourceFile", "SetFocusedControl", "FCurrentStreamPos", "9(939;9L9`9q9~9", "BTList.TEmptyFunc`'@", "C0O0V0`0r0", "MetaclassType", "0$020<0J0T0b0l0z0", "FDisplayNames", "EZDecompressionError", "csNeedsBorderPaint", "teShadow", "9X:h:", ".text", "FSelectStartMenuFolderLabelD", "crMultiDrag", "9&989M9[9q9", "thHintBalloon", "5$585I5V5^5o5~5", "FSystemMenuTracking", "Menu1", "DuplicateHandle", "=-=<=N=[=c=q=", "3*383K3a3v3", "FixPosition", "TGetClass", "ttTabItemBothEdgeHot", "RmGetList", "iTDictionary>.TValueCollection;", "FSubMenuImages", "8?8Q8r8v8z8~8", "[TEnumerable>'", "FMethod", "1TEnumerable'", ";#=;=_=", "ReadBufferData", "TArray", "FProcs", "BScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$11$Intf`'@", "Dequeue", "ListItemTextFocused", "TCreateParamsL", "TAsyncConstArrayProcedureEvent", "Uh>Rn", "common", "Y\\\\duu", "GetParentComponent", "181W1p1", "FSelectProgramGroupPage", "Rd+VD+", "tttBaloonStemUpLeft", "DialogFontBaseScaleHeight", "Icon image is not valid", "7X8p8", "skTranparentOnly", "ktcToolBarGradientBase", "hWinapi.UrlMon", "?@?\\?", "4T4v4", "tdnbRefreshDisabled", "TComponent.Create@$0$Intf`'@", "Shared.SetupMessageIDs", "4)5S5g5", "tnMenuButtonDisabled", "FCaptureOutList", "HTDictionary.TKeyEnumerator;", "7 717", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$ActRec8xm", "Uh0yn", "PGWVj", "TEnumerablel\\N", "PInterfaceEntry", "TZAlloc", "0-0D0Y0g0v0", "J0P0V0", ":-:5:", "ExportName", "<4<8 >$>(>,>0>4>B>T>k>", "SdRQj", "JTEnumerable>'", "DataSize range exceeded", "AOwner", "8-85898V8^8", "FIgnoreIndex", "Deflate", "TFileExtractor", "OnDockOver\\oG", "*Z316*", "ITEnumerable>'", "TChunkPLTE_", "fdoHidePinnedPlaces", "ohhx)", "WizardNoIcons", "Uh*St", "function Random(const Range: Integer): Integer;", "ShowArchiveInsteadOfFile", "=(=,=0=4=<=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "FDragging", ": :0:@:P:`:p:", "TRttiParameter3", "NoRestartApplications", "(IComparer`'@", "Explorer", "4O5t5", "7R7y7", "OTDictionary.TValueCollection;", ";D$$}", "Skipping due to \"createonlyiffileexists\" flag.", "FLookupRoot", "Need to restart Windows? %s", "tTDictionary.TValueCollection;", "FSelectDirLabel", "RegisterControl", "function RegGetSubkeyNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;", "RegisterVirtualMethod", "? ?(?0?8?j?", "*IEnumerable", "tebSpecialGroupExpandNormal", "Arial", ">#>7>H>X>`>n>", "claDarkgrey", "7%727:7K7\\7d7r7", "ksbcPageRight", "l6799", "FFavoriteLinks", "3=3E3m3u3", "StringBaseIndex", "=)=1=5=I=Q=r=z=", ";8;B;h;", ">-?T?", "T*%Ys", "Uh6-h", "clHighlightText", "5#5;5Q5g5", "FIgnoreStyleChanged", "sfc.dll", "Mixed", "6=6^6", "?$?,?0?4?8?(", "'TEnumerable", "TRttiContext", "50A0c0", "7$7H7X7i7", "5TList.TEnumerator5", "Uh34L4", "FThemeData", "TArrayOfECDSAKey", "sbaCustom", "TRttiMember", "CertGetNameStringW", "?E?z?", "7(70787@7D7H7L7P7T7X7\\7`7d7h7l7p7t7|7", "InverseGamma", "saRequired", "4TEnumerable'", "3TList.TEmptyFunc`'@", "GetElementMargins", "HighContrastActive", "< <$<(<,<0<4<8<@<", "kescComboBox", "?q?u?y?", "Domain", "fsNInf", "Invalid NULL variant operation%Invalid variant operation (%s%.8x)", "PExtendedd", "FOnError", "AppModifyPath", "4*4.4O4S4w4{4", "function DownloadTemporaryFileSize(const Url: String): Int64;", "ldUILanguage", "OnStartDock", "Invalid argument to date encode", "iso-ir-138", "ResStringRec", "TDoubleBufferedMode", "ELocalTimeInvalid ", ";!;%;@;D;`;", "StretchBlt", "tsArrowBtnDownHot", "SafeDLLPath", "4*515d5k5", "FAttributeTypes", "0 0$0(0,0004080<0@0D0H0h0", ".6lu@", "SetHeaderValue", "bVcl.Printers", "NamePGQ", "595G5o5", "0'0+0/03070;0?0C0G0K0", ";);L;Y;^;k;p;};", "GetDeclaredMethods", "ISSigFunc", "4N5V5a5h5x5", "?.?C?Q?h?}?", "tmbNewAppButtonPressed", "D$L+C@", "THTTPRedirectWithGET", "9(9?9U9f9{9", "SetValue", "6 6-6?6T6\\6", "Already on last slice", "5&5t5", "7 7.7E7X7`7n7|7", "TCollectionItemClassd", "AFormat", "AReadCount", "8*;.;2;6;:;>;B;F;J;N;R;V;Z;^;b;f;j;n;r;v;z;~;", "tmcMonthCalDontCare", "=}9i~]", ":e;|;", "FStreamBackup", "claPeachpuff", "1>1B1o1", "WndProcPtr%.8X%.8X", "saMostRight", "ClientToParent", "VUnicodeString", "lmNew", "Uh4hp", "PrevUserInfoOrg", "088H2", "6TList.arrayofT", "APassword", "MenuItemTextDisabled", "FTrackingPos", "TIconImage", "1$1:1H1d1}1", "9 9$9(9,9:9B9T9f9x9", "FAuthCallback", "SetROP2", "ReadComponent", "claAquamarine", "poScreenCenter", "ImmReleaseContext", "FToken", "4(5c5", "Namex", "ShowOwnedPopups", "GetExitCodeProcess", "TCanvasState", "MainPanelh", "HideSelection", "csInline", "WTArray>", "1-1>1Q1_1s1", "7$8N8", "3&3.3@3", "FDownloadArchivesPage", "URLUpdateInfo", "fsBold", "FBevelOuter", "OnAdvancedDrawItem<5Z", "tmpbEjectDisabled", "c8m/3", "242D2L2T2\\2`2d2h2l2p2t2x2|2", ".ParrayofT", "bsVertical", "4T4w4", "&System.DateUtils", "v4.5.1", "twMaxButtonPushed", "=7=?=M=`=t=", "<1<9", "wifBmp", "63JC/A", "tpIdle", "9(9P9T9u9y9", "FHintActive", "CertFindCertificateInStore", "8$9P9q9", "&TEnumerable,MF", "Offset", "FInstanceRoot", "isRS-%.3u.tmp", "FFree", ">.>7>p>", "teLink", "kTEnumerable>'", "&TEnumerable ", "claIndigo", "EndPos", "ttbSplitButtonDropDownPressed", "40484F4\\4s4{4", "3$3(3,3034383<3@3D3H3L3P3T3X3e3{3", "8:8K8Z8b8s8", "?*?@?Q?s?", "TStackPanel", "?TList.TEnumerator5", "kwdsMaximized", "4/474F4Z4k4s4", "AddIcon", "ARestartManager", "6.6?6R6`6v6", "2=2T2", "0 0$010H0]0e0", "].v f", "<)<4b>", "clMediumspringgreen", "<(<,<0<8<@'", "bsCheck", "PanelDisabled", "TEnumerable'", "7@7J7N7l7x7|7", "nTEnumerable>'", "Inno Setup Uninstall Log (b) 64-bit", "FgColor", "5/5k5", "cNames", "<,<4<<.TEnumerator5", "FLineBreak", "T0_0j0y0~0", "Post303", "9$9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9v9~9", "&op_Equality", ";\";3;>;F;W;k;|;", "VarOr", "5f6o6", "2/3Q3o3z3", "[|{vp:`d", "FCancelling", "1 161G1i1v1", "7-7?7G7U7k7|7", "<$=U=", "bfWarning", "FLogQueue", "Uhggn", "*TArray", "\\\\.\\UNC\\", "hWinapi.Wtsapi32", "7I7P7", "ClearCredentials", "RHH;Cl~", "SizeOf", "fqAntialiased", "PListd", "OLEAUT32.dll", ";=`'@", "4*4@4W4m4|4", "#TEnumerable'", "vaNil", "twFrameLeftActive", "TList&", ";-;<;H;", "csibm855", "TThemedLink", "8L8b8w8", "CheckValue", "FSysSection", "8TPair", "Content-Length", "FLastError", "IWICBitmapSource`'@", "TArchiveCallbackT", "Incrementing shared file count (64-bit).", "ACompare", "TModalResult", "SetWorldTransform", "RecursionCount", "skBottomRight", "TOutputMsgMemoWizardPageK", "tcClockDontCare", "!TList.arrayofT", "8)8T8", "FClipboardFormat", "777h7", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$8$Intf`'@", "D$L;D$", "Setup.SpawnClient", "4!4-494E4V4]4", "2(2B2M2g2r2", "System.VariantsTLC", "QRjJP", "TSeProgressSubclass", "tmMenuBarBackgroundActive", "teTaskBar", "System.MaskUtils", "Uhlgq", "Inno Setup: Icon Group", "GetMargin", "OnSelect", "DragThreshold", "SelectAll", "TCustomButton6", ">>'", "ttItemHot", "tc9t$puVL", "6&7>7G7N:U:", "FOnAnimate", "?!?)?1?9?A?I?Q?Y?a?i?q?y?", "7T8a8", "clPalegreen", "bzlib: Internal error. Code %d", "Kl;K\\u", "3 3$3(3,303=3N3c3k3", "GetCPUUsage", "tttBaloonTitleNormal", ":9;=;d;n;r;", "ktfCategoryButtonsNormal", "twHelpButtonHot", "5a5g5", "949P9l9", "vKvvv", "6 6$6(6,6064686<6@6D6H6L6T6v6", "ExObject", "UhwKn", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$28$Intf`'@", ";TEnumerable'", "pResponse", "3(363@3L3X3a3g3t3", "5%5+505;5A5F5Q5W5\\5g5m5r5}5", "FProcPos", "FInstItems", "ObjectMenuItem", "TURLHeadersX", "pintVal", ">7>?>G>O>W>_>g>o>w>", "CHARTOOEMBUFF", "6TAcceptValueListBase&", "Windows 11\"Cannot create instance of class %s", "=+=9=L=[=m=", "{TEnumerable>>", "TControlStateItem", "Points", ";5;B;Q;h;", "383H3P3X3`3d3h3l3p3t3x3|3", "ktFMBoxTextDisabled", "<\"<)<;>'", ":@:f:", "Shared.VerInfoFunc", "8TEnumerator(", "AnchorspHA", "RegQueryValueExW", "=\"=*=2=:=B=J=R=Z=b=j=r=z=", "Non-default bitness: 32-bit", "fsPositive", "csNoStdEvents", "IsChild", "Alpha", "BidiUtils", "UTF8DECODE", "q=,@H", "6/676E6U6c6x6", "VarAnd", "FFreeInstItems", "2(2,20242<2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", ";S@u\"", "IDATx", "saTopRightAngle", "ResumeWork", "3 3-3C3G3Q3Y3a3", ";S@t<", "RegSetValueEx failed (%d).", "TSeFilterSign", "9-;s;", "pGWj+1+", "6#777[7", "IsBoxTransparent", "2*2;2]2j2{2", "TFilerG", "<0:U:c:v:", "FlatSB_SetScrollRange", "OnStateChange", "FRevisionLevel", "StatusAction", "AnimateWindow", ".vhdx", "EFileError", "383Q3", ":*:=:L:^:w:", "clMintcream", "Bww7/", "KTDictionary.TKeyCollectionp5u", "(IComparer`'@", "Uh.$i", "excepInfo", "BCryptGenRandom", "tdnbInsertHot", ">'>/>=>L>^>k>s>", "9TDictionaryL7X", "6TPair", "7!73797D7\\7d7x7", "FCryptKey", "TControl", "J%Z[[", "1.1@1V1d1t1", "IsMenuDefined", "scEditDisabled", "Entry: %s", "otSByte", "3*3:3M3_3g3u3", "pfNone", ";0;l;", "6+7b7", "tbRadioButtonUncheckedNormal", "FLayout", "MenuGetClientRect", "0$0,04080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "teBackgroundWithBorderHot", "TNewProgressBarState", "taTopLeft", "Found %d files to register with RestartManager.", "FSequenceNumber", "Time stamp of our file: (failed to read)", "747D7H7L7T7\\7`7d7h7l7p7t7x7|7", "TMenuItemEnumerator", "AppSupportPhone", "Cursor", "FFieldTypes", "=TList.TEmptyFunc`'@", "scBorder", "FromPreparingPage", ">!>%>)>D>L>d>h>", "<-=4=", "TSysScrollingType", "TSeCheckDrawState", "xJ}uw3", "y-M@0", "HeaderSectionTextDisabled", "SOFTWARE\\Microsoft\\.NETFramework", "FMenuFont", "Private_d", "sbaHelp", "MarginBottomH", "303>3N3`3w3", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3m3", "PutObject", " ", "=(=0=>=L=", "MouseHover", "3TArray", "THelpEventData", "7O8q8", "Uh(7F", "FOnDestroy", "8(868>8L8^8t8", "sfRadioButtonTextDisabled", ";,;?;P;c;q;", "3?3H3v3", "FLinks", "Server", "22262N2U2_2", "(TList.TEnumerator(", "FCaseSensitive", "8TCollectionNotifyEvent", ":]\\t3", "? ?1?B?f?t?", "FOverrideFont", "1!2C2e2", ";);7;P;X;f;t;", "clSlategray", "tebHeaderPinSelectedNormal", ":';A;r;", "=#=8=@=X=`=|=", ">7>?>_>", "768f8}8", "TextHeight", "function IsTaskSelected(const Tasks: String): Boolean;", "Uhbed", "clDarkslategrey", "C _^[", ">6?C?", "AutoSizeXmG", "TSeStyleSource6", "twSmallCloseButtonPushed", "3$3,343<3D3L3T3\\3d3l3t3|3", "FOldCursor", "CopyTo", "D$H;D$ sC", "7/8\\8", "%s_%d", "7,8<8@8D8L8T8X8\\8`8d8h8l8p8t8x8|8", "ttTreeviewRoot", "tsUpHot", "cp1253", "SetupLdrAndSetup.Messages", "6 6$6(6,6064686<6@6H6P6X6x6", "FAlphaFormat", "MenuHandleL[Z", "777@7n7", "6\"646L6^6f6t6", "5;6h6", "GetThemeTextExtent", "&111v2", "='>1>;>K>b>", "TEnumerable'", "UseDockManager", "102@2D2H2P2X2\\2`2d2h2l2p2t2x2|2", "FontFocused", "TScrollingWinControl", "CharsPerLine", "NoCloseApplications", "WaitForSingleObject", "999W9u9", "Jz#o3", "clMediumturquoise", "8-9R9a9", "FReadyLabel", "System.Contnrs", "=)=q=", "ecFillColor", "isTrimmed", "FPreparingPage", "ExtendedSelect", "MemoGetClientRect", "ProductVersion", "OnTypeChange", "function MinimizePathName(const Filename: String; const Font: TFont; MaxLen: Integer): String;", "ttbThumbTopNormal", ">5?G?", "tfRtlLayout", "SHGetFolderPathW", "tpPulseOverlay", "RadioItem@oG", "FTextMarginTop", "clViolet", "UninstallDisplayIcon", "TNewCheckListBoxStyleHook8", "ARedirections", "function TaskDialogMsgBox(const Instruction, Text: String; const Typ: TMsgBoxType; const Buttons: Cardinal; const ButtonLabels: TArrayOfString; const ShieldButton: Integer): Integer;", "FindNextFileW", "%d exception(s):", "FPalette", "Time stamp of our file: %s", ">5?m?", "7'7t7", "6\"646<6J6\\6r6", "EDivByZero", "VarCmp", "NoErrorMessages", "888T8y8", "TFileDialogOverwriteResponse", "tmSeparator", "=I>m>", "2&222I2U2o2{2", "RP+PH", ";T$\\u", "FResultCode", "tfFlyOutWindow", "TNEWDISKFORM", "Uh]tJ", "4 4.4<4", "lpRect", "SetSelectedColumn", "283<3c3m3q3", "242H2L2c2j2t2x2", "3(3F3", "ClientToScreen", "AIEnumerable", "?=?E?I?`?", "GetClipboardData", "6-6C6X6f6y6", ";$;,;<;D;L;T;X;\\;`;d;h;l;p;t;x;|;", "?%?7?K?W?u?", "TLS13", "9 949G9V9h9", "YesRadio,8^", "686z6", " /s \"", "Creating directory: %s", "kmicSeparator", " 0$0(0P0T0X0\\0`0d0h0l0p0t0x0", "LTDictionary.TKeyEnumerator", "Invalid encoding nameNNo mapping for the Unicode character exists in the target multi-byte code page", "TNewCheckListBox", "claMediumblue", "TTaskDialogCommonButton", "EVariantBadVarTypeErrorDPC", "2H3O3", "teComboBox", "Mantissa", "2%2-252=2E2M2n2", "9\"909@9R9b9j9x9", "#TLoginCredentialService.TLoginEvent", "9-9D9c9}9", "tg-Cyrl-TJ", "=E=Z=k=", "DTArray>", "363I3Z3m3{3", "x0-u~f", "GlobalAlloc", "ProxyCredentials", "TApplication.TBiDiKeyboard", "TComponent", "919H9V9m9", "Point1", ":+:=:N:_:", "tlEmptyText", "StandardName", "CustomPass", "Shcore.dll", "%IEnumerable", "ttbThumbRightPressed", "? ?$?(?,?0?4?8?.TEnumeratorl", "Variant or safe array is locked", "IsTabTransparent", "RICHED20.DLL", "tdnbFirstHot", ": :$:<:L:P:p:", "=L>z>", " %d of %d bytes done.", "function BrowseForFolder(const Prompt: String; var Directory: String; const NewFolderButton: Boolean): Boolean;", "HFAElementCount", "FLatestHintControl", "ErDivideByZero", "p8BS$DWw", "TEllipsisPosition", "rgExtension", "; ;$;(;,;0;4;8;<;@;D;Q;e;m;u;};", "1 1$1(161>1P1a1r1", "SHAppBarMessage", "TStreamProc", "w,lJo", "=P>]>k>", "trSlipperVertNormal", "TMemoryStream'", "=<>O>i>", "TTextFileWriter0", ">8", "7$8s8", "Comparer\\", " ", "Font`", "tmSystemMaximizeDisabled", "Stack overflow", "tmcGridCellHasState", "> >$>(>,>0>4>8><>@>D>H>z>", "GetMaxByteCount", "{0AFACED1-E828-11D1-9187-B532F1E9575D}", "LoadLibraryW", "ttdTaskDialogDontCare", "SetLength", ",..ZK}", "4t5x5", "6'6/646:6G6V6a6l6y6~6", "SHCreateItemFromParsingName", ";?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$0$Intf`'@", "575G5^5t5", "7a8e8i8m8q8u8y8}8", "2^ 4.-O", "teBackgroundWithBorderDisabled", "=9=J=o=", "SuppressMsgBoxes", "0'0B0W0e0{0", "9?9J9R9p9", "9$929@9", "$ZXs?", "TPackageTypeInfo", "sloGetObject", "Align(", "=6=?=[=", "262D2[2r2", "v4.7.1", "FBevel1", "TRttiMethod'", "tcbGradientItemFrame", "WizardSmallBitmapImage", "tagWINDOWPLACEMENT,", "Opening the key.", "9#979P9^9q9", "8*8[8", "IAssemblyCache(", "FProgressMax", "TDummyClass", ";+;C;R;Z;l;", "FCaptionEmulation", ";BXs3", "", "Vcl.ControlshHQ", "4a4e4i4m4q4", ":R:g:u:", "sr-Cyrl-ME", "<$<,<4<<!>)>:>H>P>^>t>", "9\":&:*:.:2:6:::>:B:", "efRight", "2 2(20282@2_2s2", "GetIconInfo", "I[|;Bld", "ITDictionary.TKeyEnumerator@", "N>_`~~", "iso_8859-15", "tpHighest", "mGl;r", "384X4`4", "/yFiX", "TBrushResourceManager", "ktbmHorzBoth", "0!00080F0U0h0{0", "MTDictionary.TValueCollection;", "6$6E6I6M6Q6U6Y6]6a6e6i6m6q6u6y6}6", "TStoredDecompressor", "function IsWinDark: Boolean;", "OnGetMainFormHandle`C[", "/TArray", "tmMenuItemDemoted", "GetTimeZoneInformation", ".Owner", "TTextFormat", "TBitmapImage6", "SetMenu", "tgGradientFixedCellNormal", "<)<>.TPairEnumerator;", "6)6D6R6e6}6", "TChangeScaleMessageO", "2 282I2M2}2", "tttClosePressed", "1y1}1", "$TCollectionNotifyEvent", "425m5", "0TList.arrayofT", "6,646C6L6l6", ";6;:;_;", "dwXSize", "818K8c8}8", "6 6$6+6>6R6g6", "hddddddddddddddddddddddddddidddddd", "saLeft", " x: eXtract files with full paths", "5R5m5r5", "0TList.ParrayofT", "9B9v9", "= =.=F=Z=b=s=", "VertFrame", "UnitHashArray", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$25$Intf`'@", ";pXtG", "3R4t4}4", "3<4o4", "4#414@4W4j4{4", "0$0:0K0g0o0}0", "tsArrowBtnUpPressed", "FSourceF", "imKata", "= =.=>=L=d=l=z=", "TURLHeaders.TValueList4", "FActions", "dpAuto", "TFNDeferredFillIn", "State\\oG", "0\"0-0C0V0^0l0", "OnIdleCall", "909C9K9Y9g9~9", "FlYZ^[", ">)>9>U>k>z>", "0'0.050<0C0J0Q0X0_0f0p0", "TSysDialogStyleHook7", "6165696=6C6`6n6~6", "Formats", "7+787@7N7`7m7u7", "QueryInsertObject", "GetTextExtent", "939R9Z9b9j9r9z9", "=*=D=U=i=", "5 5$5(5,5054585<5@5D5H5L5", "9(:`:", ":,:H:L:c:m:", "5!5/5B5V5q5y5", "7.727J7p7|7", "UW}6~", "EPNGNoImageData\\R^", "Invalid slice header (3)", "FindClose", "GTDictionary", "3$3(3,343<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3", "Uhj(d", "3,3C3[3i3t3", "IndentDescriptions", ".TPairEnumerator;", "TUxThemeStyleElements`", "FReturnType", "<:.TEmptyFunc`'@", "ReadStringAsAnsi", "InfoBeforePage,5_", "?,?3?:?A?H?O?V?]?d?k?", "ttbSplitButtonOtherSideHot", "9.9<9N9]9e9t9", "function CustomMessage(const MsgName: String): String;", "sbtClose", "Invalid ZStream operation!", "1@1W1]1l1", ":#:+:5:N:\\:", "OnBackButtonClick", "8 8$8(8,8084888<8@8D8H8L8P8T8X8`8h8p8x8", "{ErO|", "FValue", " = procedure", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$51$Intf`'@", "Sig_s", "DataSize", "DWriteCreateFactory", "0V0k0y0", "Created %stemporary directory: %s", "IsEmpty", "invalid bit length repeat", "3u3y3", ";D$(~'", "= >=>", "ButtonDisabled", "ECardPanelException", "ptmPartial", "GetWideString", "HasInfo", "1!1/171E1R1b1u1", "FOnLinkClick", "717I7d7z7", "FOldMouseInControl", ";TObjectList&", "NL,hN", ";N?qyc", "<'<5.TValueCollection", "?+?:?L?[?m?z?", "SubCaption", "6:7l7", "pfDevice", "121L1Z1i1", "748`8", "cp864", "ENetURIResponseExceptionT", "CopyFileW", "1;2J2_2", ".TTask.ProcessCompleteEvents.ProcWrapper$0$Intf`'@", "GetInterfaceTable", "TConstrainedResizeEvent", "ButtonsCount", "System.RTLConsts", "userinfoname", "UhpYl", "WriteDescendentRes", "currentIndex", "FIgnoreChildren", "OTObjectDictionaryM", "+KDX(", "Action\\oG", "WParamFiller", "Cache", "5(5D5U5]5e5m5u5}5", "= =*=2=7=<=F=N=S=X=b=j=o=t=~=", "taTopRight", "TRttiObject'", ":&:a:h:{:", "CertDateInvalid", "=4=z=", ";C@u3", "ktfTabTextInactiveDisabled", "clInactiveBorder", "MenuItemTextSelected", "FAliasList", "DisableScaledDrawer", "UhYLG", "StandardGestures$FQ", "=,=<=G=R=", "\"h_P(", "4;4d4t4|4", "AutoSizeExtraHeight", "UhsIO", "TTimer", ",Winapi.Ole2", "WaitForMultipleObjectsEx", "FListViewStyleHook", "Downloading temporary file from %s: %s", "Uh;1r", "'TEnumerable", "ENetHTTPExceptionP4h", "\"TEnumerator", "QQQQQQQ", "TComponentStateItem", "TPSStackHelper.TArrayOfString", "FileHash", "`TEnumerator>(", "7V7Z7", "OldCreateOrder", "8W9[9_9c9g9k9o9s9w9{9", "BCryptImportKeyPair", "AProcedure", "OemToCharBuffA", "FTopMostList", "ISMSIPRODUCTINSTALLED", "=TWizardForm.PrepareToInstall.DownloadArchivesToExtract$0$Intf`'@", "clDodgerblue", "HH:nn", "adler", "8TEnumerator", "TSetupTypeType", ">*><>K>S>d>", "GetProcAsMethodN", "FControlCollection", "FStatusLabel4", "3*3#4", "D$ Pj", "4 4.4B4X4m4{4", "PRRRA", "UNCName", "Uhnen", "FFinder", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", "GestureEngine", "FChangeVisibleChildHandle", "kbcdsHot", "QuoteCharL", "khscHeader", "FViewerID", ":1:G:U:c:w:", "ASelectComponents", "6!6^6", "@M@t%", "FOptions", "FMaxCharSize", ">,>0>\\>", "2L2S2", "PList,", "6 6<6L6P6T6X6\\6d6h6l6p6t6x6|6", "3r4w4", "2TList.TEnumerator", "C@;p$u", "wHour", " Vcl.ComCtrls", "6*6C6X6f6|6", "8-8@8P8_8s8", "k4;k8t", "TRttiInstanceProperty3", "string", "ProcNames", ">)>.>;>@>M>R>_>d>q>v>", "AGesture", "364C4U4r4", "UhV`'@", "FCurrentPPI", "TApplication6", "RDYZ^[", "4&4G4t4", "= >E>j>", "UNPACKVERSIONNUMBERS", "?)?:?H?_?m?", "C,PjH", ">\">5>H>O>_>m>", "FillRect", "TUxThemeCheckListBoxElements", "SetItemEnabled", "ttsTrackOffDisabled", "LicenseNotAcceptedRadio$", "Comparerp(g", "TSeRollPanelObject6", "1J2X2h2", "FMsg1Label", "7%7,737:7A7H7O7V7]7d7k7r7y7", "fsInf", "sfTextLabelNormal", "3#3+333;3C3K3S3[3c3k3s3{3", "CoFreeUnusedLibraries", "MDIChildCount", "TArchiveOpenFileCallbacki", "CreateExtractionPage", "939W9x9", ">9?g?", "destructor ", "tsArrowBtnLeftDisabled", "CreateParented", "StyleNameXFA", "TTrackButton", "FOwnerLock", "TLoginCredentialServiceH/I", "claDarkkhaki", "L$8_^]", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$4$Intf`'@", "FOnUnDock", "IsDestructor", "clBtnText", "get_accDescription", "TBZDecompressor$7i", "EPNGOutMemory", "\\0`0d0h0l0p0t0x0|0", "OnDblClick8[Q", "TZDecompressor9", ">/>@>U>c>y>", "Unexpected Memory Leak", "FDropTarget", "42585?5L5R5Y5", "Uh[*r", ".arrayofT", "Uh*:G", ")TEnumerable'", "UhR&\\", "TElementEdgeFlag", "claLavenderblush", "5(676?6P6", "TWindowDisabler-Window", "949D9L9T9\\9`9d9h9l9p9t9x9|9", "7!7)7I7^7l7", "RadioButtonTextFocused", "?,?o?", "saBottomRight", "Uh*r`", "6TCollectionNotifyEvent", "0!040K0Y0p0", "'TPicture.LoadFromClipboardFormat$0$Intf`'@", "MapAlign", ">.[?N", "8!8%8;8C8G8[8c8", "LoadIconW", "8(8;8S8k8", "ControlHeight", "TSysStyleHook", "CurrentH/u", "-:^WOT", "TPSStatus", "4&454D4T4", "FrameRgn", "ShowMDIButtons", "skTop", "FCallDefaultProc", "AppContact", "212V2z2", "FlatSB_SetScrollInfo", "tebNormalGroupCollapsePressed", "tfRight", "849T9t9", "G` t;", ":XKs&", ": :S:", "MsiEnumRelatedProductsW", "TSetupFileVerification%", "FFormatSettings", "Wnd=$%x", "UhD.h", "PathEdit", "CheckCRC", "GetFinalPathNameByHandleW", "PListt", "6(7l7", "!TArray", "PageDescriptionLabel", "csRecreating", "FCredentialsStorage", "9&:*:Q:[:_:", "> >$>2>:>L>^>p>", "ElementMargins", "808>8Q8g8|8", "6,6D6L6Z6j6x6", "Found pending rename or delete that matches one of our files: %s", "function Format(const Format: String; const Args: array of const): String;", "TClassFinder", "GetPaletteEntries", "D$$WV", "FClassNameHash", "WizardSelectComponents", ";TEnumerable'", "1d2t2|2", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5|5", "ACreateDisposition", "7=8l8", "FHintPause", "9<:\\:d:", "IURLRequest`'@", "5D5O5]5", "FTree", "APort", "IsX64OS", "procedure ExtractArchive(const ArchiveFilename, DestDir, Password: String; const FullPaths: Boolean; const OnExtractionProgress: TOnExtractionProgress);", "kcdsCheckedHot", "?#?'?+?/?3?7?;???", ")TList.TEnumeratorh\\K", "mTDictionary.TPairEnumerator;", ">$>2>@>N>_>p>", "tww?x", "CurrentTask", "TVarArrayBound", "ktfComboBoxItemNormal", "cp874", ":3:F:T:g:o:}:", "SetAsHandle", ">6>>>]>a>e>", "Sub-menu is not in menu", "FWriteFunc", "teEditBorderVScrollHot", "/TCollectionNotifyEvent", "big-5", "0V213", "bBitmapImage", "hCursor", "sbaSysMenu", ";J.TKeyCollection;", ">%>7>B>J>X>h>|>", "CreateProcess failed (%d).", "aTEnumerable><", "DeInit", "=,=3=:=A=H=R=x=", "Segoe UI", "2(262F2X2n2|2", "FUseRichEdit", "B`[YY]", "function IsAdminLoggedOn: Boolean;", "GetGestureInfo", "@_^[]", "TScreen", "Uhy i", "ufWizardKeepAspectRatio", "Unknown register...", "5$5,5=5L5T5b5t5", "GetInPlaceContext", "StackSize", "SaveToMemory", "kttdsDisabled", ")TSysListViewStyleHook.TSysHeaderStyleHook7", "tsUpperTrackVertPressed", "4\"5&5M5W5[5|5", "< <$<(<,<0<4<8<<<@", "Uh6kl", "fdoFileMustExist", "c9JxM3.", "commonpf", "ProcSig", "USER32", "RegComp", "kwhtBottomLeft", "FInitLock", ">7?E?b?", "?1?3F3N3V3^3f3n3v3~3", "Invalid pixel format", "TCustomTouchManager8", "LoadCursorW", "}>< `", "claSaddlebrown", "teTaskBand", "Setup.SetupForm", "5,585<5@5D5H5L5T5X5\\5`5d5h5l5p5t5x5|5", "Helper process PID: %u", "<8<@.ParrayofT", "9TList.TEnumerator", "FNameValueSeparator", ">*?3?9?>?J?S?Y?^?s?", "invalid distances set", "Existing file has a later time stamp. Skipping.", "iSystem.IOUtils", "mtime", "lbStandard", "HasBorder", "iTDictionary>.TValueEnumerator", "FUpdateFormatSettings", " of object", "kbscOutlookBar", "TCustomAttributeClass", "Milliseconds", "claGhostwhite", "3,3>3L3T3b3t3", "Uninstall", "IsButtonTransparent", "twMinButtonPushed", "TURLHeaders.TAcceptList'", "TListBoxStyle", "System.Generics.Collectionsx", "GetDesignerStyle", "stcPreallocateOptimization", "FAutoDragDocking", "OnValueNotifyU", "EStreamError", "Invalid digit character", "7TList.ParrayofT", "Uh9WO", "PenPos", "3B3|3", "imSAlpha", "Successfully deleted the value.", "NTDictionary.TValueCollection;", "tcTimeHot", ";<;V;", "Subject8", "CastTo", "UhWMK", "InitializeCOMFlags", "curArrow", "959b9", "TFontQuality", "function UnregisterTypeLibrary(const Is64Bit: Boolean; const Filename: String): Boolean;", "FComboBox", "EstimatedSize", "0W0{0", "khssLast", "<'<=.>\\>n>", ">$>B>F>J>N>R>V>Z>^>b>x>", "3%393A3R3`3h3v3", "BaseFilename", "1?1b1", "0TCollectionNotifyEvent", "t(Ht3Ht>HtI", "bdLeftToRight", "]TEnumerable>p", "-- Icon entry --", "SysButtons", "TSysPopupStyleHook4", "7'7D7a7", "7d8z8", "@w+AUUUUUU", "PanningWindow", "tpDownHorzNormal", "https", "2@2P2X2`2h2l2p2t2x2|2", "'TArray", ":&:.:<:K:`:u:", "+TList.TEmptyFunc`'@", "CreateCompatibleDC", ":#:-:5:C:Q:b:|:", "tbPushButtonDefaultedAnimating", "_O/ij7", "function RegKeyExists(const RootKey: Integer; const SubKeyName: String): Boolean;", "D$LPkD$XdPV", "HeaderSectionTextNormal", "OnException", "9$989<9R9Z9r9z9~9", "ADirection", "4 464|4", "=*=?=W=n=v=~=", "@klmn-opqArstu", "GETCURRENTDIR", "tlListItemDisabled", "coLeftToRight", "HorzFrame", "Invalid URL: \"%s\"", "InitializeUninstallProgressForm", "ktgNone", "break from progress callback", "MaxIdatSize", "ITypeInfo`'@", "FMaskedAngles", "TDATETIME", "4*4>4O4b4j4x4", "$TList.TEnumerator5", "eeRaisedOuter", "7&7A7a7i7q7y7", "<%<-<<<", "EAccessViolationp", "<&=Z=b=p=", "FAlignControlList", "TStringBuilder&", "4 4$4(4,4044484<4@4D4H4L4P4T4\\4j4", "TFontDataName|", "=TEnumerator", "AHostname", "4 4'4>4B4F4a4i4", "6(7^7", "*TList.ParrayofT", "function RegWriteBinaryValue(const RootKey: Integer; const SubKeyName, ValueName: String; const Data: AnsiString): Boolean;", "NewTop", "Stripped read-only attribute.", "FrameNoBorder", "6,7074787<7", "clRosybrown", "TList&", "FDownPoint", "ktfMenuItemTextNormal", "qyC@:[", "TStyleHook8", "? ?$?(?,?0?4?8?>.TEnumerator", "Prompt array must not be empty", "8 9g9", "", "1X2e2", "function RegQueryMultiStringValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: String): Boolean;", "-TEnumerator(", "ttbButtonCheckedHot", "FMarginTop", "?'?5?D?L?Z?i?w?", "Q8FKu", "multipart/form-data; boundary=", "RegisterWeakRef", "Dest file exists.", "TObject", "S`+T$", "_Construct", "PIntfMethodTable", "BCryptCloseAlgorithmProvider", ">.>@>X>i>{>", "515O5Z5", "wSecond", "%TEnumerable'", "tdnbRefreshPressed", "=E>`>", "pbVal", "GetThemeSysFont", "JTDictionary.TPairEnumerator;", "TAsyncProcedureEvent", "7:7d7", "TSeTreeItemDrawState", "TVmtFieldClassTab", "tmbNewAppButtonNormal", "768N8W8<;N;a;", "6&686F6N6\\6n6", "7l;p;t;x;|;", "SharedVar", "0`0d0h0l0p0t0", "GetTokenInformation", "AccentColor", "QP_^[", "FShowBaseNameInsteadOfUrl", "8/93979;9I9W9c9p9", "DrawParentBackground", "?8?T?p?", "skPageLeft", "FListObj", "%u.%u.%u.%u", "PATPF0", "VWUUh", "0(1j1", "Unsupported method", "ttBody", "B!}pp", "TSeStyleColors6", "=.=<=", "]OX/Y", "FScalingFlags", "1$151I1Q1b1p1x1", "UnitNames", "TURLRequestt", "FIsSingleByte", "MethodAddress", "Supported", "IHelpSystem2", "data error (-3)", "OnExitxZQ", "LRDockWidthT", "6,6W6", "364:4d4", "6!6&6+676<6A6", "CreateUninstallRegKey", "dsDragLeave", "Overlay", "FIgnorePalette", "biHeight", "FindFirst", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$1$Intf`'@", "FPadding", "FHookedDirectly", "Uh:g]", "AScriptFuncLibraryRegister_R.RegisterInstFuncOleScriptFuncs$ActRec", "dwReserved1", "InputQuery[2]$0$Intf`'@", ";4;D;H;L;T;\\;`;d;h;l;p;t;x;|;", "9)989p9x9", "function IsAdminInstallMode: Boolean;", "HorzScrollInfo", "5TArray>", "375s5", "FInnerPage|", "ScrollDrawArea", "4.4W4|4", "8=8v8", "FMetrics", ";D6P6n6|6", "J.$$$!", "StartOffset$", "6\"6*6;6J6R6`6r6", ";B;F;J;j;n;r;", "claSandybrown", "6L6x6", "FOwnedAppWnds", "3#4'4+4/4=4K4W4d4t4x4|4", "5)515?5N5d5x5", "GetMenuStringW", "TMethodKind", "TProcSigh", ";&;6;q;", "FWicBitmap", "=)=:=F=N=l=|=", "ttbSeparatorHot", "const ", ">TDictionary.TItemArray", "Output", "TURLHeaders.TEnumerator", "1#1<1I1]1g1o2}2", "tcbButtonHot", "FShowMDIButtons", "<3V3d4", "0 0/0A0[0i0x0", "ReleaseMessageHandler", "GridItemFixedHot", "Collisions<", "AModernStyle", "202c2", "FOnCanResize", "kpbcCustom", "4(4,4L4X4\\4`4d4l4t4x4|4", "-TPair", "5#5+595K5b5p5", "FUpdateNeeded", "<$<(<,<0<4<8<<<@.TItemArray", "csibm857", ">D>C?", ".issig", "ActiveFont", "alCustom", ":#:V:t:", "IDesignerHook", "Signature file does not exist", "NotebookSV", "CheckDrawText", "TRttiAnsiStringType4", "OnSetNVariant", "LastEx", "Unknown custom message name \"%s\" in \"cm\" constant", "EraInfo", ":J;\\;", "EvalInstallIdentifier", "TMarshaller.TDisposeProc", "twSysButtonNormal", "Sectigo Limited1-0+", "InstructionTextx", "Uh[fo", "URL already assigned", "Assertion failed", "6/6D6Y6n6", "TList", "claLightyellow", "x*c5.kJ", ".NET Framework not found", "NTDictionary.TKeyCollection", "EditGetClientRect", "ReadFile", " l: List contents of archive", "FileVersion", "iso-8859-1", "TTypeKind", "GetKeyNameTextW", "System.Net.HttpClient", "MoveNext", "ttbButtonDisabled", ":0;z<", "Shared.EncryptionFunc", "tgFixedCellPressed", ";TEnumerable", "6 6$6(6,60686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", ">*>2>:>B>L>Z>b>l>z>", "csOwnerDrawFixed", "TileClip", "060M0", "70787<7R7w7", "RemLength", "scHintGradientEnd", "9)9P9t9", "2_3f3}3", "trSplitterPressed", "2,2<2D2L2T2X2\\2`2d2h2l2p2t2x2|2", "6)606B6U6c6j6|6", "TValueDataImplZ", "1#1+131;1C1K1S1[1c1k1s1{1", "< <(<,<4<8<@.TValueEnumerator;", "PropName", "TRealPackage'", ".TValueCollection;", "AFrame", "9=9a9{9", "S,P;E", "6:6P6l6", "Exception in safecall method", "GetBufferEncoding", "POSTMESSAGE", "*0GZ}", "ENetCredentialException", "32383D3S3f3l3x3", "sfGroupBoxTextNormal", ">->H>X>k>o>", "kspcGripper", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "6.7K7_7k7}7b8w8", "2*2.2L2k2L3P3T3X3\\3`3d3h3l3p3t3x3|3", "TERMINATED", "AStep", "QpFOu", "TCommonDialog6", "SetDownloadCredentials", "FAsUInt64", "ISPOWERUSERLOGGEDON", "Ehc3j", "twDialog", "8%9.9", "?-?1?H?R?V?t?", "878O8g8", "< <$<0<8<@l>", "2+292L2i2w2", "BitmapOnRight", "1a1j1", "Events", "Vcl.Graphics", "8Mje-", "ActiveOleControl", "%s%0.8x", "0,040<0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0", " t~mr", "utf-16", "TranslatePositionEx", "8-8\\8", ";TDictionary.TValueEnumerator;", "function CreateCustomForm(const ClientWidth, ClientHeight: Integer; const KeepSizeX, KeepSizeY: Boolean): TSetupForm;", "<|=m?", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;l;~;", "lttStandard", "101@1D1H1P1X1\\1`1d1h1l1p1t1x1|1", ";D;p;", "3\"3&3*3.32363:3>3B3F3J3N3R3V3Z4^4b4f4j4n4r4v4z4~4", "GetStreams", ":0:L:h:", "NextButtonClick", "7@8P8g8L9H;", "080H0P0X0`0d0h0l0p0t0x0|0", "8TArray", "ITDictionary.TPairEnumerator;", "klgUnchecked", ";!<)", "iTDictionary.TItem", "2&242F2J2l2", "cdSafeCall", "TFontStylesBase", "<2=C=S=", "6>7K7X7r7", "FOverrideEraseBkgnd", "TPattern", "\\TEnumerable>'", "TURLResponse'", "CollisionsTfe", "0B1b1y1", "ID+Q\\R", "TPrivateHeap.THeapItem", "OnRestore", "6(7A7U7", "TShortCut", "Resize", "8TQueue&", "=&=-=4=;=B=I=P=W=^=e=l=s=z=", "StartIndex", "BevelOuter", "9-999[9g9", "<1<\\tQzD", "skLineLeft", "IsArray", ".TEnumerator(", "%TMethodImplementation.TInterceptFrame(", "G\\_^[", "FFocused", "5#5*51585?5F5]5a5e5", "5&5*5F5M5W5x5", "6+6@6Z6l6z6", "Vcl.Grids", "BottomStackPanel", "sfHeaderSectionTextDisabled", "TNoRefCountObject", "TCustomActionList|QP", "<#=X=_=", "C(_^[Y]", "UhT}]", "OnRadioButtonClicked", "FDrawIfOwner", "TVarArray", "tebSpecialGroupExpandHot", "TRttiInstancePropertyEx", "ComboBoxItemSelected", "maAutomatic", "u+9|$", "[name/ver]", "pbSysHorizontal", "Unable to insert a line", "fdoForceFileSystem", "xjjjj", "?6?D?[?r?", "0%080I0Z0h0y0", "AResponse", "UhX>r", "ParentFont", "OnEndDock", "AImageType", "!TScrollBarStyleHook.TScrollWindow6", "tagDISPPARAMS", "pszSpec", "4,4E4I4h4x4|4", "9,9<9@9D9H9L9T9X9\\9`9d9h9l9p9t9x9|9", "DefaultExtension", "pmNone", "GetPage", "FCallback", "ttdRadioButtonPane", "Winapi.D2D1", "QTFOu", "ShowCaption", "Uh:D^", "Cannot call \"%s\" function during Setup", ">?>C>Z>a>k>o>", "claNavy", "0#020H0X0\\0`0h0p0t0x0|0", "JTDictionary.TPairEnumerator;", "AScriptFuncLibraryRegister_R.RegisterLoggingFuncScriptFuncs$ActRec ", "RollValue", "Collisions\\", "tbRadioButtonUncheckedHot", "494y4", "1 1$1(1,1014181<1@1D1H1L1P1]1t1", "FImageCount", "J%ZZZhmmEUU4M[", "<5<\\<", "DockRect", "RENAMEFILE", "FParentFont", "8@TList`1.Pack[1]$ActRec@JL", "BaseName", "ALinkLabel", "94:L:o:", "!TEnumerable", "ContentAsString", "TGestureEventInfo", "uz-Latn-UZ", "IncTopDecHeight", ";#;7;L;Z;m;", "2^3e3y3", "tis620", "mkSafeProcedure", "tIHtc", "operator ", "sltID", "FPressedFont", "IsStatusDefined", "function SetIniBool(const Section, Key: String; const Value: Boolean; const Filename: String): Boolean;", ".TValueEnumerator;", "GetWindowTheme", "IdentToInt", "MSG_INFO", "WindowState,", "1!202E2", "212A2P2`2n2", ":^DtJ", "Checkbox", "+TList", "%s parameter cannot be nil0A StyleHook class has not been registered for %s#Feature not supported by this styleDCannot call BeginInvoke on a control with no parent or window handle$CardPanel card index is out of range\"CardPanel.ActiveCard cannot be nil", "FOnHelp", "7%7>7X7`7h7p7x7", "commdlg_FindReplace", "?3?@?P?`?v?", "AutoCompleteDelay", "3\"333P3a3~3", "6.TList`1.Pack[1]$0$Intf`'@", "tgGridDontCare", "1 1(14181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "TUTF8Encoding&", "GetThreadLocale", ":C;X;f;~;", "thHeaderDropDownNormal", "TryAdd", "", "Current8", "<^=*>", "FRecursionCount", "ArchiveName", "D$XPj", "HelpContext", ";/;`=m={=", "7$727H7]7k7~7", "1,1<1@1D1H1L1T1X1\\1`1d1h1l1p1t1x1|1", "GetClipBox", "(Default)", "0+0Z0x0", "3&343C3\\3x3", "9\\9w9", "vqbi3", "WriteListBegin", "TCustomStyleTabSetElements", "E0C0A", "FRoot", "tlExpandButtonPushed", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$35$Intf`'@", "No help found for context %d", "Uh[qM", "8%828:8L8_8c8{8", "GetMethod", "FPackage", "q7XiI", "TCreateProcessOutputReader]", "2*2;2N2`2x2", "Inno Setup: User Info: Serial", "LoginEvent", "memcpy", "'TList.TEnumerator5", ",TEnumerableh", "> >1>D>U>h>v>", "0%060D0L0Z0h0", "JTDictionary.TValueCollection", "LoadLibraryA", "UhyGq", "FGlobalVarNames", ";$;,;4;<;D;L;T;\\;d;l;t;|;", "ttbBackgroundBottom", "060H0^0m0y0", "FParentShowHint", "Wz6@E", "GetHashCode", "SELECTDISK", "\"00080F0X0w0{0", "-TList.arrayofT ", "< &>*>.>I>M>Q>l>p>", "4 4$4(4,40444A4R4c4}4", "source", "TokenSymbolIs", "Mid32", "arm32compatible", "6 6.6=6K6`6n6~6", "ThreadID\\oG", "8/8=8L8T8b8p8", "TSeMenuItemInfo", "7#757L7Z7j7}7", "= ><>w>", "1 1+1}1", "cp865", "?ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$8$Intf`'@", "FUserInfoNameEdit", "FItemsPainted", "Extract7ZipArchive: Invalid ArchiveFileName value", "SetEndOfFile", "ttTopTabItemLeftEdgeFocused", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5u5", "< <$<(<,<0<4<8<<<@.TPairEnumerator", "EPlatformVersionException ", "8 868G8i8v8", "MBToWCharFlags", "1?1g1", "$IComparer`'@", "tnBackButtonDisabled", "Rh+PH", "n00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0123456789ABCDEF", "skFMXTrackBar", "ENetHTTPCertificateException", "MapArchiveExtensions", "Subtract", "vTArray>>", ":>;C;\\;l;};", "$TEnumerable'", "747D7f7j7", "5 6,6064686@6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "tfFlyOutLinkHeaderNormal", "psAlwaysSkip", "faWrite", "FromUnicode", ">ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$12$Intf`'@", ":*:8:F:Z:k:y:", "9D:#;", "8%8>8O8]8e8s8", "InitMessageHandler", "!This program cannot be run in DOS mode.", "9 9,9094989@9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "HKEY_PERFORMANCE_DATA", "v\"2Ks#23", "tspMoreProgramsArrowBackHot", "skFMXRadioButton", "1TEnumerable", "1<1[1", "libOffset", "}t7N,", "Filesx", "TSeBoxInfo", "3Q3`3h3x3", "OnReceiveDataEx$", "tmpbNextDisabled", "505>5O5_5r5", "WaitFor", "ktfMenuItemTextSelected", "/sXi`k", "DTWorkStealingQueue&", "twMDISysButtonDisabled", "tmbNewAppButtonDisabled", "FCancelled", "tpChunk", "Q0a0m0w0", "SortList", "1O2S2W2[2_2c2g2k2o2s2w2{2", ";ScriptFuncLibraryRegister_R.RegisterOtherScriptFuncs$5$Intf`'@", ">8>X>|>", "UhbvS", " ", "ktxsDropShadow", "$TEnumerable", "1 1(10181@1H1P1X1`1h1p1", "newViewer", ":D;c;j;", "2E2w2", "=)=O=z=", "2\"2>2a2i2", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$22$Intf`'@", "pf15bit", "InitializeBitmapImageFromStockIcon", "s0+s4V", "EControlC", "pszValue", "tttToolTipRoot", "GetReal", ".idata", "Failed to load .NET Framework DLL \"%s\"", "TChunktRNS$y^", "9+9<9R9`9k9v9", "function Is64BitInstallMode: Boolean;", "?Pyo\\Gp:O", ";5hl^", "ForceScaling", "sysuserinfoorg", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>|>", "tsSizeBoxHalfBottomLeftAlign", "sfStatusPanelTextDisabled", "$IComparer`'@", "WindowTextNormal", "ttbThumbBottomPressed", "HintMaxWidth", "kD$TdP", "CopyImage", ";Z]_^[", "FWinCertList", "ReadVariant", "9.9<9T9h9p9", "%TArray", ":\":A:M:c:k:", "igPan", "CreateRoundRectRgn", "ttbDropDownButtonCheckedHot", "https://sectigo.com/CPS0", "fdoStrictFileTypes", "FIconList", ",HP#B", "5 5$5(5,595J5c5w5", ":6:^:", "454G4U4l4t4", "6\"6*626:6B6J6R6d6y6", "EraseLRCorner", "6\"606?6U6c6k6y6", "TMarginSize", "TSeMenuItemDrawState", "TPointerList", "0!0/0B0Q0c0v0~0", "FFileMask", "3h4p4}4", "ABitmap", "FBackButtonl", "Original Uninstall EXE: ", "FOnCancelButtonClick", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$34$Intf`'@", " TEnumerator0'X", "bmHeight", "3*3J3\\3s3w3", " TOutputMarqueeProgressWizardPage6", "EncodeQuery", "5%575E5M5[5m5", "6\"7Q7a7n7", "; ;$;(;,;0;4;8;<;@;D;Q;h;};", ":$;,;L;T;d;h;l;t;|;", "ForceCloseApplications", "%TEnumerator(", "APoint", "FType", "clInfoBk", "VerSetConditionMask", "Uh&Co", "GetSystemMetricsForDpi", "0+090Q0b0|0", "Uh]kc", "smj-SE,smj,se", ": :.:@:N:b:|:", "TTabletOptions", "GlobalVarNames", "?,?F?", "6,6?6R6e6x6", "QT_%|L^=", "SetFileAttributesW", "0J1T1Y1~1", "9 939D9Y9h9}9", "*1#J$", "GetThreadPriority", "HeapDestroy", "Invalid RootKey value", "5#6'6M6Q6|6", "1(1:1L1a1t1x1", "sbsNormal", "twMDISysButtonNormal", "SHPathPrepareForWriteW", "GetItem", "WinHttpReadData", "FInitializeCOM", ">'>9>J>[>p>", "tiIdentifier", "ATList.ParrayofT", "clRed", "System.Generics.Collectionsd1e", "ParentXZQ", "?#?+?3?;?N?c?q?", "SetGraphic", ":':6:K:\\:}:", "kldsHot", "System.SyncObjs", "UhDlf", "pmAuto", "ZTArray>", ";ScriptFuncLibraryRegister_R.RegisterOtherScriptFuncs$7$Intf`'@", "TCardPanelL", "tmpbEjectNormal", "TBrushData", ".TTask.ProcessCompleteEvents.ProcWrapper$ActRec", "0)0;0C0Q0c0y0", "TPSStackHelper.TArrayOfInteger", "#t~mr", "TNewRadioButton", "wipmNone", "2/2C2U2h2z2", "9TDictionary.TKeyEnumerator;", "8)8:8B8P8_8u8", "ttbSplitButtonDropDownNearHot\"ttbSplitButtonDropDownOtherSideHot", "TCustomStylePanelElements", "Existing", "Systeml", "3*383@3Q3`3h3y3", "7!8-858X8", "PeekNamedPipe", "kebdsFocused", "<,>", "6+6A6N6[6i6", "TSeTabInfo", "tis-620", "CommandLinkHint", "1'191S1a1p1", "RUSSIAN_CHARSET", "TDragImageListO", "8L8[8h8w8{8", "2-3s3", "FSortedComponents", "fCache", "8?8J8P8`8h8p8x8|8", "FWheelRouting", "ecTextBorderColor", "> ?3?C?Y?f?l?{?", "SystemL", ">#>3>F>Y>g>y>", "fMonth", "InArchive", "7(707S7_7u7}7", "System.Threading", "VertScrollRect", "Invoke", "1'1=1R1`1o1", "6(636B6L6Z6k6", "ResetDesigningStyles", "commontemplates", "PropData", "0M0n0|0", ">F>`>{>", "sfToolItemTextDisabled", "WantReturns", "8!848H8P8a8", "; ;$;(;,;0;4;X;v;z;", ";/;[;p;y;", "D2D_RECT_F", "4$424D4R4Z4h4z4", "VArray", "TCustomButton", "ttbButtonHot", "Print", "FDefWndProc", "GetChars", ".TKeyCollection`MM", "afDefined", "function FindFirst(const FileName: String; var FindRec: TFindRec): Boolean;", "tgClassicCellSelected", "WriteListEnd", "]TEnumerator>(", "= =(=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=q=", "TPopupWnd", "DBNavigator", "9!9'9E9S9f9", "*IEnumerable", "DWRITE_CLUSTER_METRICS", "6d6i6", "LocationLabel", "ATEnumerable'", "9'989O9`9s9", "ComboBoxItemFocused", "WaitForSingleObject returned unknown value", "TMAXBITMAPINFO(", "GetDataInfo", "FTCollectionNotifyEvent", ",TEnumerator", ")TSysListViewStyleHook.TSysHeaderStyleHook4", "RegisterClipboardFormatW", "Failed to read CompID", "CTDictionary.TPairEnumerator0-E", "FSuspended", "2(2@2O2X2q2", "claCadetblue", "iso-8859-7", "9#9+9;9?9S9h9v9", "tlGroupHeaderCloseHot", "Yes/No", "ReleaseMutex", "8\"828@8X8`8n8~8", "No Error", "Embarcadero URI Client/1.0", "9&969J9m9{9", "DropDownMenu", "Menu2", "2 2.2E2\\2j2", ":g;v;", "FAsPointer", "FAdapter", "\\TDictionary.TValueEnumerator", "VarIdiv", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$20$Intf`'@", "6&6,6:6P6]6e6y6", "VariantCopy", "CreateEmpty", ">!>)>8>", "FCurrent", ":0:@:H:P:X:\\:`:d:h:l:p:t:x:|:", "EListError@", "TThreadPool.TQueueWorkerThread;", ":D:p:", "1 10181@1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "toPressAndHold", "t++C4P", "7(8Z8", "IsBoxDefined", "=2=C=R=Z=h=v=", "Handle,", "pbsError", "GetControlHorizontalPositioning", "'TCustomGestureEngine.TGestureEngineFlag", "dllnamehash", "898f8", "\\TEnumerable>'", "cbWritten", "ClientWidthl ><>X>t>", "5'5y5", "ArrayData", "ExtractPair", "Archive is solid; extraction performance may degrade", ">6>H>X>\\>~>", ">,>s>", "RoundedCorners", "ItemIndex", "HTDictionary.TKeyEnumeratord", "DesktopHeight", "ECompressError", "9,9@9H9Y9l9", "FIgnoreImages", "Uh mJ", "VarAdd", "Failed to parse \"drive\" constant", "FInnerExceptions", "TPSDebugExec`", "2$3X3", "ATool", "PopulateOle2Menu", "6+6L6\\6h6", "TPopupMenu6", "clAliceblue", "FMarginRight", "TRttiInstanceMethodClassic", "PendingFileRenameOperations2", "twRestoreButtonHot", "Uh/%t", "071T1d1", "4,4F4`4o4", "kcdsCheckedPressed", "GetCurrentProcNo", ";,;E;l;", "TrySetStyle", "ARange", "7 7$7(7,70747B7T7e7", "?(?1???L?]?k?y?", " 0-0@0I0", "2Z3f3w3}3", "KTDictionary.TValueCollection;", "PreparingMemoS", "function GetUserNameString: String;", "AParams", "030D0", "#TCollectionNotifyEvent", "5)5;5K5S5a5q5", "9TObjectDictionary", "CreateNew", "proDialog", "251124160441Z0?", "YTDictionary.TPairEnumerator;", "c,J^$x^q", ":(:C:G:K:O:S:W:[:_:c:g:k:o:", "0>0K0\\0~0", "919G9N9X9k9", "TRttiInstancePropertyClassic", "G(LCC", "0H0h0", "GetOpenFileNameW", "IsDialogMessageW", "CurrentD", ":!:3:T:a:u:", "6 6>6F6W6n6", ">8>^>", ">%>3>I>^>l>", "IChangeNotifier`'@", "9V>l?p?t?x?|?", "1U1i1x1", "procedure Log(const S: String);", ";&>", "8L8x8", "4 4$4,40484<4D4H4P4T4c4o4v4", "QXFOu", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$17$Intf`'@", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$2$Intf`'@", ";D$Lw", "sphpFill", "=$=2=<=J=X=u=z=", "tsLowerTrackHorzPressed", "9 :R:", "ReadInteger", "=!=7=L=Z=m=", "Error reading data: (%d) %s.Error setting timeout for the request: (%d) %s'Error opening certificate file: (%d) %s)Certificate is not found in file: (%d) %s", "ibm819", "151f1~1", "IsPanelDefined", "0=1Q1`1x1", "ENetHTTPRequestException", "maTopToBottom", "8%848J8\\8d8r8", "ImageMarginstFA", "FIScaling", "NumUninstallDeleteEntries", "Result", ":':::K:Y:m:", "1b1_2", "ImageHandleValue", "DispatchKind", "< <$<,<4<8<<<@?F?N?\\?k?", "Uh8AG", "707>7F7T7b7v7~7", "757H7P7^7l7", "Previous", "040P0l0", "tlGroupHeaderCloseSelectedHot$tlGroupHeaderCloseSelectedNotFocused'tlGroupHeaderCloseSelectedNotFocusedHot tlGroupHeaderCloseMixedSelection#tlGroupHeaderCloseMixedSelectionHot", "DeinitializeUninstall", "1;1d1", "6 6'6.656<6C6J6Q6X6_6f6m6t6{6", "RmRestart", "FNeedClientCertificateEvent", "><>B>V>", "\\Program Files", "4)4<4@4G4Z4n4", "5/5B5V5f5|5", "2&282C2K2Y2i2|2", ";&;D;", "ssCtrl", "FProcessMessagesProc", "6+6A6Z6h6z6", "PPTypeInfoT", "IsRecord", "3$3A3O3b3", "CTList>&", "QQQQQQSVW", "DTDictionary.TValueCollection", "BTDictionary.TKeyEnumerator", "FBackColor", "(TList.arrayofT", "CreateStdAccessibleObject failed", ";xPt{", "181]1", ">7>R>r>", "Active", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<", "tlListItemSelected", "thHeaderDropDownFilterNormal", "Vcl.Direct2DD", "1H1y1", "Usage: 7zDec ", "FDisabledStyle", "TSeActiveStyleObject6", "7!7%7)7-7175797=7A7E7I7M7Q7U7Y7]7a7e7i7m7q7u7y7}7", "0(090O0`0r0", "FData", ")TEnumerator(", ",strikeout", "ManualDock", "8?8n8", "HintObject", "twSysButtonHot", "?%?~?", "EPropWriteOnly", "TAuthPersistenceType", "RegDouble", "TSeHintInfo", "L5TQ>", "TFinalizer", "0(090G0O0]0k0", "GIComparer>`'@", "FRootControl", "Alignment@6Z", "3$4S4", ";TCollectionNotifyEvent", ">(", "1#1*111M1Q1q1u1", "Fusion.dll", "tkClassRef", "4&484F4N4\\4j4~4", "ClearItem", ":&:.:6:>:F:N:V:^:f:n:v:", "CompanyName", "ErOutOfRange", "2(2D4w4", "efTouchEvents", "UseVisualStyle", "csibm863", "9+939A9T9e9|9", "thHeaderOverflowNormal", "Ck*},", "GetClassNameW", "lTDictionary.TKeyCollection;", "273N3[3i3", ">/?3?7?;?I?W?c?p?", "TUnicodeEncoding", "Z_UNINSTALLICON", "FMainPanel", "TThreadPool.TThreadPoolMonitor;", "3 3$3(3,3034383<3@3D3H3P3", "FInvokeInfo", "TExtUninstallLog", "kwbClose", "TPopupFormArray", "405_5l5{5", ";6;H;Y;o;|;", "GetClassInfoW", "<1=5=`=", "4)474D4^4", "erNullVariantError", "HasFormat", ";0;G;Y;l;", "2 2A2O2X2", "TSubMenuItemInfo", "CanShow", "Handle(", ":9:B:", "KQ__", "CatgeoryButtonsCategoryNormal", "Shared.SetupEntFunc", "AStrings", "DecimalSeparator", "CancelButtonp", "OnLog", ":-:;:R:g:u:", "Setup.Install.HelperFunc", "TComponentState", ";BXs\"", "ExParam", "TAsyncCallback`'@", "clDarkgoldenrod", "Winapi.Ole2", "2&2c2", ":TPropData.:1", "?*?8?[?j?", "Anchorsl&", "3)363C3H3M3R3d3r3w3", "HandleException", "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): Boolean;", "The setup files are corrupted. Please obtain a new copy of the program.", "TClipboard", "iso-8859-5", "UhSYO", "TThemedScrollBar", "OnProgress0", "clMediumaquamarine", "FShowAction", ";/&", "MaxCapacity", "=4>F>P>h>", "FromArray", "4'494L4p4t4", "MODIFYPIFFILE", "ObjectType", "303P3T3t3", "WriteStringAsUtf8", "FloatToStr", "GetFormats", "0\"0)030:0D0K0U0\\0f0m0w0", ";TEnumerator", "InitializeWizard raised an exception (fatal).", "Writing uninstall key values.", "wYear", "incompatible version", "v4.6.2", "WStrGet", "W`CNu", "windows-1255", "=`=f=", "InsertRange", "ktfHeaderSectionTextNormal", "TaskDialogMsgBox: Invalid Buttons", "Param2", "claSlateblue", ",TEnumerator", "Systemx\"P", "B!ZZZx", "csDesignInteractive", "Align(mG", "4I4~4", "FChildZones", "ExceptionObject@", "0#0<0Z0i0~0", "Delphi Component", "848?8R8r8", "30383F3T3i3", "TDragControlObject", "1rN_.", "position", "090@0a0", "ceftDisabled", "ListItemTextSelected", "GetThemeTextMetrics", ";$;4;<;D;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "VertTrackRect", "5,5;5C5Q5c5q5y5", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6j6|6", "<-+>?>G>X>f>n>|>", "7?7C7j7q7x7", "3%4n5", "IPQPR", ";TEnumerable", "=b=f=", "TLocalTimeZone&", "=3=H=P=^=m={=", "8TDictionary.TValueCollection;", "1\"101<1", "3!333;3I3X3n3|3", "@2;fE", "TRttiSetTypeT", "ktcToolBarGradientEnd", "9!:%:L:V:Z:x:", "GetText", "!IEnumerable", ":,:B:P:c:z:", "Client", "70878N8t8", "0TEnumerator", "AStartMenu", "4+5;5", "TCustomStyleTabSetElements4", "6TArray", "=\">A>I>S>[>e>m>", "tdnbEditDisabled", "Uh~_i", "TVerticalAlignment", "/TArray", "3!383>3P3o3", "5$6(6,646@6D6H6L6l6x6|6", "t]!kY", "TProgressStage", "7@7U7c7v7", "SetAttrib", "BeginUpdate", "FIntegralHeight", "?W?[?_?c?g?k?o?s?w?{?", "SubAuth", "bcNonEmpty", "TBevelKind", "UhvmT", "0+0<0H0L0P0T0\\0d0h0l0p0t0x0|0", "Uh;Ul", "DBGrid", "ttnTrayNotifyRoot", "OnResize", "&Domain", "dupIgnore", "soUseLocale", "5*5<5M5U5c5r5", "AAction", "Uh|]t", "9+9D9Z9t9", "RegisterFunctionName", "CompareStringW", "2%2/2g2m2w2}2", "EPngUnexpectedEnd", "ComparerH", ":4:I:", "FOnPopup", "Bottom", "pmMaskNotPen", "D$LPkD$XdPW", "?%?5?C?[?c?q?", "4<4K4i4m4q4u4y4}4", ",IComparer`'@", "SaveDC", "1E1Z1k1", "/Components=", "&TThreadListt", "212C2K2Y2i2}2", ";&;.;<;M;];e;s;", "Visible", "EnterWithKeyboard", "Winapi.TpcShrd", "5(5D5`5|5", "FChildStoredNormalRect", "TObjectList&", "OBJECT", "1 1<1K1`1p1", "ComboBoxItemNormal", ";*;2;D;p;t;", "= =(=,=4=8=@=D=L=P=X=\\=d=h=w=", "ElementType", "TUxThemeHintElements", "<&<:.TValueEnumerator;", "cbClsExtra", "TCompressedBlockReaderQ", "0(1i1", "CharCode", "GlobalDeleteAtom", "ceftCustom", "FOnSetNVariant", "< >", "GetThemeSysBool", "ttTabItemLeftEdgeSelected", "PCERT_EXTENSION", "TMouseEvent", "LoadFromFile", "BevelWidthXmG", "TStyleEnginec", "8d:k:", "K/U=R=", "teEditBorderHVScrollFocused", "Threshold", "?*?;?]?j?{?", "WriteBoolean", "FUpdateMetricSettings", "0 1>1T1v1", "3(383I3h3v3", "5(5>5L5d5z5", "888[8_8~8", "7*7D7R7a7q7", "tsGripperVertNormal", "?$?,?4?8P8h8z8", "AppendFormat", "TURLEncoding.TEncodeOptions", "070D0T0\\0d0l0p0t0x0|0", "Uh6Pi", "ktbmVertLeft", "cl3DDkShadow", "5I6X6o6", "clHotpink", "\",;= ", "csisolatin6", "FBaseType", "FPageList", "-- DLL function import --", "TIntConst", ";<;a;", "TInterfaceTable", "function SamePackedVersion(const Version1, Version2: Int64): Boolean;", "Aliases", "TAdvancedMenuDrawItemEvent", "ASelectTasks", ";!<%TDictionary.TItem", "StartNew", "9*929<9F9P9Z9d9n9x9", "SysAllocStringLen", "=&=+=;=@=P=U=e=j=z=", "PUnitHashEntry4", "TFieldsCache.TFields", "TVmtMethodExEntry", "4\"484x4", "ksbcHorzSlider", "v4.6.1", "*TEnumerable'", "GetLastActivePopup", ";#;.;9;H;Y;i;", "ecEdgeFillColor", "TEnumerator", "= >$>E>I>d>h>", "8,8<8D8L8T8X8\\8`8d8h8l8p8t8x8|8", "4 4,4G4l4", "MarginId", "MTDictionary.TPairEnumerator;", "SHLWAPI.dll", "FRollValue", "6W6[6_6", "1(1:1B1P1_1u1", "Uh-UK", "14292", "tsThumbBtnVertDisabled", "Uh$uO", "TList", "oboY:", "FSection", "FAvailable", "Y^V", "WNetCloseEnum", "OkButtonLabel@", "Uh\\R`", "1C1R1", "tgGradientCellNormal", "1=1`1", "teToolTip", "0b0w0", "iso_8859-7:1987", "Spacingh", "ktfTabTextInactiveHot", "7+8L8", ">D?c?", "FItemCount", "TBevelCut", "OnContextPopup``Q", "BeginRead", "ProtocolVersion", "tiCloseRound", "FMDIStopHorzScrollBar", "7!7%7)7-7175797", "TWinControlMessageHandlerClasst", "[TEnumerator>(", "taVerticalCenter", "b0j0r0~0", ";\";>;S;a;t;", "Setup.RegDLL", "ttbButtonNormal", "DecompressInto", "464>4Z4b4", "5'5<5J5]5s5", "?7?a?s?", "FTileStyle", "RmStartSession", "0,0F0Y0k0y0", "!0<0r0", "IsCustomStyleAvailable", "?#?F?", "TKeyEvent", "C0_^[Y]", "4*494]4g4s4}4", "TSeRollKind", "fCheckCRC", "TEnumerator(", "545N5q5", "OnCreate\\oG", "FTabList", "S4;S,u", "*TObjectList&", "GetContentLanguage", ">0>B>F>Z>b>", "FFormActive", "TIDispatch", "g\"6`v", "? ?(?0?8?T>", "9 9%91969B9G9S9X9d9i9u9z9", "=->\\>", "7=7p7", " AddStrings(Strings.data(), Strings.High);", "626D6]6e6m6u6}6", "sbmLeftToRight", "64-bit", "OnUnDockK", "5#6B6", "ShutdownBlockReasonDestroy", ";&;4;D;V;f;n;|;", ": :3:I:X:i:m:", "tcbCancel", "CopyValue", "0-0>0R0Z0k0y0", "&op_Inequality", "tcpChevronOpenedPressed", "trChevronHot", "CompareWeights", ":8:H:P:X:`:d:h:l:p:t:x:|:", "UnsafeAddrOf", "clSlategrey", "0K0a0r0", "ttdSecondaryPanel", "namehash", "CutToClipboard", "Log closed.", "SetObject", "5H6$7", "WindowDrawGripper", ";AXti", "tspProgListSeparator", "TTime", "dwState", "Setup.WizardFormS", " IComparer`'@", "WParam", "34383V3Z3u3y3", "HasData", "VY_/2>1N2", "CanDock", "FInfoBeforeClickLabel", "D$$8+x", "4&454L4", "IsAmbiguousTime", "GroupBoxTextNormal", "TSeMenuItemClass", "otUWord", "AsyncResult", ";&;<;Q;l;", "#Sectigo Public Time Stamping CA R36", "TCustomGestureManager@", "EnableScaledDrawer", "FBaseAddress", "tbPushButtonHot", "6-616O6S6n6r6", "Extracting 7-Zip archive %s to %s. Full paths? %s", "kcdsMixedDisabled", "5#5=5E5I5c5k5", "(A;OICI;FA;;;SY)", "ACommonStartup", "SHGetFileInfoW", "TList8+O", "REGISTERWINDOWMESSAGE", "8 9.9?9P9m9{9", "=6=A=L=p=", "TSeTabButtonDrawState", "CountU", "tagDIBSECTIONT", "0'0/070?0G0O0W0_0g0o0w0", "3/373H3V3^3l3x3", "9(:j:", "GroupEdit", "ktfPopupMenuItemTextSelected", "282T2a2m2u2", "7'7J7c7~7", "AlternatingRowBackground", "?TDictionary.TItem", "*TEnumerable", "TStringsEnumerator`", "<$=0=F=t=", "3_4g4r4x4", "1L2S2i2", "9-9?9R9Z9h9v9", "2$3g3", "GetProperty", "6 6(60686@6H6P6X6`6h6p6x6", "UhX&r", "CurrencyFormat", ":!:~:", "3\"3p3", "0i0T1", "=M=[=j=", "CreateProcess", "d%J$E1", "!TList.TEnumerator5", "= =$=(=,=0=<=@=T=X=d=h=t=x=|=", "FCommandLinkHint", "FUserInfoSerialLabel", "_TEnumerable>H/u", ";.;<;O;e;v;", "saError", "Uh?(R", "GetCustomHeaderValue", ">q>Q?", "fdCreateAlways", "ExtraData", "no Main Proc", "kWrongPassword)Compression.SevenZipDLLDecoder.Interfaces", "Cannot open file as archive", "> >(>0>4>8><>@>D>H>L>P>T>X>\\>", "APage", "AsRaw", "TSeDockSubclass", "?%?4?s?x?", "ECannot call BeginInvoke on a TComponent in the process of destruction", "TTileMode", "#0*0?0C0G0K0N1a1@2S2", "NumLanguageEntries", "CreateNewCard", "Installing into GAC", "TCustomTrayIcon", "7,7<7N7^7f7t7", "SubscribeToMessage", "9*9@9Q9s9", "FStreams", "6.6C6Q6d6v6z6", "9]:B;", "\\TArray>", "3+3K3Y3l3|3", ";Y;|;", "t$`;~", "R/TZ*", ";5;=;U;Y;w;{;", "GetWindowOrgEx", "SpinWait", "Set-Cookie", "Session Mismatch", "5 7'7", "FActivePage", "ceftInvisible", "UhFXc", "IsEmptyx", "= =$=(=,=0=4=8=<=@=M=d=y=", "6+6G6U6b6t6", "BringToFront", "4i4z4", "Windows 8.1", "0LtER", "SetAnsiString", "7D7k7t7", "FLastThreadCreationTick", "QueryInterface", "3)4:4C4", "4$424D4Z4k4~4", "AScriptFuncLibraryRegister_R.RegisterLoggingFuncScriptFuncs$ActRecl", "tebSpecialGroupHead", "kbidsDisabled", "FontDisabled", "AHint", "&TEnumerator(", "=X>u>", "", "AddRadioButton", "9\"9I9R9", "FocusedForm", "FSetDefault", "<+<81?@?Q?c?", ">4?8?", "flags", "+TList.ParrayofT", "9,9:9B9P9\\9", "STRINGCHANGE", "; ;.;B;X;m;{;", "MaxHeight", "Uh;|S", ":*;.;U;\\;c;j;q;x;", "ST_^[Y]", " h@`c", "_STARTUPINFOWD", "TItemData", ">}zbZ", "1*1F1a1u1", "pfltVal", "taRight", "LanguageName", "8'8+8I8M8h8l8", "fCount", "ktigRoll", "2 2$2(2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "TRttiInvokableType", "!TList&", "ttbThumbBottomDisabled", "THTTPResponse0", "ResetZoneLimits", "TEnumChildrenProc", "epEndEllipsis", ">:>O>`?", ":5:B:J:]:e:y:", "999\\9d9", "SetBounds", ":TFormatSettings.:10", "TaskDialogForm", "procedure Sleep(const Milliseconds: LongInt);", "626g6", "TDummyClass", "081H1L1P1X1`1d1h1l1p1t1x1|1", "FileDescription", "function FileSize64(const Name: String; var Size: Int64): Boolean;", "TStreamC", "TMeasureItemEvent", "MainPanel$", "2S2f2", ";;;F;L;", "tpLower", "FLastActiveControl", "tmpbStopDisabled", "&TList.TEnumerator", "VUVWj", "D$`E3", "4TCollectionNotifyEvent", "fText", "MeasuredHeight", "32-bit", "sfButtonTextDisabled", "FOldValue", "THelpEvent", "TList&", "2A3|4b5:6", ">,>8><>@>D>L>T>X>\\>`>d>h>l>p>t>x>|>", "FMode", "8$909L9", "FLastTime", "tdnbPostPressed", "FStoreBitmap", "5-5?5M5^5r5", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;", "Controls", "SelText", "spoVertical", "5?6M6", "TProc`'@", "TCustomStyleServicesClasshjW", "EOverflow ", ";&;-;J;N;s;", "btnEject", "?L?~?", "claForestgreen", "5,5A5R5Z5h5}5", "AssignResource", "FRemoveThreshold", "<4k>y>", "TScrollBarStyleHook", "TNewProgressBar", "D$$PW", "UhGzY", "6b6f6", "tgDropDownButtonDisabled", "scBottom", "1TCollectionNotifyEvent", "TThemedToolBar", "ktscToolPopup", "Ph>", "AEnabled", "4$474E4W4l4x4", "poDefaultSizeOnly", "GETSHA1OFUNICODESTRING", "Uh*ac", "6\"7,7:7E7", "TPSProcRec", "Invalid image", "tlBottom", "SafeArrayCreate", "~i9}5", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4i4z4", "vaInt16", "QTArray>", ";@=Y=d=", "PrevVisible", "TrailingLineBreak", "TabRight", "< <:T?t?", "b'us-ascii", "RecSize", "Title", "b7=9=", "NumTypeEntries", ":Q:a:", "T", "Fatal exception during installation process (%s):", "GETSHA256OFSTREAM", "InnerExceptions", "838A8S8b8j8|8", "=\">8>N>]>k>z>", "8\"828B8R8b8r8", "$vg$7rr", "Listh", "CommandLinkGlyph", "file error (-1)", "1$1(1,141<1@1D1H1L1P1T1X1\\1`1d1h1l1p1}1", "WindowTextDisabled", "FGG9v", "Setup.SpawnCommon", "; ;0;8;@;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", ":r;{;", "7-7C7T7c7k7y7", "kwbTray", "UhMHr", "Uh{jf", "System.UIConsts", "FInternalCredentialsStorage", "isRS-???.tmp", "QtFOu", "GetChecked", "Compression.Base", "272Q2", "tcpBackground", "tlExpandButtonNormal", "= =4=<=M=^=f=t=", "62797r7m8", "FMousePresent", "BaseType", "TypeData", "TNewButton6", "fDataSize", "Center", "saClient", "8>8F8N8V8^8f8n8v8~8", "sTjlR", "CertWrongUsage", "TSeStatusInfo", "ReplyMessage", "7 7$7(7,7074787<7@7M7d7z7", ".NET Framework CreateAssemblyCache function failed", "1%2H2p2", "FHeapBase", "nTEnumerable>x?g", "ENetURIClientException", "6,7u7y7}7", "FVcl.WinXPanels", "December", "tiAnd", "System.Net.URLClient", "tbCommandLinkHot", "7)7=7E7S7a7q7", "ValueFromIndex", "1.1G1X1j1}1", "`TEnumerator>(", "0\"000C0W0n0v0", "RegOpenKeyEx", "<$<,<4<<<@(", "An attempt was made to access WizardForm before it has been created", "FOnThreadStart", "4TEnumerator(", "0TEnumerable'", "InGroup", ".TArray", "FromAnsi", "qps-plocm,ar", "2>2R2a2", "0(000>0Q0e0", "LicenseAcceptedRadioClick#", "claDarkcyan", "kmgMaxRestore", "tsHorzCenterStretch", "ElementSize", "Uh2tS", "FProcessHandle", "DisplayVersion", "SecurityChannelError", "=7=E=U=m=", "MenutFA", "@HH;E", "1 1(1,1014181<1@1D1H1L1P1T1p1", "FEncodeTable", "RemoveTransparency", "989\\9", ":*:?:W:_:g:o:w:", "GetShortPathNameW", "3n5z5#6", "Uh)/d", ";/<:> ", "AllocStringAsAnsi", "TCustomGestureManagerPJQ", "function SaveStringsToUTF8FileWithoutBOM(const FileName: String; const S: TArrayOfString; const Append: Boolean): Boolean;", "#TEnumerator", "FHorzScrollBar", ":U:l:", "cbGrayed", "OnDialogConstructed\\oG", "Headers error", "DeleteFile", "C @2i", "FFrameCount", "?(?2?lpX", "9,9I9_9p9~9", "prAdmin", "ExPos", "Y_^[]", "TScaledGraphicDrawerClassP", "TCustomMultiSelectListControl", "<%<6TObjectDictionary", "<+<;TList.TEnumerator", "ShellItems", "3&3N3x3", "sfTreeItemTextNormal", "Issuer", "AccelTable", "Current&", "6-6E6d6}6", "TDebugMode", "2j4~4", "5X6\\6`6d6h6", "erCouldNotCallProc", "TextAlign", "0N1V1a1h1x1", "August", "3#343B3Y3g3z3", ";';<;J;\\;t;", "ttTabItemRightEdgeHot", "4#454L4Z4j4|4", "2,303\\3l3p3t3|3", "9#9?9`9", "6\"646D6L6Z6l6", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$5$Intf`'@", "TTaskDlgTimerEvent", "Delete302", "Ph@ld", "FPreviousHotItemIndex", "0.1P1", "#oRU_c", "2%262Q2]2n2", "0;0U0", "ComboLBox", "kwscToolWindow", "sfRadioButtonTextPressed", ": :$:(:,:0:>:F:X:j:|:", "StreamToBackup", "444<4J4\\4{4", "p(FCOu", "8B8F8m8t8{8", "userinfoserial", "FOnSettingChange", "kttdsPressed", "tdnbPriorPressed", "ktfCategoryPanelGroupHeaderHot", "9@;V;Y.ParrayofT", "skCaption", "VariantChangeTypeEx", "PRQhd", "FDefListProc", "TSeColorButtonObject6", "> >$>(>,>0>4>8><>@>M>b>y>", "HasLargeComponents", "crEqual", "TAlignInsertBeforeEvent", "claLemonchiffon", "lzmadecomp: %s", "6\\7c7N.TValueEnumerator", "FOnDebug", "FWaiters", "FSecondaryShortCuts", "VWideString", "AQuery", "TPointerStream?", "t=HtO-", ">F?M?u?y?}?", "6.7H7", "tmPopupCheckBackgroundNormal", "7(7x7|7", "OnClick", "SysSetRedraw", "FRequestedSize", "twHelpButtonNormal", ">5?e?u?", "VarI4FromStr", "FPasswordPage", "ChangeScale", "kmgNone", "Cannot utilize 64-bit features on this version of Windows", "9V^W?]i", "function ModifyPifFile(const Filename: String; const CloseOnExit: Boolean): Boolean;", "Failed to create destination directory", "khscHintWindow", "AutomaticDecompression", "2=2c2", "FOEMConvert", "FPerformingShowingChanged", "&Help", " ", "tmPopupBorders", "TSeActiveBitmap6", "Failed to get a non empty installation \"AppId\"", "5'555=5K5]5o5w5", "ktbmVertBoth", "TManagedField", "function WizardSelectedComponents(const Descriptions: Boolean): String;", "3#303", "ChunkName", "5#5'51595A5", "Worker Thread - %s #%d ThreadPool - %p", "6#636E6T6h6", "function RenameFile(const OldName, NewName: String): Boolean;", "777?777~666~777~777~666~777~666~777~777~666~777~777~666~777~777~666~777~777~666~777~777~666~777~777~666~777~777?", ">_!&$", "7(7A7]7s7", "0U0k3v3", "5 5(585V5Z5", "ktfWindowTextDisabled", "?%?7?", "8=8]8", "PWideCharL", "FRealFieldOffsets", "forRefuse", "? ?.?6?D?R?d?l?z?", "FAlphaBlend", "TCustomStyle", "Vcl.StdCtrls.", "kkk_|||", "NewLeft", "7G7K7r7|7", "ttTabItemBothEdgeDisabled", "Trace", "4,5I5", "Creating or opening the key.", "FFileMaskWStr", "GetWindowRect", "WinHttpSetCredentials", "Winapi.PenInputPanel", "Winapi.MsCTF.PkgHelper", "TMonitor.TWaitingThread", ")TArray8", "BevelOutert:Q", "Uh3.j", "GlobalLock", "kbscSpinPlus", "function EnableFsRedirection(const Enable: Boolean): Boolean;", "TTask.ExecuteReplicates$ActRec(", "Portable Network Graphics", ";g;{;", "9F9Z9", "TScrollEvent", "575?5W5_5c5y5", "YZXtm1", "Failed to load bcrypt.dll", "Compression.bzlib", "BeveledLabel$", "=$=+=2=9=@=G=N=U=\\=c=j=q=x=", "0$020:0H0T0", "iso8859-8", "Registration failed:", "2 2$2(2,202>2F2N2`2z2", "SetWideString", "Invalid variant type", "ValueName", "TUnitType", "75889H9", "claSienna", "82898f8", "UhKJo", "2 202@2P2`2p2", "FNameHash", "2:2A2H2O2V2]2d2k2u2", ")262U2", ":!;K;R;m;q;u;y;};", ";S|t@", "9 9$9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "SO122bI", "JTDictionary.TPairEnumerator(", "8!8)8C8M8W8l8}8", "CHENu", "Uh^MJ", "ReadFile failed (%d).", "*>>>S>k>s>{>", "$TPair", "BitmapChanged", "LastError", "FActiveForm", "Pulse", "TypeIndex", "^5hu9", "Unexpected custom DestName", "262D2S2n2", "Vcl.StdCtrls-", ">%>6>F>X>k>", "FConstraints", "u#3x=\\64M", "tmcNavNextHot", "G(v!o", "@_^[Y]", "Uh:oY", "DTQueue.TEnumerator6", "?0?D?c?", "EResNotFound", "IOleInPlaceUIWindow", "_^[YY]", "%u.%.2u.%u", "ecEdgeHighLightColor", "UhB#n", "8&8=8R8`8w8", ">Q>d>q>", "CookieManager", "tbsBackground", "EnumChildWindows", "[Unknown]", "HTTPStatusText", "ETDictionary.TItemArray", "dmRun", "cp1361", "QTDictionary.TItem", "TEditCharCase", "CloseQueryFunc", "TDirect2DBrushd", "ComboBoxItemHot", "4;4~4!5", "7<7L7P7T7\\7d7h7l7p7t7x7|7", "5+6^6", "1V2a2x2", "twHorzScrollHot", "<$<,<=7F7N7V7^7f7n7", "959=9g9k9o9s9w9{9", "PointerInList", "rd5w;", "EWriteError", "HRESULT", "FButtonInactiveForegroundColor", "ProcNo", "7TList.TEnumerator5", "DTDictionary.TItemArray", "TOwnedCollectionI", "FFilter", "484@4d4h4l4", "Skipping.", "TThreadPool.TSafeSharedInteger", "7*7:7H7Y7g7}7", "OnDockOver", "23/]fv", ";P\\~!", "545^5", "FButton", "ShowScrollBar", "525U5|5", "kcscRadioButton", "cspc775baltic", "FileTypeIndex", "TSeBarItemInfo", "7-7@7H7V7d7", "Uh/:r", ":\\:b:", "CHARRANGE", "1=1p1", "TTextFormats", "TSeTrackBarClass", "radiusY", "UnRegisterStyleHook", "EnumFiles(RegisterFile) raised an exception.", "0&080M0g0", "FindNextPage", "989H9d9", "FThemeDataForDPI", "kgfaTopRight", "1E1L1S1Z1a1h1o1v1}1", "tcbNo", "TSePanelButtonDrawState", "%s expected$%s not in a class registration group", "kbdsNormal", ",$YXZ", "4K5W5\\5h5m5y5~5", "THTTPSecureProtocols", "ReadDateTime", "Detected previous %s install? %s", "0,000L0\\0d0l0t0x0|0", "DstClip", "Rotate90_1", "4'454C4[4i4|4", "UhG]P", "JTDictionary.TValueEnumerator", "Uh?Xt", "ifUnused1", "GetSystemTimeAsFileTime", "TThreadPool.TControlFlag&", "FFormats", "6D7H7L7P7T7X7\\7`7d7h7l7p7t7", "TOnExtractToHandleProgress*", "csFreeNotification", "TThemedComboBox", "RmShutdown", "Button", "819B9P9^9", "TComboBoxStrings", "clGray", "TPSCustomDebugExec", "=4>C>K>\\>", "<+<93B3F3J3N3", "1\"161J1^1r1}1", "APreviewHeight", ".TEnumerableH", "KTDictionary", "H~~vaa", "TLinkLabelStyleHook8", "GetUtcOffset", "tttBalloonStemDownCentered", ",>0>P>\\>`>d>h>p>x>|>", "kgfaCenter", "FModalResult", "IsWindowVisible", "FChildControl", "%?gbb", "=!=>=H=R=Z=b=h=|=", "6*696O6d6t6", "7(818", "tkSet", "teClock", "Comparand", "tbRadioButtonCheckedNormal", "CreateSize", "tcbCategoryChevronOpened", "?0?E?S?d?}?", "SxJ)St", "FDebugMode", "y@'P&", "TSysLinkEvent", "thHeaderDontCare", "ControlTop", "FLicenseAcceptedRadioP", "MaxLen", "7(7b7g7|7", "3&393G3[3h3p3~3", "3%3<3J3a3x3", "OnThemeChange", "2.393K3", "csNeedsDesignDisabledState", "9Z94:L:x:", "=TEnumerable", "939A9P9`9x9|9", "SelectPalette", "ValidateDirEdit", "ComponentName", "twFrameRightInactive", "t$4;u", "Publisher", "TPatternManagerN", "FShutdown", "Vcl.StdActns", "ImportPrivateKey", "FDrawing", "TInterfaceListEnumerator8", "PaletteValues", "?(?g?k?", "iso8859-15", "-TCollectionNotifyEvent", "claMidnightblue", "FFreeCount", "?*?/?=?B?G?S?X?]?i?n?z?", "FVertUpState", "HotImageIndex", ">Z>j>w>", "SlicesPerDisk", "HasChildren", "8%848T8X8o8v8}8", "GetIndexedProperty", "Splitter", "kebcLeft", "ExtractRawDataNoCopy", "[TDictionary.TPairEnumerator", ">%>*>?>|>", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$11$Intf`'@", "TMessageListener`'@", ";,;M;T;s;", "InMenuLoop", ":%;/;9;?;I;W;a;p;t;|;", ";j", "; ;$;(;,;0;", "Decimal", ">1>U>z>", "UTF8String", "teTaskDialog", "tdnbNextHot", "7#7+737;7C7b7w7", "Setup.ScriptDlg", "SignFlag", "8Z9u9", "TInStream", "fdoCreatePrompt", "EPNGInvalidFileHeaderLM^", "GetThemeForDPI", "7\\7`7d7h7", "tbPushButtonNormal", "250327000000Z", "_CERT_INFOp", "macarabic", "cArgs", "2&2=2", ":TSetupHeader.:2", "&", ":TEnumerable>'", "GetThemeInt", "0%030?0N0c0o0", "FEllipsisPosition", "3m4{4", "FOnKeyNotify", "1)1=1Q1Y1g1z1", "?)?;?N?b?", "6.6W6|6", "))),...C...M+++B***+", "ControlDestroyed", "GetContentEncoding", ";1;9;U;];a;w;", "Reserved", "< <$<(<,<4<<.TEmptyFunc`'@", "8+898G8X8`8n8", "oleaut32.dll", "9=:b:q:", "Bitmaps", "9)9<9Y9u9", "StatusDrawPanel", "FTopXYLimit", "SelCount", "BtnSize", "FResource", "TRttiStringKind", "TStrongRandom: BCryptGenRandom failed (0x%x)", "TNOperationResult", "Constant", "OnGetSiteInfo\\oG", "TElementMargin", "tsArrowBtnDownHover", "1$1]1s1", "claDimgrey", "EnumClipboardFormats", "7*787K7a7|7", "PageNameLabel$", "8%8-8?8C8G8[8p8~8", "AStartAt", "373?3M3]3k3", "IsInvalidTime", "/Text", "DrawTextOption", "EAggregateExceptionL$e", "9M9r9{9", "DTObjectDictionary", "ExtCreateRegion", "999A9a9h9t9", "ScrollBox", "FAuthor", "879O9q9", "ClassInfo", "btnEdit", "FLicenseNotAcceptedRadioT", "function CallDLLProc(const DLLHandle: LongInt; const ProcName: String; const Param1, Param2: LongInt; var Result: LongInt): Boolean;", "GetMonitorInfoW", "AddParameter", "?0?8?@?H?P?X?`?h?p?x?", "CurStepChanged raised an exception.", "8'828D8", "Quoted", "3$4i4", "cTSparseArray>;", "mbMiddle", "FYesRadio", "function CreateDownloadPage(const ACaption, ADescription: String; const OnDownloadProgress: TOnDownloadProgress): TDownloadWizardPage;", "=;=I=]=q=", "group", "Phl2v", "SingleBufferingInRemoteSessions", "rtIcon", "Assertion failure", "erCannotImport", "1.161[1", ":\";+;", "runas", "C0A05", ";0;?;U;];z;", "FExpression", "FParentBiDiMode", "?@?w?", "iso_8859-6", ">2>H>P>^>q>", "MessageBeep", "NewDPI", "Ancestor", "TSeWindowHitTest", "8 8$8(8,8084888<8@8D8L8i8w8", "Uhq#Z", "5.6<6N6", "VOleStr", "ktfPopupMenuItemTextNormal", "Setup.InstFunc.Ole", "claPurple", "tcpThemedChevronClosedNormal", "64-bit helper EXE wasn't extracted", "BeginBufferedPaint", "=%=-=;=M=[=c=q=", "GetEnhMetaFileHeader", "4(4:4T4b4q4", "OnKeyNotifyPiX", "GetInt", "tmMenuBarItemDisabledPushed", "curMultiDot", "trSlipperVertHot", "gUEyi", "=5=O=h=", "ContainsControl", "5\"6A6", "function PageIndexFromID(const ID: Integer): Integer;", "FillRectangle", "313W3z3", "'IEnumerable", "0!0%0E0L0S0]0", "ExInfo", "8X8e8t8", ";\";&;*;.;:;O;];p;", "tkWString", "AThumb", "TTaskDialogBaseButtonItem:", ":3;h;", "TabDrawItem", ">\">9>N>V>d>t>", "Basic", "bkTile", "teBackgroundHot", "FOnMessage", "?1?B?V?^?o?y?", "@K:FKv", "5\"5b5", ":7:;:V:Z:v:", "elType2", "GETSHA256OFUNICODESTRING", "ktfTabTextActiveDisabled", "4 4$4(4,4044484<4@4D4H4L4d4u4y4", "AMPM ", "TCustomDecompressorClass", "kwhtCaption", "UhLlS", "csOwnerDrawVariable", "function FindWindowByClassName(const ClassName: String): HWND;", "SignHash", "teMonthCal", "1$151N1_1q1y1", "5.5?5]5", "TProcedureParam", "FPasswordEditLabel", "tsUpperTrackHorzPressed", "TUxThemeControlBarElementsD", "Uh66l", "D$8Pj", "ActionUpdateDelay", "GetAction", "8,848B8T8f8n8|8", "BalloonHint", "5$6?6F6X6", "%s%s%.2d:%.2d", "6)6?6W6_6m6~6", "TPSExec&", "VLongWord", ";9;=;`;p;x;", "FFonts", "ADelay", "3'3>3L3_3v3", "MovEBP_ESP_1_89", "GetSystemColor", "?&?.?>", "4 414?4G4U4d4", "UhJd`", "InsertNewLineBefore", "AsText", "TMessageManager", "0$0;0I0`0w0", "GETUILANGUAGE", "coCheckWithChildren", " i", "TComponentStyleItem", "<,<0.TItemArray", "0(0@0x0", "OnRedirect", "WNetOpenEnumW", "=%>B>e>z>", "7*7B7J7X7k7z7", "bsBox", "LookupRoot", "kwbdsPressed", "Saturday", "$TList", "001E1S1e1t1|1", "clGhostwhite", "%s[%d]", "9$939D9f9j9", "saMostLeft", "LastReportedProgressMax", "HTDictionary.TKeyCollection;", ">3>;>L>Z>b>p>|>", "-TDelegatedComparer", "FHeadIndex", "3#3+333;3C3K3", "PInstItem", ";+;F;a;w;", "clDarkcyan", "OnStartDrag3", "iso_8859-9", "tTDictionary.TValueCollectionl1M", "skMenuBar", "lpszMenuName", "REGDELETEKEYIFEMPTY", "9\"909>9R9Z9k9y9", "AccentColorInactive", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$6$Intf`'@", "Uh?Bf", "FHelpKeyword", ":$;4;8;<;D;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "RegDeleteValue failed (%d).", "UnaryOp", "FHorzSliderState", "igTwoFingerTap", "User chose not to shutdown applications using our files.", "808>8N8a8s8{8", "ThemesAvailable", "TDuplicates", "5)5S5a5", ",TList.TEnumerator(QF", "Create2", "vaInt8", "cTDictionaryD6M", "CaptionAlignment", "kbdsDefaultHot", "0!1X1h1l1p1x1", "6 6$626D6V6g6w6", "464`4{4", "8'8/8=8M8[8s8{8", "System`", "*TEnumerator(", "FInBufferAvail", "EOSErrorl", "<7<;.TKeyCollection8", "TScrollBarStyle", "ssVertical", "NextVisible", "CHYZ[", "6V7j7", ":3:T:x:", "kbdsDisabled", "Windows 2000", "tcDropDownButtonHot", "TWICImage&", "0$0,040<0@0D0H0L0P0T0X0\\0`0d0h0l0p0x0", "=?=d=t=|=", ",bold", "TreeItemTextFocused", "0TList.ParrayofT", "procedure Extract7ZipArchive(const ArchiveFileName, DestDir: String; const FullPaths: Boolean; const OnExtractionProgress: TOnExtractionProgress);", "3G3[3o3", "TCertificate", "sfListItemTextDisabled", "TScriptTable", "FindGesture", ",TEnumerable'", "ftDouble", "ShowHint`^V", "saBottomLeft", "Vcl.CategoryButtons", "(0D0_0{0", "ImmSetOpenStatus", "1'1/171?1G1O1y1}1", "=:=S=t=", ":0;9;", "FlatSB_EnableScrollBar", "161C1", "3'393A3O3^3q3", "1=1c1", "fsModal", "<&=N=~=", "!ValidateServerCertificateCallback\\9h", "5D5O5p5", "GetBytes", "tlCollapseButtonPushed", "<8A?v?", "Shared.CommonFunc.Vcl", "cspc8codepage437", "&Ignore", "6 6,63696B6^6i6r6~6", "twSmallMaxCaptionActive", ";';D;L;i;u;", "505Q5u5", "454`4p4x4", "fdoPathMustExist", "sbaRollPanel", "5'5C5M5U5c5q5", "tpPageRoot", "RaiseLastException", "BitmapButton", "7$737?7M7\\7g7y7", "Current@", "TPSError", ":;:`:x:", "94;k;s;~;", "/INITPROCWND=$%x ", "NIndices invalid", "TRttiObject", "efTopRight", "eVcl.Forms", "function InstallOnThisVersion(const MinVersion, OnlyBelowVersion: String): Boolean;", "tdnbFirstDisabled", "7.8<8J8U8n8", ":P(t&", "303>3Q3g3|3", "wMinute", "MaskedAngles", "function SetupMessage(const ID: TSetupMessageID): String;", "LockResource", "ExistingFlags", "AsVariant", "WindowGetTitleRect", "=.=<=M=d=i=t=", "FWriteRecursionCount", "FScrollWnd", "RL+PD", "2TList.TEnumerator5", "TseBitmapList&", "L0P0T0X0f0t0", "Put301", ":/:@:S:[:i:|:", "0D1I1\\1", "kwscDialog", "}owuue", "TCheckBoxStyleHook8", "91:h:", "=+>4>", "6&6C6K6[6_6", "DroppedDown", "757C7V7f7v7", "RegisterSysStyleHook", "GetLoginCredentials", "FOnGetActiveFormHandle", "1 1$1(1,1014181<1@1D1H1L1P1T1X1e1", "iso-ir-149", "TPoolToken&", "saCenter", "TPSOnSetNVariant", "DoubleBufferedModeXHA", "FTypes", "Uh2]J", ">D?k?", "Exponent", ":$:0:4:8:D:L:T:\\:`:d:h:l:p:t:x:|:", "ActiveBitmap", "=TEnumerable'", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$46$Intf`'@", "FAttributeGetter", "tbCheckBoxImplicitHot", "kppSolidVert", "ShouldHideHint", "4(5P5]5p5", ":$:(:,:4:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:}:", "9 9(969K9X9`9p9", "TRttiInstanceProperty", "Cannot get class object", "tnBackButtonNormal", "RemoveChunk", ";TDictionary.TValueCollection", "System.Math", "3 3$3(30383@3H3P3X3u3", "\\x]xM8Y", "Keys<", "Variant is null, cannot invoke", "95:@:J:_:", "Unknown architecture '%s'", "0$0(0,040<0@0D0H0L0P0T0X0\\0`0d0h0l0p0}0", "9!9%9)9-9195999=9A9", "828M8}8", "TRegKeyInfo", ":TDictionary.TKeyEnumerator", "Group2", "585H5L5P5X5`5d5h5l5p5t5x5|5", "ArchitecturesInstallIn64BitMode", "=+=B=P=`=s=", "ReadMultiString", "(IEqualityComparer`'@", "0%0C0~0", "3D3T3u3", "teEditTextFocused", "Ht4HtC", ";&;G;O;k;s;", "=1=H=P=^=q=", "AutoCheck", "claMoccasin", "FrameCount", "TBitmapCanvas\\", "7 7$7(7,70747<7i7x7", "TRttiManagedField", "9z'B_Q", "FScrollPos", "TAlphaFormat", "csDesignInstance", "2$23272L2T2m2u2", "tdnbFirstPressed", "<\"<&<*<.<2<67>", "HandleU", "scPosition", "RegisterTypeLib", "Marked uninstall display name to avoid duplicate entries. New display name: %s", "kmicNormal", "GetPackages", "twVertScrollPushed", "RTPair>", "5!5>5d5t5|5", "TRequestRegisterServerData", "bstrDescription", "D$lUP", "5O6t6", "Droppedx", "YTDictionary.TValueEnumerator,", "?A?H?}?", "4Z4p5M6a6", "WindowGetButtonRect", "npbstMarquee", "function WizardIsTaskSelected(const Tasks: String): Boolean;", "pszHelp", "FShortCut", "TFile", "]TEnumerable>'", "%IEnumerable", "AsBoolean", "Sh,><>", "Item1", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$26$Intf`'@", "FClassImporter", "99:\\:*;S;l;", "function CreateInputFilePage(const AfterID: Integer; const ACaption, ADescription, ASubCaption: String): TInputFileWizardPage;", "FImageType", "454=4E4M4`4u4", "c6?Bwk", "tmShow", "4 4$4(4,4044484<4@4M4h4p4x4", "claDarkred", "SetCurPage", "X _^[", "Thursday", "EEncodingError(&B", "<#<,<;", "!ASSIGNED", "tclHeaderItemNormal", "cd32Bit", "t$Ht=HtV", "FStartOffset", "ReadStyle", "DebugEnabled", "mj>zjZ", "MACHINE", "1J1v1", "VTEnumerator>X", "FMonitorNum", "twMDICloseButtonDisabled", "cspc862latinhebrew", "kmgSubMenuGlyph", "ParentBackground", "<3", "?6?k?", "ulVal", "FromMilliseconds", "NTDictionary.TValueCollection;", "8H8L8x8", "doOwnsKeys", "ttHotGlyphClosed", "dllname", "FOnBackButtonClick", "claTan", "9c9r9", "tbCheckBoxCheckedPressed", "SVWUj", ";%<8h", "7'767M7g7u7", "OnlyBelowVersion", "CreateNamedPipe", "TSetupTypeOptions", "wc6n{", "ptMaxPosition", "TPropFixuph", "FClient", "0+1K1T1z1", " index ", "?%?5?E?W?t?", "{}xMw", "UhPMD", "UhsCn", "?,?:?J?\\?l?", "sfGridItemNormal", "CaptionTextInactive", "TWizardPage8(", "Collection", "OnClose\\oG", "iso-8859-11", "\"TEnumerable", "C,YZ^[", "8 8L8", ">(>;>C>Q>_>s>", ":(:0:>:Q:^:f:t:", "AutoLineReductionXmG", "Collisions,MX", "twCaptionSizingTemplate", "FAlgorithmHandle", "function GetUninstallProgressForm: TUninstallProgressForm;", "TSeGroupSubclass", "FOnActivate", "251124160438Z0?", "DELPHICLASS TTask; /* __interface */ ITask; DELPHICLASS TAbstractTask", "?7?{?", "FOnClickCheck", "6*6j6E7", ";!;.;B;Q;h;", "FEvent", "TMBCSEncoding&", "OnMessage\\oG", "0#01090G0T0x0|0", "TThreadPool.TBaseWorkerThread@0e", "0TEnumerator(", "8(8@8N8\\8h8w8", "VTDictionary.TItemArray", "CompType", "get_accState", "asSuspended", "ttTabItemDisabled", "FBtnUpDetail", "Uhl{O", "DrawOverlay", "", "sfGridItemFixedNormal", "ImageName", "626<6@6`6p6t6x6", "HorzLeftRect", "iso8859-13", "_SYSTEMTIME", "btnPause", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$11$Intf`'@", "GenericGradientEnd", "INITIALIZEBITMAPIMAGEFROMICON", "=%=-=5===S=", "3*31383?3F3M3T3[3b3i3p3w3", "FExtractedArchiveName", "1 1@1T1n1", "euctw", "'IEnumerable", "WriteBOM", "FProgressGauge<", "TInputFileWizardPage", "GetTempFileNameW", "NewFolderButton", "=)>0>f>n>w>", "272?2M2]2k2", "4 464G4Z4k4~4", "tmbMenuBandRoot", "Uhf&^", ";C$tI", "5$5,545<5D5L5T5m5", "Sleep", "clDarksalmon", "OnObserverAdded|^H", "1&141<1J1X1w1{1", "IsDrawingLocked", ";Y;h;", "Failed to list directory.", "~1J6-U", "fFeatures", "sfWidth", "pszButtonText", ":%:):>:E:L:S:Z:a:h:o:v:}:", "PopupMode,", "FMenuImage", "?,?4?Y?~?", "commonappdata", "clNull", "Uh\\Ir", "tfTop", "Uh=jM", "4 4'4.454<4C4J4Q4X4_4f4m4t4{4", "Marlett", "twMaxButtonDisabled", "181m1", "3f3j3", ";%;,;3;:;A;H;O;V;];d;k;r;y;", "GetDpiForMonitor", "Uhm8G", "wrFocusedWindow", "1+1<1{1", "fvNone", "ttbSplitButtonDropDownHot", "3\\5i5~5", ":TTaskDialogForm.:1", " AMPM", "1P1v1", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$37$Intf`'@", "FHintWindow", "7.787=7^7h7m7", "Spawning 32-bit RegSvr32: ", "|dl|7", "FValueCollection", "Amount", ">B?R?", "7*7[7b7y7", "FShowInTaskBar", "@TList.TEmptyFunc`'@", ":\":):3:7:Z:^:", "THeaderValueList.TItem", "CryptDecodeObject", "SCALEX", "EVariantUnexpectedError", "TMouseButton", "Winapi.D3DCommon", "tspTopMatch", "ExceptionString|", "TFavoriteLinkItemsEnumerator;", "0 0$0(0,0004080<0@0D0H0l0", "1.2.13", "tpTransparentBarNormal", "TSysButtonStyleHook", "EntryCount", "TEnumerator(", "&TList&", "BitTransparency", "GetCurrency", "8%8-858=8Y8l8t8", "=j>!?", "Setup.Helper", "<&=/=5=:=J=R=j=s=y=~=", "UnfixString", "BrowseButtont", "]TArray>", "TDPIContextService", "RedrawWindow", "tdbDateBorderDisabled tdbShowCalendarButtonRightNormal", ";S<_'", "THTTPDataReceiverD", "FPaintBufferUsers", "Phd5x", "BiDiMode@CA", "szInfo", "9)919@9k9o9", "tpPanelBevel", "?", " TEnumerableh(X", "=!===R=w=", "4,4=4h4v4|4", "[Window Title]", "TabGetClientRect", ";2L>l>", "9!949C9U9h9p9~9", "2@2a2", "ufWizardDarkStyleDark", "4@5G5X5\\5`5d5h5U6", "IInArchive`'@", "\\P=FP*", "hpAutoFromBottom", "1!2%2)2-2125292=2A2E2I2M2Q2U2Y2]2a2e2i2)5v5", "ttsControlLabelDisabled", "8 8$8,84888<8@8D8H8L8P8T8X8\\8`8d8h8u8", "FEncoding", "twHorzScrollNormal", "3,3:3K3n3|3", "ttdExpandoButtonNormal", "FScreenSnap", "ITDictionary.TKeyEnumerator;", "FRootKey", "Unsetting NTFS compression on directory: %s", "566E6M6\\6", "5&545C5Z5m5~5", "TObservers", "AlignRect", "Creating or setting the value.", ": :$:,:F:Y:a:p:", "TWinHttpLib%", ";XXt%", "0:0>0E0_0c0j0y0", "Operation aborted(Exception %s in module %s at %p.", "OEM_CHARSET", "ARequest", "/SECONDPHASE=", "'TList.TEmptyFunc`'@", "TokenString", "DeleteSelected", "7,7>7B7\\7f7", "CTCollectionNotifyEvent", "?YZ^[", "Unregistering 64-bit type library: %s", "ttdContentPane", "ReleaseIcon", "Success", "2TList.TEnumerator5", "4%4;4I4Y4j4", "InfoBeforeClickLabel", "UhOub", "kebcUpDown", "tagSTATSTGH", "1(1,1P1[1`1k1p1{1", " TEnumerable'", ":TWICImage.:2", "FDrawTextProc", "wsMinimized", "FMDIClientInstance", "4/5F5W5]5l5|576", "ButtonHide", ">D>T>\\>d>l>p>t>x>|>", "2)383_3\"5&5*5.52565:5", "RegEnumKeyExW", "4$444<4D4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "Entry", "maLeftToRight", "*TEnumerator", "Uh#\"n", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "Notebook", "SetThreadPriority", "o399i9", "FLeft", "ImageList_GetBkColor", "TMethodImplementation", "3#3'3D3T3\\3d3l3p3t3x3|3", "D$(Pj", "All rights reserved.", "5%535D5R5Z5h5{5", "FImageAlignment", "DrawCustomTitleBar", "7\"7P7\\7`7d7h7p7x7|7", "FLinkControl", "< =<=M=_=s=", "TBase64Encoding&", "RegView", "7(7@7D7d7t7|7", "LParamFiller", "Locked", "TSeWindowButtonDrawState", "5 5%51565B5G5L5X5]5b5", ")TList.ParrayofT", "WinHttpSetStatusCallback", "889H9L9P9X9`9d9h9l9p9t9x9|9", "6>6`6d6", "SaveToFile", "9'9;9`9h9p9x9", "FTestLib", "FloodFill", "pszObjId", "2(2<2M2b2p2", "=3===A=`=l=p=t=x=", "sfCategoryButtonsSelected", "CursorHeightMargin", "FScaleFactor", "cAccelEntries", "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;", "EPNGInvalidPalettehL^", "GridItemFixedPressed", "(TList.TEmptyFunc`'@", "DefaultIme,MA", "FInternalPopupParentWnd", "&", "2TList.arrayofT", "CheckOnce", "LeftScrollBar", "Uh9zO", ";&;.;6;>;F;N;V;^;f;n;v;~;", "0%0-0;0I0W0_0m0", "Radio item cannot have disabled child items", "ICryptoGetTextPassword`'@", "7n7;8", "=*=@>", "EDirect2DException", "^^bVIb", "z$Z$cti~wqd", "4&6-6R6V6Z6^6b6f6j6n6r6v6z6~6", "162F2", "8;8`8", "FOnShareViolation", "kwhtTop", "FPopupControlWnd", "ttbTaskBarRoot", ": :$:(:,:0:4:8:<:I:", "l6qnk", "rgvarg", "SendDataCallback", "BitmapHotL\\r", "immett", "; ;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "6TDictionary.TKeyEnumerator", "GetThemeDocumentationProperty", "Address", "THandleStream", "9 9+92989@9J9Z9b9j9", "0!0?0`0t0", "T;mt=", "ABuffer", "ktfListItemTextSelected", "Install was done in 64-bit mode but not running 64-bit Windows now", "cpMax", "OleMainThreadWndClass", "TEnumerable'", "ActiveForm", "%TEnumerable'", "3 363B3]3", "TFormState", "sfButtonTextNormal", "TObjectDictionaryM", "\"TEnumerable'", "TMetafileImageL", "Inno Setup 6.6.0", ":\":1:L:\\:", "tfExternalLeading", "1#1;1U1o1", "ReadLine", ":':@:o:", "1S1u1", ">2>J>h>z>", "tbHorizontal", "=G?P?", "FFallbackWnd", "9!9/9<9V9", "RmRegisterResources", "FPrevAppDir", "6E6h6", "CredentialsStorage,", "ksscSplitter", ":TDictionary.TPairEnumerator", ";2;G;U;l;", "Winapi.KnownFolders", " TList.TEmptyFunc`'@", "2(202A2W2h2{2", "UhUPt", "8$8W8", "FDirEdit", "iTDictionary>.TValueCollection", "Uh[UR", "1.161H1]1a1y1", "xCompression.SevenZipDLLDecoder", "LongTimeFormat", "0 0$0(0,090P0e0m0", "tis620.2533-1", "RootName", ";P;w;", "fsSurface", "utf-16le", "AutoLineReductionp", ">S>h>v>", "D$T;C@", "vaNull", "mvPublished", "FGrabbersOnTop", "ttdMainIcon", "8*8@8S8a8t8", "UhVkd", "Download is not using basic authentication", "twSmallFrameLeftSizingTemplate", "function SuppressibleTaskDialogMsgBox(const Instruction, Text: String; const Typ: TMsgBoxType; const Buttons: Cardinal; const ButtonLabels: TArrayOfString; const ShieldButton: Integer; const Default: Integer): Integer;", "3=3S3n3", "GetDlgCtrlID", "5 5G5m5", "TTitleBarPanel", "IgnoreImages\\oG", "TRttiInterfaceType=", "4 4'4>4B4F4a4", "ecGradientColor1", "ACookieURL", "FWindowState", "GetRequest", "IsEmpty4", "Uhs8c", "EOutOfResources", "64-bit install mode: %s", "UhfFD", "SetStretchBltMode", "CaptionRect", "Stage", "<.9L9c9k9y9", "IsX86", "CreateOutputMarqueeProgressPage", "6\"6&6B6J6h6p6", "4TList.TEmptyFunc`'@", "Winapi.RichEdit", "WindowFromPoint", ">A>S>", "272V2u2", "RunProcPN", "1#131", "2 2$2(2,2024282<2@2D2H2V2^2p2", "Error obtaining session handle", "K,)Kl", "tspSoftwareExplorerFocused", "FormatMessageA", "OnChange", "wifJpeg", "?+?J?", ":*;o;", "Commit", "GetControls", "AArea", "2$222B2P2h2p2~2", "8,9X9", "HintDraw", "ShowingHint", ":E:L:S:Z:a:h:o:v:}:", "&T\\RZ", "FAverageCPUUsage", "FPressedImageName", "4'484L4T4e4s4{4", "UpdateMetricSettings", "0*080L0Y0a0o0", "tdnbDeleteNormal", "80878>8E8L8S8Z8a8h8o8v8}8", "?%?0?5C5Y5~5", ".TKeyCollection;", "1Z1k1", "ttItemNormal", ":+:B:J:X:k:{:", "L6Mel", "505=5E5V5e5m5{5", "PRQhD", "1'151H1Y1p1", "FOnOverwrite", "Uh{+R", "FStyleFileName", "UnlockRegion", "Run as: Current user", "y|RprY", "tcpThemedChevronOpenedNormal", "303j3n3", "TBytesStreamh", "1$131<1L1T1c1l1", ":Xqui", "TInputDirWizardPage6", "get_accHelpTopic", "FTypesCombo", "FDropDownMenu", "FEdits", "IArchiveOpenVolumeCallback`'@", "ImageList_Create", "Software\\CodeGear\\Locales", "ECompressInternalError", "tagDEC", "PerformUninstall", "(]_^[", "HideHint", "151Z1", "TUninstallLog&", "TInteractiveGestureOption", "8]_^[", "3+3>3Y3d3o3", "clDarkslategray", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$3$Intf`'@", ";';/;L;T;u;};", "=5=<=Q=X=", "Post302", "7,747B7P7d7z7", "[%s] ", "TSysEditStyleHook7", "ListL(O", "ttItemSelectedNotFocus", "CreateResFmt", ">+>@>N>a>w>", "WindowDraw", "1)1>1T1p1", "tsThumbBtnHorzHot", "twHorzThumbNormal", "invalid distance too far back", "FStepOverStackBase", "ktmiWindowDialog", "RVPQW", "TArray", "JTDictionary.TValueCollection", "ScrollWindowEx", "+TCollectionNotifyEvent", "FClientHandle", "Uninstallable", "Sectigo Limited1.0,", "SetSecurityDescriptorDacl", "t$j2h", "<0!rt", "6&6.666>6F6N6V6^6f6n6v6~6", "AEntryCount", "FShowMainForm", "ufDontCheckRecCRCs", "85999`9g9n9u9|9", "twSysButtonPushed", "TPasswordEdit6", "cspc850multilingual", "tsVertCenterTile", "tnNavigatrionRoot", "?$?,?H?L?P?T?X?\\?`?d?z?", "ktscToolWindow", "FDragKind", "bsHorizontal", "TStopwatch", "FillStyle", "TArchiveOpenFileCallback", "LNN2>>N6", "Invalid string length", "claLightslategray", "NewTarget", "=->B>P>d>z>", "DwmIsCompositionEnabled", "OnDataFind", "zh-HK,zh-Hant,zh", "FTokenPtr", "ssMiddle", "TWriterT,H", "]TDictionary", "tebHeaderBackgroundPressed", "pmNotXor", "FGroupBrowseButton", "8&8.868>8F8N8V8o8", ">[>p>~>", "SetStyle", "TStyleManager", "TThread", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$4$Intf`'@", "ACanEnumerate", "8*868", "en-us", "7$7f7j7", "TStrongRandom: Failed to get address of BCryptGenRandom", "GetThemeBackgroundExtent", "D$DPV", "4!50585H5n5r5", "GetDataSize", "iso-8859-3", "TerminateThread", "2TList", "Rstrtmgr.dll", "1`2o2", "ExtractAt", ":TWinControl.:1", "UhJ=c", "EControlCx", "ttlTextLabelNormal", "1#161S1a1q1", "FServerCertificateAccepted", "<,=5=", "System.Generics.Collections<", "8'888@8P8h8l8", "ZTDictionary.TKeyEnumerator", "EInsufficientRtti", "Destroying", "TScriptFunc`'@", "ButtonPressedBackgroundColorpHA", "tpDownPressed", "ButtonRollup", "This \"Portable Network Graphics\" image is not supported because either its width or height exceeds the maximum size of 65535 pixels.", "ThumbVertRight", "= =3=I=v=", "lTDictionary.TKeyEnumerator;", "InitializeFont", "DeleteCriticalSection", "TAbstractTaskT=e", "PRecord", "FScaleBy", ";<$s&", "2uM0O", "bs-Latn-BA", "FString", "taAlignTop", "PanelDraw", "2&2L2m2", "GetUserNameW", "ktbdsDisabled", "<'", "2 2U2y2", "AOpenArray", "TPSCallingConvention", "FormatCount", "060W0w0", "macromania", "TBevelStyle", "9$929:9H9V9j9r9", "FInArchive", "ttTabItemNormal", "FUseDockManager", "Uht[o", "<4<<>W?d?q?", "868L8_8z8", "1'141<1M1\\1d1r1", "claDarkgreen", "=$=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=m=", "Failed to set NTFS compression state (%d).", "GetInt64", "&TSysToolbarStyleHook.TSysToolbarButtonH", "OnCardChangeL", "z>", "Bounds", "IdispatchInvoke", "caMinimize", "SelectedTasks", "9b:i:", "kcdsCheckedDisabled", "TUninstallLog", "FColorDepth", "TPSTypeRec_Record(", "939D9X9`9q9", "SetWindowPlacement", "474j4", "FExt1", "RegEnumValueW", "=4=D=H=L=T=\\=`=d=h=l=p=t=x=|=", "EInOutArgumentException", "ttbTaskBandDontCare", "8#81898G8U8i8q8", "REGQUERYSTRINGVALUE", "GetTypeNo", "t$0WS", "TImeMode", "User chose %s.", "FCustomTitleBar", "===l=", "2I3l3", "cyBottomHeight", "ImageList_GetDragImage", "6!6%6)6-6165696=6", "?!?3?;?I?V?h?", "FMMaped", "RH;CL~", ")TList.ParrayofT", "FOnKeyPress", "tmSystemCloseNormal", "NotifyRestartRequested", ":P:^:k:s:", "sfListItemTextSelected", "8c:p:", "Attempting to restart applications.", "FAsyncHandle", "ControlName", "TSeListSubclass", "3F4+5K5", "!IEqualityComparer`'@", "<($9u", "152x2", "@e u<", "6!696G6Z6j6z6", "IsMemoDefined", "Spare", "stfTextColor", "TCustomDockFormd,[", "{,+{4;", "7R8q8", "131D1W1", "5-585H5L5P5X5`5d5h5l5p5t5x5|5", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$ActRec", "FWaitQueue", "RPYZ]_^[", "TThemedMenuBand", "3w3", "ktfHeaderSectionTextPressed", "BeginPaint", "teBackgroundDisabled", "http://ocsp.usertrust.com0", "function InitializeBitmapImageFromIcon(const BitmapImage: TBitmapImage; const IconFilename: String; const BkColor: TColor; const AscendingTrySizes: TArrayOfInteger): Boolean;", "AMenu", "*>F>h>p>x>", "HelpFile", "FTouchControl", "TSeStyle&", "Uh;=V", "tsThumbBtnVertHot", "AAllowAllCharsAboveFF", "StringSplitEx", "function CurrentFilename: String;", "fbase", "7<8W8l8", "tmcGridBackground", "", "TRttiIntfMethParameter", "TOrphanPackage&", "kbbdsNormal", "0L1[1", ":8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "Successfully created the key.", "=8=]=", "?$?(?,?0?8?@?D?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?", "9$9<9D9R9b9p9", "kECDSA", "btnFirst", "?.?4", "AddzTXt", "Uhm'V", ",italic", "TConversion", "? ?G?Q?t?", "FDestroying", "> >$>(>,>0>4>8><>D>L>T>", "Sl+S\\", "ControlAtPos", "1L1Y1", "clCyan", ")TEnumerable'", "2)212?2M2a2o2", "T$4+C", "6*:0:6:<:R:X:^:d:]=", "8'8N8z8", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$12$Intf`'@", "WTDictionary.TKeyEnumerator", "AutoPopupXmG", "3C4K4k4t4", "2-272K2", "tsArrowBtnRightHot", "FFileNameLabel", "TSimpleStringList'", "TSequentialOutStreamC", "FmtMessage", "NumSubKeys", "ISequentialStream`'@", "4 4(40484@4H4P4X4`4h4p4x4", "5!595Q5i5", "ARABIC_CHARSET", "FAutomaticDecompression", ":;;Q.", "?(?9?L?]?r?", "252T2n2|2", ":6;d;", "UpdateFrame", "RegisterStyleHook", "5>5l5", "WizardImageBackColor", "AbortedByUser", "?4?8?9l9~9", "OpenThemeData", "=0=U=`=h=", ".TList", "IsTabDefined", "BuildUp", "StrictDelimiter", "HintGetClientRect", "; ;$;,;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;", "546F6Y6", "RichEditViewer$", "nPage", "FListInstance", "1F2f2}2", "PositionH", "1#111>1O1g1u1", "SetSpinCount", "csDropDown", "WinHttpConnect", "TEnumerator(", "FieldTypesL", "kIsNotArc", "<3=I>", "tkFloat", "Angle", "FIsMetropolisUI", "9\\:w:~:", "TSize", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$21$Intf`'@", "VDate", "EInvalidCast", ";TDictionary.TValueCollection;", "NTEnumerator>(", "6:6H6\\6x6", "AnEnd", "FMaskedBorder", "DesignOffset", "RemoveItem", "S<;tX5", "HelpKeyword", "Uh+h\\", "ProcessLocksList", "#IEnumerable", "OnExit", "InfoBeforeText", "", "SENDMESSAGE", ":N:c:t:", "SetChars", "tmMenuBarBackgroundInactive", "PasswordEdit", ">'>5>A>P>f>", "=/>I>}>D?l?|?", "commoncf32", "SHAutoComplete", "clDimgrey", "soReference", "OpenKey", "< <$<(<,<0<8<<<@.TKeyCollection", "TRttiInstanceFieldEx@1F", "SnapBuffer", "Failed to delete directory (%d). Will retry later.", "1(1:1L1T1b1p1}1", "FResultFP", "\\TEnumerator>(", "PThreadInfoD", "8*838", ".0=0P0T0c0v0", "kbbdsHot", ": :$:(:,:0:4:>;E;j;n;r;v;z;~;", "Refresh", "8!888P8T8", "?W?o?", "3$323@3H3V3e3s3", "clLightgoldenrodyellow", "7#7*7H7_7j7|7", "9F:~:=;n<", ">\">0>D>O>S>e>", "3 3$3(3,303=3S3h3", ";(;:;H;X;`;n;|;", "656L6d6u6", "sfButtonTextFocused", "3TList.TEnumeratord", "#IEnumerable", "EVariantInvalidArgError", "FSpaceDown", ".TList&", "InitializeWizard", "StandardGestures", "WinHttpQueryHeaders", "ssAlt", ">$>8>P>X>f>y>", "/ALLUSERS", "AFileName", "PSafeArray", "t f;J", "IsStatic", "GetFont", "Pitch", "7C7J7Q7X7_7f7m7t7{7", "5(5O5t5", "7!7(7e7", ",TList.TEnumerator@Ke", "FHotButton", "DVCLAL", "DisabledStyle", "4$4.4I4h4", "laXor", ":N:|:", "'u);7~%", "S`_^[Y]", "%System.Classes", "claYellowgreen", "= =$=", "TRttiArrayType", "0IEnumerable", "SetOle2MenuHandle", "lmOverwrite", "ATList.TEnumerator@", "FTextMarginRightStretch", "FMaxLimitWorkerThreadCount", "< <$<(<,<0<=(", "TThemedSpin", "949I9h9", "8 8$898Y8y8", "=\"=-=>=J=R=p=", "CurrencyString", "&TList.ParrayofT", "EXTRACTFILENAME", "TList", "<#`'@", "TThemedToolTip", "EIntOverflow", "8/838Z8d8", "4*484I4l4z4", "FormatSettings", "RegisterVirtualAbstractMethod", "FExtendedViewerList", "GTList.TEnumerator", "isPaused", "TRegister32", "FMinWidth", "TNewProgressBarStyle", "=3=D=L=Z=g=|=", "function TrimRight(const S: String): String;", "Windows 7", "4(4D4s4~4", "ForegroundColorpHA", "; ;a;e;", "HorizontalPositioning", "D$4;D$", "FOnIdle", "'TCredentialsStorage.TCredentialComparerD", "?TList.ParrayofT,", "UhYPN", "030D0^0o0", "AppendLine", "kgfaBottomRight", "UhC)v", "SavedFatalException", "3 3<3X3t3", "Format", "TSeCheckSubclass", "Could not set permissions on the key because it currently does not exist.", "khdsPressed", "CompressionMethod", "*IComparer`'@", "Canvas does not allow drawing#Text format flag '%s' not supported8Invalid image frame index %d: there are %d frames (0-%d)", "/TList.ParrayofT", "function FileOrDirExists(const Name: String): Boolean;", "MINIMIZEPATHNAME", "TFindItemKind", "function SetCurrentDir(const Dir: String): Boolean;", "FDroppingDown", "APreviewWidth", "Using %s", "FIconHandle", "GetClasses", "TActionListEnumerator", "AExtension", "TCustomComboBox6", "Uh]6\\", "4 4$4(4,4044484<4@4X4j4n4", "BitmapFocusedL\\r", "9 9$929D9T9k9", "accSelect", "teFlyOut", "FShowCaption", "EditBoxTextNormal", ";9 >(>6>D>[>n>v>", "fkShortCut", "Level", "4$44484X4_4f4p4", "0 0(00080@0H0P0X0`0h0p0x0", "3 3$3(3,3034383<3@3D3H3L3P3]3", "6IComparer`'@", ":$;+;C;G;K;O;S;W;[;h;", "Origin", "ITArray>", "&Username", "ktxaTopCenter", "TList&", "0\"181I1]1e1v1", "PCurrency", "?0?N?\\?n?", "Command", "tmpbPauseNormal", "2-252K2`2n2", "FFocusControl", "FOnProgress", "9+9O9u9", "SelectedImageName", ",TList.TEnumerator5", "ChangeNotification", "dbmRequested", "UhGv_", "1?1p1", ">/>>>P>_>q>", "too many length or distance symbols", "DoThumbPreviewRequest", "twVertThumbPushed", "8#8-878A8K8U8_8", "UhP0D", "TTransparentMode", "OnSourceLine", "COPYFILE", "2(2>2L2[2l2", "Could not find page with ID %d", "OrgName", ":.:A:", "newlineLength", "TRttiRecordMethod", "UhIdo", "twSmallFrameLeftActive", "TOriginalParentCalcType", "UhYnp", "gb2312", "Uh#7f", "TWizardPage", "AddEx", "kspcDisabled", "8)828D8L8T8", "SetParams", "ParentBiDiModeChanged", ";W;d;q;", "CurrentPath", "-TEnumerable", "9%9P9g9q9}9", "CurrentProcParams", "UhfEF", "TCustomGestureEngine,QQ", "TInputQueryWizardPage", "jycmSS", "CALLDLLPROC", "#TArray", "FOnMouseActivate", "Ellipse", "IsEmptyL", "function GetEnv(const EnvVar: String): String;", "eP7Ef", "klgCustom", "? ?$?(?,?0?4?8?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$2$Intf`'@", "748s8", "0l7p7t7x7|7", ":*:8:G:^:q:", "TRegGroupsx7I", ";';/;7;?;G;O;W;_;g;o;w;", "7 8h8", ";3.TEnumerator", "9 9$9(90989@9o9", "525>5", "stream end (1)", "TBasicActionLink7", "SETINIBOOL", "Registered", "FillColorsAndFonts", "Error connecting to server: %s", "ElementSize,", "7!7/7B7_7m7", ">$>6>", "FHeight", ">0?4?[?e?i?", "CheckCardVisible", "function GetExceptionMessage: String;", "<&=L=U=", "dwWant", "FFontFocused", "TTask.ExecuteReplicates$0$Intf`'@", "FFrameIndex", "function LoadStringsFromFile(const FileName: String; var S: TArrayOfString): Boolean;", "313J3R3Z3b3j3r3z3", "4 4F4h4", "FOnCloseQuery", "DockOrientation", ">'>8>M>\\>x>|>", "'TList", "31484O4S4W4[4_4c4g4k4o4", "FImageChangeLink", "lB\"?A?k?", "8#969", "Parameters: ", "`TEnumerable>", "ttbDropDownButtonPressed", "IsObserving", "WriteAnsi", "FReplacementZone", "saTopLeft", "6O6]6e6s6", "AutoFree", "L0P0T0X0\\0`0d0h0l0p0t0x0|0", "3P3`3h3l3p3x3|3", "2[3|3", "csAligning", "OnEnumerateControl", "NTDictionary.TValueEnumerator;", "6!646m6q6", "9+9P9|9", "0)0-0N0R0t0x0", "csReadingProps", "OnContextPopup\\oG", "VAnsiString", "tkString", "RegData", "ItemFromClass", "DrawEdge", "GlassSessionId", "B>H>V>f>l>r>x>", "twCloseButtonPushed", "TThreadLocalCounter", "GetSysColor", ";(;5;=;K;X;j;|;", "8#848H8Y8f8n8", "TChunkClassHk^", "AThreadPool", "9!919?9W9_9m9}9", "ttbSeparatorVertNormal", ">ScriptFuncLibraryRegister_R.RegisterMessagesScriptFuncs$ActRec", "FOwnerInterface", "oO|@+", "WelcomeFontSize", "TCustomStyleMenuElements", "ShowLines", ">[?}?", "'TList&", "GetValues", "rkLeft", "9:D1k", ": ;.;A;l;z;", "8j8|8", "FActionComponent", "FindType2", "PreparingErrorBitmapImage$", ". %s range is 0..%d", "AppName", "TPropSetK", "Failed to set permissions on the key (%d).", "TArray", "FPropName", "FTransparentSet", "6&6w6", "function GetUILanguage: Integer;", "FMaskValid", "&IEnumerable", "GetGestureList", ";';N;w;", "IsSplitterTransparent", "kwhtCloseButton", "*TList.TEnumerator", "R0H;E", "FHotImageIndex", "PATCH", "EOleSysError8bP", "OnException<", "FMinLimitWorkerThreadCount", "Cannot find utCompiledCode record for this version of the uninstaller", "ParentTabletOptions@EQ", "Attrib", "ttbDropDownButtonDisabled", "System.AnsiStrings", "ISADMINLOGGEDON", "GetCurrentDirectory", "TPicture.SetGraphic$0$Intf`'@", "`.data", "fPPUnitX", "C`+D$", "55595?5Z5s5", " C<^[", "kHeadersError", "91959Q9s9", "=#=0=E=I=`=j=n=", "151g1", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes", "TInputOptionWizardPage5", "pfArray", "SysColors", "6(7a7", "5'595", "TSeScrollAreaClass", "TRect", "sbsHover", "A1_d`p", "1+191G1]1v1", "claSlategray", "FOuterNotebook", "Spawning 64-bit RegSvr32: ", "SetReal", "7 8,8084888@8H8L8P8T8X8\\8`8d8h8l8p8t8x8", "Cannot install files to 64-bit locations on this version of Windows", "?(?9?N?c?z?", "Skipping due to \"onlyifdoesntexist\" flag.", "The password you specified is not correct. Please try again.", "TActionListState", "8@9|9", "> >(>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>y>", ">$>`>", "ntdll.dll", "StrToInt64", "claTurquoise", "102F2]2", "varStart", "IsLastChild", "HelpCommand", "FMonitorThreadStatus", "THelpManager&", "3)3>3L3T3c3l3", "3<4a4", "invalid window size", "SYSTEM\\CurrentControlSet\\Control\\Terminal Server", "ThumbHorzBoth", "Uhy,K", "1#2O2", "+F\\;D$", "EAbstractError", "TFieldsCache", "Append", "FDuplicates", "2U3p3", "6@7^7|7", "TSeDockInfo", "ktigCheckGlyph", "1A1N1_1", "101F1W1e1m1~1", "=;=U={=", "AChunk", "itCheck", "UhF%n", ">7>X>_>7???I?O?Z?j?u?", "%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u ", "5 5(50585@5H5P5X5`5h5p5x5", "XTDictionary.TPairEnumerator", "<\"<@", "FONTEXISTS", "+TList&", "4Setup.Uninstall", " deflate 1.3.1 Copyright 1995-2024 Jean-loup Gailly and Mark Adler ", "TChildFormMessageHandler8", "2(2C2K2S2[2c2k2s2{2", "8+8B8P8c8z8", "Out of string range", "9-9D9R9i9", "2-2;2S2[2i2y2", "KeyOnly", ">/?N?", "FSecureProtocols", "FindString", "393]3", "RegisterStyleClass", "Duplicates", "TFieldExEntry", "clDarkkhaki", "kwhtBottom", "2.323Y3c3g3", ">3n!m", "&Password", "Start extracting archive %s to %s. Recurse subdirs? %s", "EncodingName", "twSmallMaxCaptionDisabled", "InsertMenuW", "TClipboard'", "?;?b?", "7!7/7D7[7_7z7", "I0G0E", "OldChar", "FDataLength", "FPrevPoint", "Failed to expand \"", "FFormFocusChanged", "Currentl", "9.9?9S9[9l9z9", "5; Q~", "9i:m:q:u:y:}:", "363l3", "=ScriptFuncLibraryRegister_R.RegisterInstallScriptFuncs$ActRec8Om", "Failed to delete the file; it may be in use (%d).", "DesktopWidth", "0#0J0T0X0x0", "4@5P5X5`5h5l5p5t5x5|5", "SectionLast", "TValidateCertificateEvent", "7\"787M7[7m7", "kwhtHelpButton", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX", "kmgTray", "0)010?0N0d0v0~0", "SAVESTRINGSTOFILE", "3/3=3P3f3w3", ":TDictionary", "CustomTitleBar", "8 84888L8P8\\8`8d8h8t8x8|8", "FDecompressor", "vaUTF8String", "1(1<1@1\\1l1p1t1|1", "Uh5pJ", "TCustomMemo", "9\";B;_;k;p;|;", "7G8\\8j8", ";nP>T>X>\\>`>d>", "0x3|3", "Lazyx", ",TEnumerable'", "5.5I5d5", "< (", "VerticalOffset", ":%:,:>:H:Y:", "_DARK", "Uhi!i", "Uh^7p", "teBackgroundWithBorderFocused", ")TEnumeratortNX", "MsgLabel", "FHDownState", "7<7p7", "5(6q6", "TWindowHook", "TElementAlias", "636A6T6X6b6y6", "-TList.TEnumerator", "9http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#", "BUTTON", "AddRef", "3TDictionary&", "TEnumerable'", "GetBit", "PaintTo", "REGWRITEMULTISTRINGVALUE", "FCertificateList", "FBufEnd", "<)<7", "alRight", "GetWindowLongW", "0,010", "858Z8h8w8", "LParamHi", "HeightXHA", "FIsDWMEnabled", "/NoRestart", "SetProgress", "Exclusive", ":;;;;;;;;<<<<<<<<<<<<<<<<<<<<<<<<<", "TCallConv", "2 2$2(2,2024282<2@2D2H2L2Y2p2", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$18$Intf`'@", "5&6*6.626@6N6Z6h6", "AddClass", "+TList.TEmptyFunc`'@", "< <(<0<8<<<@.ParrayofT<", "!NOTIFICATIONVARIANTSET", "FActiveFont", "kmdsFocused", "VarBstrFromCy", "-TEnumerable'", "ListGetClientRect", "?3?@?F?Y?g?v?~?", "607a7z7", "AGroupClass", "8&9+9X9", "E$PWV", "Shared.SetupTypes", "TSeStyleColors<", "AUserName", "#TEnumerator", "3\"3B3F3f3j3", "FPanningWindow", "virtual void __fastcall AddStrings(TStrings* Strings)/* overload */;", ":.;2;Y;c;g;", "UhOVG", "status", "BTDictionary.TKeyCollection", "5Q6|6", "clKhaki", "=ScriptFuncLibraryRegister_R.RegisterInstallScriptFuncs$4$Intf`'@", "FCheckListBox", "IsScreenFont", "FAsMethod", "ttsTrackOffNormal", ";(;:;P;a;", ":\":::k:", "TSeTrackSubclass", "%Dd5LT`", "PeekMessageW", "7$757E7[7q7", "vaLString", "GridDrawItem", "opaque", "4\\5g5", "FAsyncCallbackEvent", "8 8$8(8,808=8W8n8", "TStackPanelControlItem", "MaxValueLen", "PixelsPerInch", "FOnMouseUp", "6(6,60686@6D6H6L6P6T6X6\\6`6d6h6l6y6", "TRttiArrayType;", "FSendDataCallback", "tdnbEditHot", "ecTextShadowColor", "Convert", "TPicture.ReadData$ActRec", "9@:R:s:w:{:", "pvData", "2+2>2L2^2s2", "Uhb_b", "FDragIndex", "TPropIntfFixupC", "414<4R4X4n4t4", "ttbTrackBarDontCare", "smj-NO,smj,se", "<>", "TDragObject6", ">6?@?", ";C@uW", "UpdateCapacity", "twSmallFrameLeftInactive", ":J:j:p:", "skFMXGlyphButton", "cfTaskDialog", " TCustomEdit.ObserverAdded$ActRec", "teMenuBand", "SelectTasksLabel,8^", "ucs-2", "8 8.8>8P8`8h8v8", "kWinapi.PsAPI", "FOnSelect", "VTEnumerable>", "FCurrentCol", ":-:5:M:U:v:~:", "AControl", "PList`", "mS_HJ", "> >3>;>I>T>g>}>", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$14$Intf`'@", ";BPt(", "FOpenRefCount", "tfPositionRelativeToWindow", "Uh(DO", "GETSYSWOW64DIR", "@ScriptFuncLibraryRegister_R.RegisterBrowseFuncScriptFuncs$ActRec", ")TList&", "mn-MN,mn-Cyrl,mn", "8*898@8L8P8T8X8`8h8l8p8t8x8|8", "&IEnumerable", "7\"7U7", "6]6d6", "GlowSize", "GetModuleHandleW", "<<.TItem", "tttCloseHot", ">!>)>7>J>Y>m>", "hWndInsertAfter", "'TList.TEmptyFunc`'@", "<'<,<1<=", "twMDICloseButtonHot", "ssMinimized", "8V9{9", "232Z2a2h2o2v2}2", "ASection", "_TEnumerator>", "6;6J6R6d6", "TMessageEvent", "Argument must not be nil#Unbalanced stack or queue operation", "THintInfo@", "FTicks", "TBevelEdge", "1,101P1`1h1p1x1|1", "Uh'ng", "CurUninstallStepChanged", "TComboBoxStyle", "IsManaged,", "505h5p5{5", "FDragPos", "XTDictionary.TValueEnumeratorP", "imSHanguel", "function RmSessionStarted: Boolean;", "9(:T:u:", "FCurrentPopupID", "FReadyMemo", "tsUpNormal", "7(797N7\\7r7", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$0$Intf`'@", "tmMenuDropDown", "4]_^[", "000w0", "5 515E5W5}5", "ActiveCardIndex", "EFileStreamError", "424@4Z4l4z4", "2n`b[", "FOldCount", "SetCapture", "EndBufferedAnimation", "DaylightDate", "VarArrayGet", "RaiseError", "TFileExtractor.DecompressFile: Negative size", "929D9U9k9", "GetElementContentRect", "tcpThemedChevronOpenedPressed", "PUInt644", "The existing file appears to be in use (%d). Retrying.", "tePassword", "StrLength", " ", "2c3g3k3o3}3", ";3=E=L=S=Z=a=k=o=", "9'9/9=9R9i9q9", "FMouseDeltaY", "TBasicAction6", "69Bo;", "odNoAccel", "WizardBitmapImage$", "ProxyAuthRequired", "GetDateFormatW", "h>/]G", "CanEnumerateControl", "Exception \"%s\" at address %p", "TValueType", "IFileDialog", "GetTickCount64", "index", "RightToLeftReading", "ReadString", "TNewStaticTextStyleHook8", "4%5)5P5Z5^5|5", "PsjBa", "FinishedPage,5_", "FMovePos", "010R0s0", "9 9$9(9,90989q9", "FTabStop", ";b;0", "TStyleTextFlags", "8\"8*828:8B8J8R8Z8b8j8r8z8", "SetInputScope", "GETVERSIONNUMBERSSTRING", "Invalid stream format$''%s'' is not a valid component name", "Monitor", "tspOpenBoxHot", "matrix", "AdjustLinkLabelHeight", "DestFile", "BitmapPressedL\\r", "HintWindowClass", "FVertScrollWnd", "DoISSigVerify: Invalid SourceF / SourceFS combination", "tdnbPriorNormal", "TBasicRichEditOleCallback", "fdTruncateExisting", "TRACE", "3*3<3R3`3o3", "4)444H4[4l4", "FDragTargetPos", "AHandle", "? ?(?0?8?@?H?P?X?`?h?p?x?", "ttTopTabItemLeftEdgeNormal", "", "889l9", "PasswordChar", "TMonitor.PWaitingThread8$@", "TDragImageList", "LoadFromStream", ">I?t?", "(:{Ykgg\\", "FindProcResource", "CompareExchange", "GetCurrentThemeName", "TSysBidiModeDirection", "OnMouseWheelDown", "teScrollBar", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$0$Intf`'@", "iso-ir-58", "9-9C9X9f9x9", "\\W6/i", "fdoNoValidate", ";4;I;W;j;", "9(9,9L9\\9d9l9t9x9|9", "TCustomCheckBox6", "TThemedCategoryButtons", "iaTop", "EInvalidGraphicOperation0", "FLicenseAcceptedRadio", "AChunkLength", "RunStringFunction", ":O;q;", "OnLogFmt4", "TUxThemeStyle&", "expand:", "LazyWrite", "ITDictionary.TKeyCollection", "ufPowerUserInstalled", "HelperGrantPermission: Invalid entry count", "HasAttribute", "ReadSignature", ":+:;:M:`:y:", "%s-%d.bin", "S-1-5-18", "ValueCount", "5&545C5T5~5", "TFieldsCache&", "Msctf.dll", "0=0J0W0i0", "PRQh4", "TReaderProc", "Q,GWV", "ACanvas", "TPopupMode", ";!;4;I;M;h;", "TInterfaceListH", "tbCommandLinkGlyphDefaulted", "Invalid symbol '%s' found", "csisolatin4", "141X1}1", "9C9p9w9", "Vcl.WinXPanels:", "393T3X3\\3`3d3h3", "BDSUnthemedDesigner", "AlphaBlendValue", "FDefaultIme", "7 8+868=8d8", "FClassTab", "ASourceStream", "=!=)=p=", "2 2$2(20282@2w2", "fonts", "\\\\?\\UNC\\", "sbVertical", "ufAdminInstallMode", "FValues", "IsTrackDefined", ">'>;>C>T>b>j>x>", "!0n#e`k", "ListX", ";'<0", "VirtualQuery", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$20$Intf`'@", "clSlateblue", "FWheelAccum", "Ownerships", "REGQUERYMULTISTRINGVALUE", "IsArm32Compatible", "TThemedToggleSwitch", "[TEnumerator>(", "System.Masks", "FAsUWord", "0W#2G=", "8'8P8j8w8", "FHintWindowQueue", "GetKeyInfo", "ISSigVerify", "IComparer`'@", "ktigRadioGlyph", "TAsyncFunctionEvent", "CurrentKey", "SetTimer", "zQzTt}", "DataType", "FPopupMode", "314Y4s4", "tcCueBannerHot", "System.Generics.Collectionsx\"P", "TSeWindowSubclass", "FScrollBoxSize", "%Sectigo Public Time Stamping Root R460", "VirtualIndexX", "TProgressEvent", "DaylightName", "*TEnumerable'", "TProxyAggregateStreamP", "ProcessMessages", "Uh0Vk", "TSysUpDownStyleHook", "Parent", "8#9V9", "Action", ";d2>8>H>P>X>`>d>h>l>p>t>x>|>", "oShared.SetupEntFunc", "kpbdsHot", "> >(>0>8>", "3A[H#", ";0(>8>@>H>P>T>X>\\>`>d>h>l>p>t>x>|>", "tlExpandButtonHover", "8-9:9V9]9|9", "< <$<(<,<0<4<8<<<@+>3>A>P>f>{>", "484L4", "PostQuitMessage", "ktfStaticTextHot", ">D>;?j?", ";D$Tw", "TFilex", "ReadValue", "323H3j3{3", "TDragObjectH&Q", "=5=X=", "t ;^dt", "Failed to proceed to next wizard page; aborting.", "3$3,343<3N3c3t3", "5Y5]5", "FLastBoundaryWrited", "CompareStringOrdinal", "TAssemblyCacheInfoT", "TSeHeaderSubclass", "tsSizeBoxHalfTopRightAlign", "BTDictionary.TItem", "Uh%og", "MonitorDefault", "TokenComponentIdent", "=9=c=g=", "RegECX", "Invalid argument8String index out of range (%d). Must be >= %d and <= %d", "FNextIn", "0A1h1o1", "4.4E4S4d4|4", "soBeginning", "TDefaultLoginCredentials", "claFloralwhite", "5,5;5Q5`5l5z5", "FDefault", "tsSpinDontCare", "&op_UnaryNegation", "FQueues", ":TTaskDialogForm.:4", "FActionList", "D$ VP", "TBiDiMode", ")TEnumerable", "pAsmInfo", "btnApplyUpdates", "?#?5?C?U?]?k?", "9!:4:h:", "&0E0L0g0", "#< Ti", "ktfTreeItemTextHot", "gtRegistered", "Put302", "FMBoxTextHot", "Count", "kbxdsNormal", "NewLimit", "PrevSystemTimes", "GETENV", "TLZMA1Decompressor", "IPropertyStore::SetValue(PKEY_AppUserModel_ID)", "@`@t%", "NameFld", "System.Win.ComConst", "TScaledGraphicDrawerM", "1m2q2u2y2", "UhLUK", "VariantInit", "ttbThumbBottomFocused", "function MsgBox(const Text: String; const Typ: TMsgBoxType; const Buttons: Integer): Integer;", "LookupPrivilegeValueW", "paLeft", "QQQQQQQSVW3", "zh-TW,zh-Hant,zh", "Vcl.Direct2D", "ktisRightMiddle", "7 7$7(7,7074787<7@7D7H7L7P7T7X7f7n7", "TSeTextOrientation", "ContainsObject", "MouseWheelHandler", "}l`aa", "tmcGridCellBackgroundSelected", "Q\\FOu", "859e9", "485E5", "5(505>5Q5k5", "TPSStringList%", ";5;P;l;z;", "&TList.arrayofT", "9;9j9", "tsSizeBoxTopLeftAlign", ";+.TPairEnumerator;", "VertScrollBar", "TResourceStreamZ", "GetDeclaredProperties", "7/797`7t7", "Invalid CompID", "S ^[Y]", "5,5F5J5b5", "GetState", "6,6=6S6l6z6", "1&1-141;1B1I1P1W1^1h1", "XTDictionary>&", "e:q0&", "000C0K0Y0g0~0", "windowBits", "ResetChildren", "teTextLabel", ":%:-:5:=:E:M:U:]:e:m:u:}:", "ReadStringAsUtf8", "506p6Z7j7", "\"TEnumerable", "FInstallingPagep", ":*:l:i;", "2-2G2U2h2z2", "", "Identifier expected", "tsUpHorzPressed", "ExceptAddr", "=%=2=:=H=U=g=y=", "TFileTypeItem", "TPropSetP9D", "OnExecute\\oG", "ControlID", "Bitmaps,", "?(?6?C?U?b?j?x?", "./szy", "IsX64", "TBevell_V", "HasElementFixedPosition", "ChangesAssociations", "?(?8?Q?f?t?", "OnKeyDown", "iaRight", ":TDirect2DCanvas.:4", "<&<4", "TFileTypeItems#", "sfPopupMenuItemTextDisabled", ";TEnumerable'", "?6?|?", "0 0(0H0", "_iii/", "NewFolderButtonl", "384]4u4", "tsGripperHorzHot", "kbidsNormal", "TWizardPageStyle", "7!7%7D7T7X7\\7d7l7p7t7x7|7", "6!6;6I6X6k6", "WindowDrawText", "ttbSeparatorVertHot", "Vcl.ComStrs", "twSmallFrameRightInactive", "TSeMemoDrawState", "Uh15t", "Getting size of %s.", "SetMenuItemInfoW", "ssRight", "5;6D6H6P6d6p6", "MessageFont", "TThreadPool", "SD_^[", "GetPixel", "BorderIcons", "Width\\oG", "AInterpolationMode", "Element", "\"code\" constant with no CodeRunner", "poDesigned", "> >(>,>0>4><>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "6$6,6o6", "7 7(7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "Acquire", "tsDownDisabled", "UnsafeAttributeX!@", "TransactNamedPipe/GetOverlappedResult", ";!;/;>;F;T;d;r;", "WinHttpWriteData", "ttbThumbRightNormal", "FMenuAnimation", "6+686H6", "Uhaj]", "3.3C3Q3g3|3", "Docked control must have a name%Error removing control from dock tree", "TFileFormatsList,", "TCustomLinkLabel", "HintPos", "Ignore", "FModified", "Smallint", "tbsDontCare", "FDefaultRoundedCorners", "FWinapi.DxgiType", "MoveKey", "tfNoPrefix", ">#><>D>q>", "3TCollectionNotifyEvent", "9 9$9(9,90949B9T9p9", "9;9P9j9x9", "UhYvJ", "TCustomFileDialog6", "QQQQS", "crSizeNWSE", "5&5-545;5B5I5P5W5a5i5", "function GetIniBool(const Section, Key: String; const Default: Boolean; const Filename: String): Boolean;", "PProcRec", "System.Win.Taskbar", ">=>H>P>x>", "0,0?0M0Z0j0}0", "t:GNu", ";B\\uT", "3#313A3O3g3o3}3", "t0Htd", "L$LA+", "1 1$1(1,1:1L1c1}1", "0-0F0N0\\0j0", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:x:|:", "FOldHorzSrollBarPosition", "GetReferenceToRawArrayElement", "x.[uL", "CaseSensitive\\oG", "Windows", "Resource", "tmPopupCheckBackgroundDisabled", "ktcListBoxDisabled", "Sunday", "claBlack", "FBuffer", "csClicked", ">+><>h>l>", ">$>@>Q>h>x>", "/bJ>v", "claDarkslateblue", "TPSStringList(", "FMouseOnButton", "ktfCheckBoxTextNormal", "ResourceName", "DoneWithWizard", "claKhaki", "oN", "SV:PAt5", "VInterface", "New key created, need to set permissions again.", "FParamType", "ToolDrawItemText", "1(2T2u2", "; ;$;(;,;0;4;8;<;@;L;P;\\;`;l;p;", "clLemonchiffon", "fqDefault", "141<1D1L1T1\\1d1l1t1|1", "8!8l8", "Persistence", "VCL_STYLE 2.0x", "=+=P=", "\"z-9`", ";Xdt6", "Sectigo Limited100.", "FFilenameLabel8", "isLoaded", "TSetupForm", "=,=L=T=k=o=", "647S7", "7)7=7N7[7c7t7", "macturkish", ":!:;:I:\\:p:", "8.8>8", "THelpManager", "6$666M6[6n6", "-TList&", "/Silent", "ETDictionary.TItemArray", "GetCharCount", "TRttiInt64Type", "MethodName", ">/>Q>^>o>y>", "; ;3;F;T;f;{;", "FExportDecl", "#>5>G>O>]>m>", "6/6C6W6q6", "&!a5kYk", "maParent", "=)=/=]=", "Compatibility mode: %s (%s)", "ChunkClass", "7/7G7_7n7v7", "GetProcessDpiAwareness", "9%9C9K9i9q9", "<5<]", "{E5nC", "TImageLink&", "Setup.RegSvr", "VmtSize", "Primary", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=h=t=x=.>", "ktfRadioButtonTextFocused", "FImageIndexes", "\" constant on this version of Windows", "MoveWindow", "<0=`=", "LabelDrawText", "FStyleElements", "gu~V1", "=.=A=[=i=x=", "2%3)3P3Z3|3", ":#:7:M:Z:b:p:", "InnoSetupRegFile.%.10d", "\\TEnumerator>(", "tmpbNextPressed", "wrIOCompletion", "Setup.ExtractFileFunc", "-TDelegatedComparer8", "teBackgroundNormal", "1.3.1", "&~_zt", "IsCheckDefined", "SetSubItemFontStyle", "Uh?Po", "IsDotNetDetected: Invalid Version", "function SaveStringsToFile(const FileName: String; const S: TArrayOfString; const Append: Boolean): Boolean;", "+System.Messaging", "tfRtlReading", "Everything is Ok", "TFindComponentInstanceEvent", "FDirBrowseButton", "FScheme", "tsLowerTrackHorzNormal", "TCustomStyleGridElements8", "CreateMenu", "?l-\\Y(", "%.4u%.2u%.2u", "FTracking", "TCustomFolderTreeView", "FDisabledFont", "FModalPopupMode", "UhJ)c", "FPreviousActiveWnd", "8http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y", "GlassFrame`", "C>x>", "6%7)7-7175797=7A7E7I7M7Q7U7Y7]7a7e7i7m7q7u7y7}7", "OnMouseLeave\\oG", "CreateNewItems", "FQuoteChar", "1&141B1R1b1t1", "515F5T5f5", "5-5W5v5", ";%;4;o;s;w;", "HMONITOR", "mkClassDestructor", "2 2$2(2,20242B2J2\\2n2", "3+3D3R3i3y3", "; ;$;(;,;0;4;8;<;@;D;L;s;", "BasePtr", "TCheckBoxState", "FComponentsDiskSpaceLabel", "FFinishedHeadingLabel", "AlignDisabled", "FLockEvent", "csFramed", "ExtentRect", "AuthCallbackx", "4IEnumerable", "FOrgClientWidthAfterScale", "<&<..TPairEnumeratorP5X", "MarkAsRemoved", "6,747<7D7L7T7\\7d7l7p7t7|7", "ACommonPrograms", "0p0t0x0|0", "Empty", "TGraphic&", ";9;X;c;", "0C1^1", "707K7\\7x7|7", "Space", "0#0<0Z0b0s0", "2&232;2I2[2l2t2", "FPopupLevel", "1-1B1P1`1w1", "TThread GH", "TArray", "ExtractTemporaryFiles", "Run as: Original user", "scLineUp", "LTList>.arrayofT", "ThumbVert", "w&*QtF", "%TList&", "function CompareStr(const S1, S2: String): Integer;", "414U4\\4", "SetHintSize", "<#<+<3<;.TEnumerator", "emSizing", "0(KR^", "? ?.?D?W?e?x?", "5 5J5N5u5", "CharUpperBuffW", "teMPlayerButtons", "TShiftStateItem", "TFilters", "eB_4\\", "GetThemeMetric", "Author", "ktidsNormal", "\"TStyleManager.TStyleServicesHandle", "ExtractedArchiveName", "FCommonButtons", "7G8a8r8", "Parameter count mismatch >$>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", ":*:2:@:P:a:e:", "9K9Y9", "[Main Instruction]", "imDontCare", "0'080J0R0`0o0}0", "Will restart because NeedRestart returned True.", "f;4Ku", "Vcl.Dialogs", ";;;\\;};", "$TArchiveOpenCallbackWithStreamBackupP", "QxFOu", "StopPanning", "gsStream", "EPSExceptiond", "777H7P7t7", "515?5L5^5k5s5", "2%3[3", "S|_^[", "ksbdsPressed", "=4=D=L=T=\\=`=d=h=l=p=t=x=|=", "5&5A5W5]5q5v5|687d7q7|7", "GroupBrowseButtonClick", "SetDefaultDllDirectories", "#TThreadList&", "TPSTypeRec_Set$", "000L0d0", "FWriterID", "2 2-2>2", "?'?6?L?^?r?", ";BXr$", "issig-v2", "?,?0?4?", "Pj`Sj", "Cannot run files in 64-bit locations on this version of Windows", "SystemH", "8#8+8\\8q8", "ByRef ", "VirtualIndex", "FThemeDataUnLoading", "FOnHide", "Inno Setup: Setup Type", "BitBlt", "?(?9?T?g?", "HELPER_EXE_AMD64", "FSawFirstLine", "FByRefParam", "6#7\\7l7p7t7|7", "<+<@T", "=R=g={=", "MenuItemTextNormal", "Writing uninstaller messages: %s", "March", "D$@Pj", "?4?V?", "MTDictionary.TKeyCollection;", "OnRunLine", "TSeSectionDrawState", "DropOnControl", "GetPropW", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX", "2\"282X2", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4n4v4", "skFMXCheckBox", "TPSDebugExec&", "csSubComponent", " TEnumerable ", "utf-8", "=8=z=", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$18$Intf`'@", "RICHEDIT50W", "RegOpenKeyExW", "J%FGG1M", "Need to restart Windows, not attempting to restart applications", "IShellItem`'@", "Chevron", "EHeapExceptionX", "\"TEnumerable'", "FileSize", "ChunkCompressedSize", "&IEqualityComparer`'@", "2 2$2(252K2O2Y2a2i2", "8.TList`1.Pack[1]$0$Intf`'@", "Kl+K\\Q", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$14$Intf`'@", "= =E=S=j=", ";F\\t&", "=&=/=6=<=Q=]=z=", "uCallbackMessage", "9 :g:", "?*?(>=>]>", "AfterLoad", "<';?\\?", "Setup.MsiFunc", "bsFDiagonal", "sr-Cyrl-BA", ":,:X:m:x:", "344F4g4k4o4s4w4{4", "Uh2)t", "6$696G6_6u6}6", "Same version. Skipping.", "csActionClient", " TList", "8(808>8P8h8p8~8", "GetActiveOleObject", "TReaderT", "EnumAllWindowsOnActivateHint", "TECDSAKey", "v1.1.4322", "GetElementSize", "?SVWU", "1)1=1X1f1y1", "ASource", "QP]_^[", "?+??>L>[>j>y>", "UhY^N", "FVirtualIndex", "IsStatusTransparent", "FTransparent", "IndexOfObject", "ATComparison`'@", "Filename", "TThemedHint", "isRS-", "iso-8859-9", "?#?)?2?;?E?O?`?", "Text8", "6#6'6+6/63676;6?6C6G6K6O6S6W6[6_6c6g6k6o6s6w6{6", "<)<<(", "DispatchCommand", "313D3R3d3y3", "4/4B4J4[4p4", "TCustomControl", "FunctionExists", "FComponents", "<#>*>", ":G;f;", "UnitType", "1D1P1v1", "AAAAA", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$13$Intf`'@", "5-5L5W5", "Deinitializing Setup.", "2*292A2P2k2o2", "twVertThumbDisabled", "DimensionCounth", "dwLowDateTime", "> >1>M>[>i>{>", "TSysStyleHook7", "uz-Cyrl-UZ", ":':J:R:Z:b:j:r:z:", "VType", "0,0P0c0g0", "FPackageVer", "4,4:4I4`4z4", "sfCategoryButtonsHot", "TSiteList6", "TPadding", "0$0(0,0004080<0@0D0H0L0P0T0\\0`0h0l0p0t0x0|0", "tpDockPanelVertNormal", "&TArray", "UhHXU", "nb-NO,nb,no", "FromMinutes", "&IEnumerable", "EIntfCastError", "UheKu", "iso_8859-5", "WheelRouting", "FContextToken", "CreateFormFromStrings", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$9$Intf`'@", "#+3;CScs", "Merge", "CommonFilesDir", "FStdInNulDevice", "UhF.Z", "tgIndicatorMultiArrow", "9 9$9(9,999J9_9g9", "14181Y1]1", ":(;z;I<", "ccStdCall", "3'4M4k4q4{4", "1;1`1p1x1", "ForceQueue", "FIsChanging", "PVmtFieldClassTab", "8\"8&8*8.82868:8>8B8F8J8N8R8V8Z8^8b8f8", "2[2e2y2", "OleUninitialize", "0 0$0(00080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0", "Y0^0q0", "UhG$G", "<%<-<", "FNeedReset", "TDirect2DGraphicsObject", "<(=/=\\=", "clDeepskyblue", "Uh\\uc", "FlatSB_GetScrollProp", "FTemplateModule", "ZTDictionary.TKeyEnumerator;", "OnChange|", ">,><>L>\\>k>q>", "3>Ec{", "TMultiWaitEventImplx", "Wow64RevertWow64FsRedirection", "Fdsx1", "7&707U7d7", "FUserInfoOrgLabel`", "toggleswitch", "trGripperVert", "222C2V2d2x2", "Winapi.Imm", "6Q7|7", ";=;N;_;g;u;", "3 3$3(3,3034383<3@3D3H3L3T3l3", "7 7T7_7h7x7", "TStringList", "FProcPtr", "xMMM|", "TEnumerator>(", "5&5-545;5B5I5P5W5^5e5l5s5z5", "tspMoreProgramsTabFocused", "xPBKDF2", "TSeStyleSource", "GroupDrawText", ":(;7;J;N;];p;|;", "1-151C1X1v1", "TModuleInfo", "ZTDictionary.TKeyCollection;", "Ht?HtS", "DrawThemeIcon", "scTreeView", "2J2j2p2", "4U4i4", "D$DUP", "AComparer", "FInfoAfterMemo", "360321235959Z0r1", "TDragDockObject8", "ssPostInstall", "4)4?4P4j4n4", "ConsumeMulti", "JZ>(", "RowUsed", ">0>Q>", "FPass", "dmMainForm", "UNREGISTERSERVER", "=K>c>", "SetupType", "#TStyleManager.TStyleClassDescriptor", "5TDictionary.TItemArray", "tsUpperTrackHorzHot", "9TDictionary&", "Y[YY]", "DesktopRect", "ttTabItemFocused", "taBottomRight", "FieldOffset", "0\"0)00070N0R0V0q0", "DataStringh8B", "EN]XA)", "DTDictionary.TValueEnumerator;", "Chunks", "UhdZf", "kebdsNormal", "LicenseNotAcceptedRadioClick", "=1=9=A=I=Q=Y=a=i=q=y=", "2%2>2P2a2}2", "FOnStartDock", "TEditStyleHook", "iso-ir-144", "0.0H0V0e0u0", "Operand size mismatch", "7=8n8r8v8z8~8", "?TDictionary&", "SetRectRgn", "cyrillic", "ttbSizingBarBottom", "tsThumbBtnHorzNormal", "Failed to delete \"_unins-done.tmp\".", "FWorkQueue", "thHintNormal", "gtNone", "StaticSynchronize", "8)8.8:8?8M8R8W8c8h8m8y8~8", "Setup version: Inno Setup version 6.6.0", "FGrayscaleBitmap", "7/7E7V7i7z7", "3<3]3a3", "Uh-+r", "Touch", "TDragDropEvent", "SystemColors", "0123456789ABCDEF", "sfEditBoxTextHot", ";2;X;~;", "6TArray", "OnKeyNotify$", "tpFill", "Qh4FC", "TCard", "010T0n0", "L$ _^]", "323D3X3\\3}3", "WriteMultiString", "VertUpRect", "claLawngreen", "OuterNotebook0._", "TSeStyleObject", "<*=\\=", "6)6;6U6f6z6", "FTList.TEmptyFunc`'@", "FindCustomGesture", "999G9V9f9x9", "csTransient", "TMemo`", " t4VW", "CreateAndRegister", "0#0'0+0/03070;0?0C0G0", "FMinHeight", "TClassFinderT", "rdUnknown", "FAccess", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$23$Intf`'@", "TCustomFile=", "List index out of bounds (%d)", "TECDSASignature@", ":$:E:I:p:z:", "HintParent", "tcTransparentBackgroundNormal", "OnValueNotify", "*TEnumeratorT", "LOADSTRINGFROMLOCKEDFILE", "^9RxZ", "TDataModule6", "FCenterOnShow", "?$?G?Z?w?", "FFileTypeIndex", "TECDSAInt256 ", "TApplication", "ttbBackgroundTop", "NormalizeTopMosts", "QLGMu", "OnFindAncestor`+H", ": :$:(:,:0:4:8:<:@:N:V:^:f:n:", ";HScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$10$Intf`'@", "clBisque", ":&:0:A:S:b:i:q:{:", "TCustomMemoryStream<", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$8$Intf`'@", "dwType", "TrackGetThumbSize", "WizardIsTaskSelected", "TMenuMeasureItemEvent", ")Sl){\\", "WTArray>", "ScrollBy", "kpmj{S", "ResultType", "skFMXListBoxItem", "4(4;4I4]4j4r4", "Unknown", ".%4:.7d", "=*=F=M=W=f=p=}=", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3", "FParentDoubleBuffered", "1D1L1p1", "R\\gma", "TCustomVariantType&", "040J0[0m0{0", "CX+D$", "090S0n0", "tspUserPicture", "ThrowOuterException", "claDarkviolet", "GENERATEUNIQUENAME", "8;8?8l8|8", "8\"8=8U8d8l8", "FProcInstance", "IIEnumerable>", "SelectFolderForm", "volatile bool FTerminated", "0 0$0(0,0004080<0@0D0H0L0Y0o0s0z0", "LoggedTaskDialogMsgBox returned an unexpected value. Assuming Cancel.", "?.arrayofT", "2)363M3`3s3", ";,;O;u;", "OnAlignInsertBefore", "ASelf", "2=3[3y3", "HintFont", "klidsSelected", "8TEnumerable'", "tgIndicatorEdit", "3,343<3D3H3L3P3T3X3\\3`3d3h3l3p3t3x3|3", "8 8(80888", ":4:W:_:", ">@>O>V?w?", "MenuFont", "040K0Y0p0", "TSysControl7", "9 969D9S9d9", "FSysPopupItem", "InnerPage,5_", "2d3h3l3p3t3x3|3", "FFormStyle", "PExceptionRecord", "AsClass", "GetCount", "kbdsDefault", "DELAYDELETEFILE", "FLicenseLabel1", "rgbReserved", "454;4A4G4M4", "4-5M5", "Will register the file (a type library) later.", "D$0HP", ">-?^?", "= =(=G=c=t=", "igoPanInertia", ";8;\\;~;", "<$=?=p=", "6,6?6Q6d6c7v7", "RegCreateKeyEx", "!IComparer`'@", "FAsyncCallback", "button", "ResultFiller", "3'393U3c3p3", "claLinen", "9*999G9V9l9", "IsArm64", "ttbFlashButton", "Validated", "7 767K7Y7k7", "6'696p6", "<[3Hr", "UhaSc", "FAsULong", "D$T;C@|", "1&252=2L2", "ktfCategoryButtonsHot", "0$1=1J1Z1j1{1", "Uh'zf", "92989i9", "TEnumerator", "<$<3\">9>", "WheelScrollLines", "OnBeforeMonitorDpiChanged", "bsBtn", "Uhatg", "=&=2=C=N=]=l=", "FDefaultFont", "3\"3A3Y3x3", "FParentCtl3D", "tnMenuButtonHot", "0/0L0", "clCornflowerblue", "FHeaderStyleHook", "FInRemoteSession", "ttbSeparatorVertNearHot", "TabCount", "8g8r8", "Setup.MainFunc", "?:?P?a?u?}?", "Invalidate", "wifOther", "TransparentBlt", "11373I3R3n3x3", "csksc56011987", "FDropDownRect", "HTDictionary.TKeyCollection`", "IsGroupDefined", "BL8b3", "stfGlowSize", ";Ptu;", "cseucpkdfmtjapanese", "Ph", ":':/:I:M:Q:k:s:", "FHotTabIndex", "dotnet11", "WheelDelta", "twFrameBottomActive", "VerificationText", ">O?Y?", "6*6J6Q6\\6l6t6|6", ";C<{<", "twVertThumbNormal", "6\"6D6T6\\6`6d6l6p6t6x6|6", "4,5054585<5@5D5\\5x5", "5+5C5K5S5[5c5k5s5{5", "Version", ">X?\\?`?d?h?l?p?t?x?", "4\"4I4R4", "GetDeclaredIndexedProperties", "50@0N0", "ktFMBoxTextPressed", "3$3H3L3l3|3", "1+2P2", "=7=]=i=", "\"TCustomStyleCategoryButtonElements", "Internal error: InternalRunStringFunction: invalid BreakCondition", "2*2=2", "Installation process succeeded.", "8%8-8", "TMenuItemEnumerator9", "919S9]9w9", "kwbMaxRestore", "0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "7+7\\8~8", "GetTempPath2W", "4%4-454=4E4M4m4", "4\"404H4W4_4p4", "5e6p6x6", "", "8#8(858:8G8L8Y8^8k8p8}8", "Delete307", "spvpTop", "1$14181<1D1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "2,20242<2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "treeview", "`ZxZ,", "TCustomGestureEngine8", "EOverflow<", ";WT)>G>e>", "tdnbCancelUpdatesHot", "TCustomFolderTreeViewt", "9%uYN", "esActual", "Downloading file from %s", "tcpThemedChevronClosedPressed", "http://ocsp.sectigo.com0", "puiVal", "2W3y3", "WordBool", "OnMouseWheelUp\\oG", ">&>.><>N>^>f>t>", "Expiry", "8!9j9", "ttbTaskBandRoot", "2)2;2O2]2i2u2", "WriteInt64", "HFONT", ";(;0;A;e;s;", "FMaskHandle", "AddServerCookie", "4\"4&4*4.42464:4", "ColorXHA", "q\\LoJ", "SelStart", "BorderColor", ": ;;;", "TAttrData", "System4", "r,uKj", ":&:.:6:C:T:i:", ":0:B:J:X:g:}:", "2,2m2", "'TDictionary&", "macukraine", "tlGroupHeaderLineCloseSelected!tlGroupHeaderLineCloseSelectedHot(tlGroupHeaderLineCloseSelectedNotFocused+tlGroupHeaderLineCloseSelectedNotFocusedHot$tlGroupHeaderLineCloseMixedSelection'tlGroupHeaderLineCloseMixedSelectionHot", "function ProcessorArchitecture: TSetupProcessorArchitecture;", "It2It`", "0!0%0)0-01050", "Q/A!Ig2d", "ScanLine", "IHelpSystem3,", "wrAbandoned", "clLawngreen", "IURLResponse`'@", ">1>=>T>\\>z>", "044dm", "FScaling", "/NoCancel", "FRequireRadioSelection", "FindInstItem", ";{,rD", "TStreamOwnership", "FOnIdleCall", "create", "_HbWE", "C0f;p", "tzm-Latn-DZ", "90:=:J:R:^:k:r:x:", ".TList.TEnumeratorp)P", "ktcGenericBackground", "GetBkMode", "9pGt'+", "ttbSeparatorChecked", "<%=,=C=", "procedure UnpackVersionNumbers(const Version: Int64; var VersionMS, VersionLS: Cardinal);", "5B6V6f6", "EOutOfMemoryX", "incorrect command", "4)4?4C4M4U4]4", "181M1x1", "D$0WPS", "5#5'5+5/53575;5?5C5G5K5", ">$?T?v?", "vaInt32", "Extract7ZipArchive: Invalid Password value", "ALevel", "FixupResourceHeader", "FOnDialogCreated", "kticHomeButton", "4#4+494K4b4p4", ";3;;;I;Y;g;", "TThemedTab", "OnlyIfTransparent", "ThemeForDPI", "TOutputMsgMemoWizardPage", "FIsControl", "=!=%=D=T=X=\\=d=l=p=t=x=|=", "AOptions", "Helper: Command did not execute", "FGroupEdit", "0r0{0", "3$3E3M3k3s3", "NumRegistryEntries", "TDownloadWizardPage(", "5%5A5J5", "TObject&", "FPool", "3&323;3D3V3f3", "FParentWindow", "BeginPatch", "TopButton", "3&4<4", "Dhq*B", "!OPENARRAY", "8$8@8D8]8d8k8r8y8", "HICON", "FIsMoved", "UhviE", "Ph|fR", "UhB>V", "WantTabs", "181H1P1X1`1d1h1l1p1t1x1|1", "OnSimpleDownloadNoProgress", "=&=B=W=e=x=", "SetCursors", "4'4T4i4z4", "TCompleteEventsWrapper'", "SysControlXZQ", "PLongWord", "tNj@j@hH", "UhJro", "UhZp\\", "TTaskX?e", "FPopupChildren", "Uhw*v", "?2?:?U?]?x?", "OnActivate0", "&", "dwLockType", "TseBitmapList", "3,4X4", "jkdlmn", "GetElementColor", ";s,t'", "747J7[7o7w7", "TSePanelButtonClass", "0[0z0z1`2", "2 2$2(20282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", ";6;>;D;P;u;y;", "FCodePage", "IsProgressDefined", "?\"?C?g?u?", "5\"5*585O5a5i5w5", "sfHeight", "9(989@9H9P9T9X9\\9`9d9h9l9p9t9x9|9", "clDarkslateblue", "alLeft", "=N>[>{>", "AsUInt64", "smh^}", "csOpaque", "9 9$9(90989@9", "TSeListColumnInfo", ">$>6>M>h>u>}>", "Pages", "ID2D1BrushX", "Will register the file (a DLL/OCX) later.", "=0f0t1", "ha-Latn-NG", "t-Rf;", "TMemoStyleHookDET", "FAnimate", "FBufferOffset", "9U9a9B<[=s=n>", "&eZ67", "<7=M=^=r=z=", ">3>K>h>", "CreateNamedPipeW", "List item and state item count mismatch", ": :$:(:,:0:4:8:<:@:D:H:P:T:X:\\:`:d:h:l:p:t:|:", ">!>2>G>O>", "OnProgress", "839a9p9", "uPSR_std", "Uh$`n", "5(5;5L5_5m5", "99:N:", "GridItemFixedNormal", "TList", "ibm866", "BufferedPaintSetAlpha", "= >A>", "D:PAI", "?%?*?:???O?T?d?i?y?~?", "TOverlay", "TRegView", "Winapi.UxTheme", "srLeft", "tpPanelDontCare", ".TValueCollectionP", "TRttiClassRefType", "TPSRuntimeClassR", "tcpGradientHeader", "aBitSize", "FPreparingLabel", "GETWINDOWSVERSION", "pvarChildren", "FIconIndex", "GetHeaders", "Minute", "CreatorBackTraceIndex", "iso8859-4", "IArchiveOpenCallback`'@", "TGDIHandleRecall", "WriteResourceHeader", "RemoveObserver", "ComboBoxItemDisabled", "_^COu", "WriteUTF8Str", "TCompressedBlockReader", ":,:>:X:l:", "1-1<1O1b1q1", "D2D_MATRIX_3X2_F", "GetNativeSystemInfo", "3Y3x3", "insufficient memory (-4)", "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<", "tmpbPauseDisabled", "1$1=1S1i1", "TPenStyle", "tlGroupHeaderLineOpen", "\\TEnumerator>t X", "claLightpink", "&TList.TEnumerator5", "twCloseButtonDisabled", "TArray", "No argument for format '%s'\"Variant method calls not supported", "WizardImageAlphaFormat", "procedure CreateMutex(const Name: String);", "PathFunc", "0/0=0O0^0p0", "0J1W1i1", "ttdButtonSection", "9'9/979?9G9O9W9_9g9o9w9", "nTDictionary.TValueCollection", "4&4>4B4`4d4", ":$:,:4:<:D:L:T:\\:d:l:t:|:", "9:TSysListViewStyleHook.TSysHeaderStyleHook.TSysSection.:1", "263G3", "UhGzo", "ControlVerticalPositioning", "0*151;1H1", "Collisions|", "kZ77P", "CHARLENGTH", "2 24282O2V2`2", "tmSystemCloseDisabled", "6J6S6", "OPTIONS", "function RemoveDir(const Dir: String): Boolean;", "TStrings&", "UhcD^", "&VeIG", "clFirebrick", "ClassRefAttrData", "9?9`9", "Machine types supported by system: %s", "UhTDN", "{group}\\", "t!Ht:", ";D$@}", "Uh8]l", "Inno Setup: Language", "HelpFileName", "Uh[@d", "CloseHandle", "YZ]_^[", "Deleting registry value: %s\\%s\\%s", "Uh|nJ", "kbscSpinDown", "5.5C5Q5c5", "<$<(<,>", "PPropInfoEx", "7z Decoder 25.00 : Igor Pavlov : Public domain : 2025-07-05", "HeaderDraw", "QueryAssemblyInfo", ".TValueEnumerator;", "TRadioButtonStyleHook8", "ParentColor", "tcReadOnlyNormal", "SerialNum", "HtNHt", "AScroll", ">.>A>", "ImageList_Remove", "\"PrivilegesRequiredOverridesAllowed", "ContextSensitiveHelp", "SetLocation", "COMPAREPACKEDVERSION", "{TEnumerator>>", "5#5+535;5C5K5S5[5c5k5s5{5", "AAttrib", ".arrayOfT", "TSeGlyphInfo", "NewValue", "4'4H4P4T4m4u4y4", "<#<*<1<8'>3>D>t>", "4&484", "8:8p8", "tcbControlBarDontCare", "ButtonForegroundColorpHA", "Uh9>Y", "crHelp", "Started", "zh-CN,zh-Hans,zh", "Uh},j", "Shift+", "Uh\"ur", "9-9B9S9j9", ">*?8?]?g?w?", "ktbcRight", "HintWindow", "Setup.SecurityFunc", "OnEndDrag", "<-<;2E2_2f2y2", "<\"<&<*<.<2<6<:<>ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$13$Intf`'@", "UserAgent", "2TCollectionNotifyEvent", "tspMoreProgramsArrowBackNormal", "iso-2022-kr", "=#='=D=T=X=\\=d=l=p=t=x=|=", "Uh15v", "<%<3<;", "bTEnumerable>", "; This file was created by the installer for:", "TRttiDataMember", "THintPosition", "DeclaringUnitName", "GetLocaleInfoW", "0(0>0L0\\0n0", "BottomPaneld", "ktscTreeList", "csClickEvents", "FOnRemoteSessionChanged", "FQueue", "757M7n7v7~7", "hpBelow", "tttStandardNormal", "=K=`=n=", "606W6~6", "UnicodeToIDNA", "p0n0G", "94:N:", "UhS{a", "Directory", "PAttrData", "Uh-kq", "IModalWindow`'@", "Uh.nO", "FTrackingRect", "punkVal", "+T$h+", "SHA-256 hash mismatch", "msimg32.dll", "scLineDown", "Readme", "DragDrop", "9%9/93979P9`9h9p9x9|9", "WinHttpReceiveResponse", "2&2.262}2", "clPapayawhip", ">*>;>F>X>h>w>", "UhJ*D", ">7>L>Z>p>", "3'3;3C3Q3_3s3{3", "GlobalFindAtomW", "EZCompressionError,", "tkInt64", "0,0=0R0`0v0", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;i;", "> >->h>", "WindowDrawButton", "8,8A8E8`8p8x8", "OUnsignedFunc", "MAC_CHARSET", "GETVERSIONCOMPONENTS", "< <<(>>>Q>k>", "6,6J6l6", ">\">*>2>:>B>J>R>Z>b>j>r>z>", "SizeofResource", "WriteComponentRes", "kwdsTopmost", "Invalid Header", "TMessageManager.TListenerDataL", "Winapi.PropSys", "5&5+505?5N5g5s5", "?$?M?c?w?", "claOrangered", "FMeths", "1 1,181D1P1_1v1", "=>=g=", ">#>*>1>8>?>F>M>T>[>b>i>p>w>~>", "SubjectPublicKeyInfo", "EInvalidOpException", "OTDictionary.TValueCollection", "sfTreeItemTextDisabled", "6*6^6}6m8", "tspSoftwareExplorerDisabled", "FOldSelStart", "TMultiWaitEvent.TWaiterFlag", "69+V-Q", "9.9A9[9i9x9", "GetSystemDefaultUILanguage", "separator", "clSnow", "<3<}<", "-TFunc>`'@", "THandleStream7", "PList8'O", ";TList&", "PopupControlWnd", ";4;B;U;h;v;", "<%<7>", "CharUpperW", "clRoyalblue", "9$9:9O9]9t9", "FPopupParent", "tmcGridCellBackgroundHot tmcGridCellBackgroundSelectedHot'tmcGridCellBackgroundSelectedNotFocused", "OnReferenceNamex", "3\"3*383K3\\3s3", "CloseQuery", "FormKeyDown", "3@3\\3", "=$=k=o=", "CopyFrom", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$0$Intf`'@", "KeepSizeX", "2,2<2O2b2p2{2", "tgIndicatorMultiDot", "5)555C5X5e5j5w5|5", "8.8i8", "OnKeyPress", ":^Kt1", "FTotalMethodCount", "File/directory doesn't exist. Skipping.", "RXZ^[", ":#;\\;s<|<", "5=5w5", "5'5T5~5", "TChunktRNS_", "TTaskDialogButtons'", "6p6t6x6|6", "QQQQQQS", "&TArray", "PostMessageW", "Uh\"!r", "bsNone", ">)>=>E>V>d>l>z>", "3 3$3(3034383<3@3D3H3L3P3T3X3\\3d3h3l3p3t3x3|3", "%&'()*+", ">1>G>`>w>", "9%9-9;9R9l9z9", "9?9C9Q9`9p9t9x9", "FMinItemHeight", "function GetSpaceOnDisk64(const DriveRoot: String; var Free, Total: Int64): Boolean;", "TMessageListenerMethod", "FromTicks", "THTTPUpdateCookieEvent", "%TEnumerable'", "sfSmCaptionTextInactive", "LangComboh", "DrawIfOwner", "CountClipboardFormats", "ReadOnly", "8l8|8", "AppMutex", "?2?9?", "AutoMergeXmG", "TLZMACustomDecompressor,>i", ";C|u'", "TSeTextEffect", "claWheat", "ReturnTypeX", "FWConnect", "}7@", "NumIconEntries", "8/9r9", ":-:L:W:", "191I1a1y1", ";4;Y;~;", "procedure RegisterTypeLibrary(const Is64Bit: Boolean; const Filename: String);", "plVal", "1@2d2", "..\\Sysnative", "; ;:;T;p;", "?)?5?K?S?W?j?r?", "EPNGHeaderNotPresent", "&TEnumerator", "6 6$6(6,6064686<6@6D6H6L6d6t6x6", "eM7l4ts", "GetTabOrderList", "?8?P?k?", "=g?w?", "3-3x3", "TPSOnSpecialProcImport", "TktlMargin", "psDash", "FOuterNotebookp", "{?U}wOw", "tbCheckBoxExcludedDisabled", "GETVERSIONNUMBERS", "FMouseOnThumb", ";FpsJ", "AFragment", "lpReserved", "dotnet2032", "IsHintMsg", "FLineDiv", "Unused1", "IndexOfName", "SetChecked", "0%0)0-0H0P0j0r0v0", "lrMap3DColors", " FSingleBufferingInRemoteSessions", "Child", "55696=6A6O6]6m6", "DrawMenuBar", "Minutes", "<,5F5P5[5`5k5p5~5", "BitmapPressed", "hij@klmn-opqArstu", "AMessageHandlerClass", "FKeyHandle", "TInputFileWizardPage6", "2%272M2\\2", "TRttiIntfMethod6", "TAccObject8", "Successfully created or set the value.", "4-4=4P4c4q4", "ReadCollection", "TEnumerable", "TPropSetV", "FDefaultEncoding", "FWorkComplete", "638t8", "FPreparingErrorBitmapImage", "https://www.innosetup.com/", "ctWinApi", "PVmtMethodEntry", "TBaseAsyncResult", "ttbSizingBarLeft", ";!;3;F;N;^;g;q;{;", "kbcdsNormal", ":0:=:C:L:^:k:q:|:", "tXf;J", "kmgClose", "GetScaledBitmapLink", "SetBackColor", "TSysScrollBarStyleHook7", ">)?E?", ">J>W>~>", "FOnDrawItem", "GetSystemPaletteEntries", "ImmSetConversionStatus", "GetMenuState", "clGradientActiveCaption", "wsMaximized", "FilenameLabel", "tlLinkDontCare", "= =$=(=,=0=4=8=<=@=D=H=L=P=t=", "FNewFolderName", "%.48s~%.8x", "2<2`2l2", "AExact", "tfUseHiconMain", "kmgSysMenu", "Collisionsp", "ssDone", "SelectedImageNameL", "92999@9G9N9U9\\9c9j9q9x9", "kpscProgressBar", "Unregister", "ISDOTNETINSTALLED", "GrantPermission", "System0", "4;5G5N5X5b5l5v5", "969C9T9^9f9t9", ".TList.TEnumerator5", "4TEnumeratorX", "TEnumerable", "LocationLabelp", "tmHide", "3 3$3(3,3034383<3@3D3H3L3P3l3", "tbCheckBoxUncheckedHot", "tbCheckBoxImplicitNormal", "Vcl.Imaging.pnglang", "tsArrowBtnDownPressed", "OnFindComponentClassd", "FOriginalParentSize", "6 6$6(6,60686^6m6u6", "7'7+7q7", "chinese", "CallCancelButtonClick", "6!6/6A6X6f6v6", "BCryptExportKey result invalid (1)", "D$hPU", "ksbcPageLeft", "1,1K1]1", "TSimpleStringListArray", "SelectLabeld", "function SysErrorMessage(ErrorCode: Integer): String;", "rYf;5 ", "BarDraw", "2<2Q2_2s2", "=ScriptFuncLibraryRegister_R.RegisterInstallScriptFuncs$0$Intf`'@", "PipeRead", "Paint", "FPageDescriptionLabel|", "DataModuleCount", "AInstance", "=(=O=", "ReadIdent", "EInOutErrorA", ": :$:,:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:u:", "1#1W1m1", "6\"606H6\\6d6u6", "cdCdecl", "System.Generics.Collectionsd", "clWheat", ":-;Q;e;", "3<3H3L3P3T3\\3d3h3l3p3t3x3|3", "[[;Wc?", "FINDWINDOWBYCLASSNAME", "D2D1CreateFactory", "tcBorderFocused", "TComponent.Create@$ActRec", "+TEnumerable", "ktisBottomFirst", "uPSR_forms", "ContentionCount", "TStream", "FControlState", "function IsX64: Boolean;", "TCollectionEnumerator", "ScrollDraw", "ShowInTaskBar\\oG", "<*=:=c=~>#?I?", "2 252C2W2m2", "TEnumerator", "clMenuHighlight", "SetUnicodeString", "Deleting the value.", "Windows version: %u.%u.%u%s", "#Sectigo Public Time Stamping CA R360", "9+:6:<:L:T:\\:d:h:l:p:t:x:|:", "FEndOfVmt", ":S;/=r=", "353P3a3", "<-<@h", "FOldPalette", "tmpbStepHot", "AddPage", "0.0Q0_0m0", "6\"6<6N6\\6v6~6", "-TObjectList", "<3<;(", "5-5;5K5^5p5x5", "SetWindowTheme", "Param1", "7$7(7,7074787<7@7D7H7L7P7T7X7`7h7p7", ": :6:Y:", "tclHeaderItemDisabled", "MTDictionary.TPairEnumerator", "fSecond", "TRttiInstanceType", "=!]@,", "NameValueSeparator", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7p7t7|7", "maccentraleurope", "FEncoderContainerFormat", "FRunningEvent", "DragHandle", "IsInstanceOf", "clAppWorkSpace", "= >J>~>", "WizardDarkStyle", "?-?,>=>", "<\".TEnumerator", "2&2.262>2F2N2V2^2f2n2v2~2", "6 6H6L6x6", "3>3b3", "TResourceStream", "DrawingStyle ", "TCriticalSection", "0?0g0", "function ComparePackedVersion(const Version1, Version2: Int64): Integer;", "1.1:1T1`1w1", "TThemedStatus", "Creating the icon.", "6F6p6", "506h6", "AutoDragDocking", "TSeKind", "tfFlyOutLinkArea", "The USERTRUST Network1.0,", "FNextID", "HeaderSectionTextPressed", "tsGripperHorzHover", "<-=5=:=J=Q=b=q=", "clGrayText", "YTDictionary.TValueCollection;", "3%3A3", "\"IComparer`'@", "aExtended80", "ksbdsHot", "292x5", "Interval\\oG", "ScaleValue", "%s: The existing file appears to be in use (%d). Retrying.", "TRttiRecordMethod6", "1%1A1P1d1h1}1", "EVariantInvalidNullOpError", "0-0;0Q0Y0g0z0", "euccn", "838M8g8", "VertSliderRect", "UhU$V", "FUpdatingAllFonts", "tspMoreProgramsArrowHot", "0E1R1]1", "OnMouseUpP_Q", "Failed to get path of 64-bit Common Files directory", "twFrameRightSizingTemplate", "FCond", "twFrameBottomSizingTemplate twSmallFrameBottomSizingTemplate", "8(8D8Z8`8", "ENetHTTPResponseException", "V>e>", "Uh`tK", "5 5$5(5,5054585<5@5D5H5L5P5T5\\5d5l5", "829u9", "0#090a0", "FGDIObj", "claMediumorchid", "ShortDateFormat", "3$303", "HasInternalChildren", "8/8D8R8d8n8r8", "3)3?3R3Z3h3v3", "Terminated", "Invalid filename", "UNLOADDLL", "ImmIsIME", "Uh@Tn", ":%:9:L:[:m:", "RadioButtonTextDisabled", "`TEnumerable>'", "kbbdsPressed", "otSLong", "OnKeyNotify(", "MessageBox", "Uhd\\f", "868>8B8`8p8x8", "TEnumerator>(", "0 0=0K0[0m0", "PWORD", "UnicodeString", "OuterNotebook,5_", "Encode", "#FShowProgressControlsOnNextProgress", "Comparer", "0&0<0Q0_0u0", "tbCommandLinkPressed", "EndRead", "HelpContext @Q", "Inno Setup: User Info: Organization", "t';C8u", "TCollectionItem:", "PLIST_ENTRY", "W!IY#", "FBeveledLabel0", "DirBrowseButton", "clMediumorchid", "TWizardPageCancelEvent", "ktoptOneComboBox", "?!?*?F?", ")TArray", "function SetPreviousData(const PreviousDataKey: Integer; const ValueName, ValueData: String): Boolean;", "TEndDragEvent", "ExtractTemporaryFiles: No files matching \"%s\" found", "4 414<4G4Y4m4u4", "7*7I7", "XTDictionary.TKeyEnumeratorDKM", "pdblVal", " - Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.7Length of value array must be >= length of prompt array", "&Retry", "D$8_^]", "ESevenZipError", "OnPaint\\oG", "7PathFunc", ":k:z:", "= =$=(=0=4=8=<=@=D=H=L=P=T=X=d=l=p=t=|=", "IsClassMethod", "677T7", ";%;9;G;Y;z;", "*TMethodImplementation.PFirstStageInterceptD", "=8=F=W=o=}=", "5 555N5e5x5", "dsBmih", "hRV-J", "AsyncCallback", "PlYZ_^", "biSystemMenu", "DragObject", "\"TEnumerator(", "QL_^[", "ArchiveFilename", "3P4e4s4", "cp853", "EPNGInvalidPalette", "Winapi.UrlMon", "2I2^2o2", "TRttiInstanceFieldEx6", "poPrintToFit", "FPreparingMemoj", ";pY>i>w>", "RemoveMenu", ">F?]?", "teEditBorderNoScrollNormal", " !\"#$%&j", "=i7I!", "FDownSliderPos", "9+9=9J9R9`9r9", "REGISTEREXTRACLOSEAPPLICATIONSRESOURCE", ":*:A:O:c:z:", "4%434E4_4m4}4", "7+797P7^7p7~7", "?$?,?4?8?$>,>4><>D>L>T>\\>d>l>t>|>", "CLvT2", "/TList.arrayofT", "? ?$?(?,?0?4?8?.TValueEnumerator(SM", "L$`#T$\\", "6 6$6(6,6064686<6@6D6H6L6P6T6\\6", "6I6_6p6", "81898G8Y8o8", "TIntConstD", "Array ", "5$8M8", "+TEnumerator(", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6v6", "FWaitRecycle", "TreeItemTextHot", "SetNamedSecurityInfoW", "ecHeading1TextColor", "O}K.O+3", "SkipValue", "1 1$1(10181`1n1", "skPageDown", "Uh)7Y", "8!S3S,/.", "kwbMin", "Groups", "tebNormalGroupCollapseNormal", "IOleForm`'@", "0@1[1", "4 424I4W4g4z4", "SeekToEnd", "StepOver", "FWelcomePagex", "FClassItems", "8TDictionary", "TPrintScale", "FStep", "GetThemeSysSize", "9TDictionary$", "6TList.TEnumerator|", "TURLResponse.Schedule$ActRec`", "tsUpperTrackHorzDisabled", "HandleType", "AdjustLabelHeight", "FOpenArray", "tmpbPlayNormal", "3'4N4", "System.Generics.Collections", "5.5F5^5u5", "kmicRestore", "4%4-454=4E4M4h4}4", "FSilentOrAllowed", "TZDecompressionStream$", ":$:4:q:x:", "ReplaceKey", "FCaption", ":D:S:p:}:", "\\$(#l$4+l$,)\\$", "ttbSplitButtonNormal", "TPaintEvent", "> >(>0>4>8><>@>D>H>L>P>T>X>\\>`>d>q>", "FViewerList", "0=0A0\\0t0}0", "HeaderDrawSection", "Unknown Reason(s) %d", "2!252C2S2}2", "ToolItemTextHot", "'TArray", "GetWeights", "Uh#@n", ">J?\\?g?", "tcTimePressed", "505D5", "6c6p6", "272E2S2o2}2", "FRight", "IsOrdinal0", "FShowLines", ";%;3;;;I;X;", "TThreadPool.TBaseWorkerThread", "4U5G6V6x6", "wQ\\/s", "FSelectDirBrowseLabel", "@ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$13$Intf`'@", "ParentStyle", "TList&", "function ShellExec(const Verb, Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ErrorCode: Integer): Boolean;", "SolidVert", "2 212G2[2n2", "AFlag", "ScaleForCurrentDPI", "Uh4&o", "=\"=*=8=H=Z=g=o=}=", "WinHttpOpen", "3 3$313D3L3T3\\3d3l3t3|3", "K ;K$t", "FPropInfo", "TScriptRunner8", "9 9$9(9,90949<9D9L9p9~9", "HeaderSectionTextDragging", "BoxDraw", "Reserved2", "AThread", "ISequentialOutStream`'@", "pmExplicit", "646<6Y6a6~6", "3o:y:", "OnSettingChange", "FDebugDataForProcs", "IsEditTransparent", ":C;R;t;", "848D8L8T8\\8`8d8h8l8p8t8x8|8", ">3>A>X>o>}>", "clLtGray", "FTabOrder", ";';@;D;H;c;k;", "clLightgrey", "twVertScrollNormal", ":/:O:]:p:", "kedsDisabled", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;l<{<", "Current", "RegFlushKey", "Unclosed constant", "twMaxButtonHot", "?(?2?A?", "kbscSpinRight", "4TArray", "505R5", "FExt2", "i9Z^b%", "Installing the file.", "FCurrentKey", "8TDictionary.TValueCollection", "LoadStringW", "WindowHandle", "4W8g8", "IsDialogMessageA", "?TComparer|", "IComparer`'@", "ADDQUOTES", "AExceptionHandlerProc", "HTDictionary.TItemArray", "{,}Hnj", "FOnScroll", "function CreateShellLink(const Filename, Description, ShortcutTo, Parameters, WorkingDir, IconFilename: String; const IconIndex, ShowCmd: Integer): String;", "0F1N1s1", "CVcl.ExtCtrls", "?)???P?\\?`?d?h?p?x?|?", "797`7", "ASelfTypeHandle", "6<7X7", "FindNext", "B0@0>", "internal_state", "PageCount", "ZTDictionary.TValueCollection;", "DrawRectangle", "ttbDropDownButtonChecked", "GetThreadPreferredUILanguages", "ImageList_SetImageCount", "IsStandardTime", "tcbButtonSelected", "DrawThemeTextEx", "pvReserved", "CreateFileW", "datepicker", "BCryptExportKey result invalid (3)", "9 9'9.959<9C9J9Q9X9_9f9m9t9{9", "202A2T2b2v2", "GetThemePropertyOrigin", "FixupReferences", "4&5A5", "DelimitedTexth8B", "FStreamStartPos", "? ?^?m?u?", "DisplayNameWStr", "2>2s2", ";TList.arrayofT", "FMessage", "FProgressSet", "SETUPMESSAGE", ";$;7;I;Q;_;n;", "Uh)er", "?UUUUUU", "5#545B5J5X5d5", "9TDictionary.TItem", "TPanelStyleHook8", "tmMenuDontCare", "TThemedMonthCal", "SetAutoSize", "LOOS/", "TMetafile&", "Uh}iB", "@ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$11$Intf`'@", "VariantChangeType", "1'1:1F1N1_1u1}1", "FButtonState", "7+7>7L7`7m7u7", "?H?L?s?}?", "CONNECT", "1.121Y1`1g1n1u1|1", "FWordWrap", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$4$Intf`'@", "3TLoginCredentialService.TLoginCredentialEventObject:", "Output:", "FUndockWidth", "IsClass", "ToArray", "ST_^[", "GetStartupInfoW", "3%383F3Z3g3o3}3", "clMagenta", "D$", "<'.TKeyCollection;", "INCREMENTSHAREDCOUNT", "IsMemoTransparent", "5%5L5a5j5", "DockClientCount", "Counth", "Dormant", "<#<6&", "ktigClose", "tis620.2533-0", "9 :$:P:", "6\"6&6*6.62666:6Z6^6b6f6j6n6r6", "FMessageHandler", "TSimpleStringList,9c", "7\"717=7K7Z7h7x7", "Items", "Uh))h", "ImageList_GetIcon", "TThreadPool.IThreadPoolWorkItem", "Original Setup EXE: ", "BoxGetClientRect", "MinWorkerThreads", "TileStyle", " inflate 1.3.1 Copyright 1995-2024 Mark Adler ", "AlignpHA", "_CRYPT_ALGORITHM_IDENTIFIER", "3!3D3O3j3", "IDockManager`'@", "o0J|t+", "imOpen", "procedure CoFreeUnusedLibraries;", "tmPopupSubMenuNormal", "FILESEARCH", "=)=;=I=]=l=", ";H<|<", "ATList.TEnumerator5", "RichEdit20W", "_aullshr", "7D7l7", ";*;2;@;S;g;", "ExplicitHeight", "ToByteArray", "@ _^[", "Arm64", "FTagCounter", "?(?1?b?|?", "9':4:C:e:", "omCapture", "TUninstallLogFlags", "141E1[1l1|1", "SettingChanged", "cseuctw", "ToolbarWindow32", "claPalegreen", "-TPair", "<+<=:>D>H>h>t>x>|>", "+TCredentialsStorage.TCredentialAuthCallback", ":0:E:M:", "<4.TEnumerator5", "*TList.TEmptyFunc`'@", "FButtonBackgroundColor", "PushButton", "TReadComponentsProc", "ttTopTabItemRightEdgeSelected", "SplitterDraw", "fpFixed", "Cookie", "Failed to proceed to next wizard page; showing wizard.", "959;9F9S9]9c9r9", "CreateDownloadPage", "889y9", "0,0D0`0q0", ":TFormatSettings.:20", "\" /SILENT", "@TList>.TEnumerator5", "GraphicU", "Setup.Uninstall", "Uhd@`", "tiOpenRound", "FPopupOwners", "7a7f7", "Exception message:", "laAnd", "StyleClass", "StatusGetClientRect", "HorizontalOffset", "UhS?J", "function StrToVersion(const VersionString: String; var Version: Int64): Boolean;", "=5=9=`=g=n=u=|=", ".TValueCollection", "sfTabTextInactiveNormal", "FILECOPY", "1*1:1M1_1g1u1", ":-:C:T:e:m:{:", "UserInfoSerialLabel", "TMessageManager.TListenerList4", "4(4:4W4e4x4", "GetParentMenu", "FStyleColorsChecked", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$55$Intf`'@", "6\"6&6*6.6<6J6W6i6y6", "FThrottler", "TNewProgressBarStyleHook8", "\"TArray", "Wh /x", ":TWICImage.:1", "tdnbLastHot", "FBoundary", "SetDIBColorTable", "AMaxChars", "3$4D4", "System.NetConsts", "TTabletOption", "MsiGetProductInfoW", "FOnDragDrop", "StyleDescriptor", "NeedServerCredential", "4j4w4", "saRight", ">%>,>3>:>A>L>\\>d>h>l>t>x>|>", "Cannot cast an interface", "WindowBits", "Failed to set permissions on directory (%d).", "tmpbRecordNormal", "Reverse", "8\"878?8M8`8p8t8", "FRedirectsWithGET", "=ScriptFuncLibraryRegister_R.RegisterInstallScriptFuncs$ActRec", "<'T>X>t>x>", "?>(", "IsTimeout", "PreviousFrame", "2q3u3y3}3", "CatgeoryButtonsNormal", "ShowHelp", "v m2=:", "FCompleteEvents", "saAll", "Source", "Failed to create \"_unins-done.tmp\".", ":TWizardForm.:1", "tlCenter", "FInnerNotebookl", "BitmappHA", "UhXWO", "ControlWidth", "TEnumAliasEntry", "C>o>", "tsUpPressed", "DisableProgramGroupPage", "Winapi.Messages", "FUserInfoSerialLabelt", "=6=>=V=Z=x=|=", "TPSTypeRec_ProcPtrx", "VerificationCheck", "1/1@1X1p1", "X,2<<", "TSysControlP", "UnLoadKey", "9'959E9S9k9s9", ">#>+>3>;>C>K>S>[>c>k>s>{>", "TPSInternalProcRec", "TSequentialOutStream", "1p2y2", "ARight", "cbRead", "euc-kr", "TStringScanner", "3*3.3t3", "?TList.ParrayofT", "Not enough timers available@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active*A control cannot have itself as its parent)Control '%s' is used on a not main thread", "t,Kz?", "ReadListEnd", "twHorzThumbHot", "1 1(101d2h2l2p2x2|2", "TBrush&", "2B3S3f3p3", "tmcGridCellToday", "4)4@4N4a4x4", "9:9U9}9", "FOnTypeChange", "D$4PU", "TBorderIcon", "LocaleName", "ClientWidthpHA", "#IComparer`'@", "iso8859-6", "EListError", "CreatedBy", ":5:d:l:", "ppAsmItem", "FMaxWidth", "0D0M0", "TThread.TSynchronizeRecord ", "InitCommonControls", "6$7.727P7", "7+7R7y7", "TSysComboBoxStyleHook7", "Verification error: ", "CanUndo", "odInactive", "ListhfF", "1'151P1^1q1", "Uh2mc", "ssInstall", "1 1$1(1,1014181<1@1D1H1L1P1T1a1s1w1~1", "5F6o6", ";<;d;y;", "Arm32", "ktcListBox", "223I3W3m3", "=,=~=", "categorypanelgroup", "bzlib: Too much memory requested", "Cancelt:Q", "AddResource", "EndInvoke", "scGenericGradientBase", "=$=0=8=F=T=_=g=u=", "FCaptionFont", "TCustomLinkLabel6", "TSeStyleDrawing", " TListp", "CallSpawnServer: Unexpected status: %d", "?5?S?e?y?", "usercf64", "Uhz#t", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$2$Intf`'@", "VirtualFree", "Existing file's SHA-256 hash matches our file. Skipping.", "2;6G6N6Y6c6n6", "kbscBox", "[Set]", "FlatSB_SetScrollPos", " ", "TMethod", "4 4E4o4", "TSeMemoInfo", "MouseUp", "BufferedPaintInit", "FEditHandle", "TWinControlMessageHandler8", "FStack", "ktxsExpandTabs", ",tdBHu", "989W9", "?=?A?E?I?M?Q?U?Y?]?a?j?o?", "1(1<1H1R1R2_2l2x2|2", "WCharToMBFlags", "ssPreInstall", "PasswordEditLabel", "7 7C7p7", "tlListviewRoot", "Unable to open Index", "9Z9d9u9", "BarDockDraw", "FNoSharedFileDlgs", "MakeFullyVisible", "/TList.arrayofT", "ResList", "tmPopupSeparator", "?2?F?_?~?", "ExtractArchive: Unknown ArchiveFileName extension", "ByteIndex", "function StringSplit(const S: String; const Separators: TArrayOfString; const Typ: TSplitType): TArrayOfString;", "TWaitResult", "DragTargetPos", "RegisterPreviousData", "|:Fo[vsB", "='=:=B=P=_=r=", "PrevUserInfoName", "z^o/B", "navigation", "PShortString", "THTTPRequest5", "Orientation", "WidthP", " TEnumerator(", "Dec=Overflow while converting variant of type (%s) into type (%s)", "ATList.TEnumerator", "wdsLight", "SourcePos", "TPropSet,", "RootAncestor", "FBevelInner", "JOHAB_CHARSET", "Error removing header: (%d) %s", "KTDictionary.TValueEnumerator;", "TTaskDialogForm", "9>:i:", "?%?7?H?P?^?m?{?", "FOwnsObjects", "7!7)71797A7I7Q7Y7a7i7q7y7", "C`;D$L~!", "clActiveCaption", "GetInterface", "FUserInfoSerialEditx", "Key: %s\\%s", "Constraints", ":4:R:", "FResponse", "TEnumerator>", "1-1;1S1[1i1y1", "SetLayeredWindowAttributes", "INSTALLONTHISVERSION", "9$9?9G9K9h9p9", "R8_^[", "<(V?b?", "@NJ-rRZ", "Uh6Vf", "NewChar", "AMenuItem", "cp862", ";$;5;K;\\;j;", "ssFlat", "Objects", "32-bit Edition", "UhH`n", "TList&", "9=9R9}9", ";-$7x", "4 4$4(4,40444@4D4H4L4P4T4X4\\4`4h4l4p4t4x4|4", "7.7z7", "Uh~*d", "claPalegoldenrod", ":8:z:", "#TEnumerable'", "FFontHot", "NewWidth", "?!?1L1c1q1", "TSeBarButtonClass", "SetFileTime", "USINGWINNT", "InstallRoot", "FUndockHeight", "BTDictionary.TKeyEnumerator", "rgszNames", "IsLine", "9/:<:K:m:", "TMessageBase", "RemovePropW", "PUninstallRec0=k", "jjjjjjjj", "MenuItem", "515;5]5", "oM\"%8", ";\";0;H;W;_;p;", "OnDrawItem\\oG", "Uh[)S", "hpAutoFromCenter", ":}}}V", "ForceDaylight", "2.2<2K2b2|2", "?%?8?Y?g?z?", "=3>7>^>h>l>", "tmcNavNextNormal", "Capabilities\\", "TCustomStyleServices.TStyleFlag", "teEditTextHot", "Uh+4t", "Deletion failed (%d).", "1$2(2,20242B2P2b2q2", ":2:@:P:c:u:}:", "656@6a6l6", "FSysToolbarButton", "HTDictionary.TItemArray", "@ScriptFuncLibraryRegister_R.RegisterBrowseFuncScriptFuncs$2$Intf`'@", "AscendingTrySizes", "505L5i5w5", "$YZ^[", "0*080H0[0n0|0", "RegisteredOrganization", "DragImmediate", "MousePresent", "_isetup\\_isdecmp.dll", " TArray", "AFileToBeDuplicated", "FQuery", "skNoMask", "'TEnumerable'", "TIcon", "THTTPSecureFailureReason", "tebHeaderPinSelectedHot", "claMediumspringgreen", "$TEnumerator,", "@`CLb", "dbkFCallWrapperAddr", "2%282G2O2]2k2{2", "TArray", "6&6-646;6B6I6P6W6^6e6l6s6}6", "FHintShortCuts", "9H.ParrayofT", "TWICImageInterpolationMode", "FReadMethData", "teEditBorderNoScrollFocused", "GetFileInformationByHandle", "<'9F9T9g9x9", "Jersey City1", "SourceIndex", "4 4$4(4,404P4h4l4", "CurUninstallStepChanged raised an exception (fatal).", ";$;6;E;M;\\;", "TSeProgressPart", "4 4$4(404e4t4|4", "ArcTo", "FCapturedButton", "klgMixed", "0 0(0_0n0v0", "ITDictionary.TKeyCollection<", "9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "HintInfo", "stream error (-2)", "tbRadioButtonCheckedHot", "HasPixelInformation", "FMustActivateSysMenu", "<$<:", "7D7y7", "clSeagreen", "5)5;5U5c5s5", "Execution", "UhJ{O", "csisolatin5", ":%:M:p:", "?'?5?K?`?n?", "/TDefaultLoginCredentials.LoginEventUsrPw$ActRec", "808N8\\8m8|8", "OverrideFont", "TCustomCombo6", "tdnbInsertDisabled", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$28$Intf`'@", "7C7l7q7v7", "<\"<0>", "IsDragging", "TPUtilWindow", "FDefClientProc", "Uh[Vf", "FImage", "TRttiEnumerationType3", "5 5$5(5,505>5P5h5", "ExpandedTexth", "4 454K4\\4", "ttbSeparatorVertChecked", "MinInt64Value", "GTDictionary.TKeyCollection ee", "2%2=2L2T2d2", "<%6j6", ";';1;9;G;Y;p;~;", "TTaskDialogFlags", "ktxaBottomRight", "TPersistentClass", " TList.TEmptyFunc`'@", "; ;$;(;,;0;4;8;@;a;p;x;", "ResDataSize", "claLightgreen", "claDarkorchid", ">b?q?y?", ">5>j>c?", "TStringComparer'", "FClientCertPassword", "pfCustom", "[ OZ+", "MoveFileExW", "EWriteErrorHtG", "1#1@1c1", "Current8zF", "?5?J?X?o?", "CodeAddress", "<%<: >$>(>,>0>4>8><>@>D>H>L>P>T>b>t>", ";%;9;M;U;f;w;", "FromBeginning", "MimeTypeHeader", ";8;N;_;s;{;", "FStyleColorsCheckedWantTabs", "mbNone", "rgbGreen", "FDestF", "tlListDetail", "BINFNAN", "tcBorderDisabled", "FOrgWndProc", "AOperation", "5#5,5P5a5r5", "csLButtonDown", "LastBaseNameOrUrl", "TWinHTTPClient&", "ttGlyphOpened", "T$,+C", "TEnumeratorhOd", "FOnThemeChange", "Value: %s", "Intersect", "OnMouseLeave", "AOwnsStream", "=)=7=D=L=Z=j=|=", "Unexpected Download flag", "171X1m1{1", "PExcepInfo", "tkUString", "/SPAWNWND=", ">TDictionary.TItemArray", "kgscRadioGroup", "ShowDragImage", "unins???.*", "ZoneLimit", "0\"040N0\\0k0~0", "dmDesktop", "IEqualityComparer`'@", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$20$Intf`'@", "P+t$4FV+\\$", "tagMSG", "psUserStyle", ",TList.TEnumerator5", "4>5T5e5y5", "VERSIONTOSTR", "959J9X9k9", "FWheelHwnd", "ecFillColorHint", "<,<=.TEmptyFunc`'@", "bsRaised", "<$<(<,<0<4<", "tfUseCommandLinks", "7\"707A7\\7m7", ":TInternalEraInfoRecord.:1", "THintWindow", "claAqua", ".vmdk", "\"TEnumerator", "8kZyP=", "buffer", "6*6G6}6", "DesktopTop", "3A3E3S3`3", "4$454N5", "TPopupMenu", "Collisionsd", "TUVW'XYZ[\\]^_`(", "slAuto", "ControlLeft", "PhHFb", ">L>\\>`>d>l>t>x>|>", "HintpHA", "6$6,6:6V6d6u6", "TMainMenuPPZ", "PVariantArgList", "SAMETEXT", "UhTfq", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "6 6$696A6Y6a6e6{6", "?(?J?W?h?r?z?", "DELETEFILE", "TPicture.LoadFromStream$ActRec", "kmgMinRestore", "TSeGridItemClass", "5$585I5h5", "OnDialogCreated\\oG", "ssRegular", "< <$<(<0<81P1j1x1", "FOnConstrainedResize", "mkFunction", "OTDictionary.TPairEnumerator;", "ktfStatusPanelTextNormal", "B[>w;", "2,3P3", "3 393T3d3h3l3t3|3", "BorderWidthpHA", "bsBottomLine", "8P8p8", "Values", "~Setup.Install", "FCurrentSourcePos", "3-373;3\\3h3l3p3t3|3", "U_W7P^", ":oVua", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$5$Intf`'@", "Package", "HotSpotY", "DwmGetColorizationColor", "9.989<9\\9h9l9p9t9x9|9", "csReplicatable", "Extracting temporary file: ", "EXPANDCONSTANT", "TProc", "FReadSignal", "7T8e8r8", "QQQQQS", "3J4R4X4]4", "FEnhanced", "9*9T9{9", "AMode", "Windows architecture: %s (%d-bit)", "claLightcyan", "=(=,=J=N=i=m=", "function UTF8Decode(const S: AnsiString): String;", "odGrayed", "D$$Pj", "5/5>5T5", "SysControlClass", ":0:C:T:g:u:", "PanningWindowClass", "4,4H4d4", "FMethodBuckets", "/TList.TEmptyFunc`'@", "Unknown error", "5 5.5E5X5`5n5|5", "7 7(7", "DrawUsingPixelInformation", "ButtonDrawText", "ButtonRollDown", "csGestures", "484=4X4p4", "skBottom", "1*121D1L1`1p1", "?)?;?T?e?s?{?", "VTEnumerator>(", ";TEnumerable'", "UhebY", "HotFontpHA", "TCompressionLevel", "9\"9+90959C9L9Q9V9d9m9r9", "sig-s", "QQQQSVW", ";-;2;>;D;L;^;i;t;", "PreviousCard", "&TListT", "FOnData", "NTDictionary.TValueCollectionl", "7T92:q:';[<|<", "tagOIFI", "=+=3=A=P=^=u=", "twSmallFrameBottomInactive", "_^YY]", "twSmallCaptionActive", "claCornflowerblue", "ReplicaProc", "+TList.TEnumerator5", "OnStartDragF", "4 4$4(4,4044484<4@4D4H4L4P4^4p4", "<-&>:>T>\\>j>}>", "EPNGInvalidBitDepth", "=8=H=L=P=X=`=d=h=l=p=t=x=|=", "faReadWrite", "?TList.ParrayofT", "FORCEDIRECTORIES", "8P8p8x8", "Memory", "3B4F4m4w4", "ktfGridItemNormal", "FAuthorURL", "function RegisterExtraCloseApplicationsResource(const DisableFsRedir: Boolean; const AFilename: String): Boolean;", "TransparentColorpHA", "ttTabItemRightEdgeFocused", "OOO[u", "commonpf64", "FWelcomePage", "bigfive", "ArchiveFindFirstFile: Invalid ArchiveFileName value", "TreeItemTextSelected", "Shutting down applications using our files.", "NotAfter", "9?9]9", "8!8:8@8E8X8t8", "-TList.arrayofT", "saRestore", "Out of Record Fields RangejThis \"Portable Network Graphics\" image is invalid because the decoder found an unexpected end of the file.8This \"Portable Network Graphics\" image contains no data.]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.oSome operation could not be performed because the system is out of resources. Close some windows and try again.", "7#737;7I7[7r7", "ttTopTabItemRightEdgeDisabled", "tcTimeNormal", "Importing the DLL function. Dest DLL name: %s", "Direction", "kcdsMixedHot", "(TList.arrayofT", "akRight", "twFrame", "THelpViewerNode6", "TFinalizer'", "ffInline", "7*$,/", "1\\2r2", "MustActivateMDIChildSysMenu", "Is64Bit", "AScriptFuncLibraryRegister_R.RegisterInstFuncOleScriptFuncs$3$Intf`'@", "ShowModal", "Inno Setup: No Icons", "949B9Z9k9s9", "<)<7>.TEnumerator5", "eeSunken", "#IComparer`'@", "92969:9U9]9u9y9", "TPopupWndArray", "4\"4&4D4T4X4\\4d4l4p4t4x4|4", "Ph@iP", "DEd]n", "function GetSysNativeDir: String;", "UhfxC", "<48B8W8}8", "function StringChangeEx(var S: String; const FromStr, ToStr: String; const SupportDBCS: Boolean): Integer;", "7(7-7<7A7V7[7j7o7", "CheckIndexAndName", "ChangeWindowMessageFilter", "FCurrProc", "TRecordTypeField", "Cannot access a 64-bit key in a \"reg\" constant on this version of Windows", "7+7A7Z7m7", "FClasses", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$15$Intf`'@", "5!5(5/565=5D5K5R5Y5`5g5t5", "TCustomDockForm6", "4)5I5P5x5", "FCaptured", "ttlTextLabelDisabled", "FindAttribute", "RemoveRecordedGesture", "StreamOwnership", "eS\\XY`N", "5+6T6}6", "TImageLink", "EPNGUnknownColorType", "FDesignSize", "FTextHeight", "9%969T9b9r9", "EAssertionFailed$", "FOnPaint", "; ;6;H;^;w;", "=i>n>", "TList", "TReloc", "SENDBROADCASTNOTIFYMESSAGE", "UpdateControlState", "taskbar", "4,4?4P4c4q4", "GetThreadUILanguage", "ShortTimeFormat", "030A0S0i0x0", "^[YY]", "mtidsCheckedHot", "2*282N2_2x2", "IsDotNetDetected: Invalid VersionString", "TList", "coRightToLeft", "FDefaultKbLayout", "Uh/Go", "TScalingFlag", "ktFMBoxTextNormal", "4P5{5", "LocalPop", "Inno Setup CodeFile: ", "function RegWriteExpandStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;", "Currentp5u", "0A\\_^", "Access violation", ":0;N;X;d;h;l;p;x;", "R>", "FFixups", "UhItc", "2&2E2M2^2o2w2", "Deleting uninstall key left over from previous %s install.", "BorderWidth", "TInputQueryWizardPage6", "TFloatType", "twMinCaptionInactive", "tfWordBreak", "tmpbPrevHot", "L$D;N", "TrackPopupMenu", "EndOffset range exceeded", "@.tls", "TScrollBar", ">*>D>R>b>w>", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$9$Intf`'@", "skRight", "FWheelMessage", "@^[YY]", "TabDrawGlyph", "?&?Y?", "3TDictionary&", "AllocResource", "hz3Da", "ktbmHorzTop", "clChocolate", "TBZAllocP5i", "soEnd", "TCustomAttribute", "TTask.ExecuteReplicates$ActRec", "2F2t2", "7i8m8q8u8", "InitObservers$0$Intf`'@", "9'9=9K9Z9l9", "EDuplicateStyleException", "PPropInfo", "Failed to get address of %s in bcrypt.dll", "5?5d5", ";*&", ";.;3;C;H;X;];m;r;", "clPlum", "tmcGridCellUpperHasState", "ClientHandleD", "UhCgn", "L$(SVW", "636;6C6K6S6[6c6k6s6{6", "ExStyle", "FDisableIfNoHandler", "GetExtraScanline", "kmgRollRestore", ":Winapi.Imm", "User-Agent", "949D9H9L9T9\\9`9d9h9l9p9t9x9|9", "CancelButtonClick", "D$,+D$P;", "tmcTrailingGridCellHasStateHot", "$TFormStyleHook.TMainMenuBarStyleHook8", "<*f?~?", "ktfCheckBoxTextHot", "cannot write output file", "SelectComponentsLabel$", "Proc: ", "Region", "0j0U1", "OnPaint", "0&1[1i1q1", "[TEnumerable>l_e", "8TDictionaryd", "WriteFunc", "IAsyncResult`'@", "8\"8&8<8_8g8", "TLabel", "PPointer", ";#;';+;/;3;7;;;?;C;", "5(585<5@5H5P5T5X5\\5`5d5h5l5p5t5x5|5", "IsEmpty<", "ktfSmCaptionTextInactive", "System.Win.Crtl", "95:^:~:", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$14$Intf`'@", "tmcTrailingGridCellHasState", "&TEnumerable", ":':;:^:", "4/4Y4", "Inno Setup: User", ">.TItem", "NoModify", "Unchecked", "TContainedActionList6", "InstallMode64Bit", "twMinButtonDisabled", "btnText", "Login", "IsBufferValid", "System.Character", "8Alx3", "version.dll", "0%0,030:0A0H0O0V0]0d0k0r0y0", "1TList.TEnumerator5", "FPrintScale", "InitializeSetup", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$2$Intf`'@", "CanStore", "TTaskDialogBaseButtonItem", "9@:W:v:", "need dictionary (2)", "S`_^[]", "0IWfH", "SHOWEXCEPTIONMESSAGE", "AIsClas", "?9?I?]?u?", "959P9k9", "TTimer6", "ktfButtonTextDisabled", ": ;0;4;8;@;H;L;P;T;X;\\;`;d;h;l;p;t;", "\\TEnumerator>D", "ButtonFocused", "LastSlice", "?!?7?H?a?o?}?", "function DeleteFile(const FileName: String): Boolean;", "6M6c6", "Winapi.ImageHlp", "3,3>3X3f3v3", "5C5M5Q5p5", "0\"000L0X0`0v0", "8#8=8K8Z8m8", "vaSet", "ItemSubItem", "", "clTan", "? ?$?(?,?0?4?8?%>->5>=>E>M>U>]>e>m>u>}>", "t+f;J", ":H:w:", "5G5X5", "&0C0Y0p0", "mvPrivate", "BinaryOp", "FAutoCloseUp", "4 4$4,44484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4~4", "-TEnumerable'", "Inno Setup version 6.6.0", "Install", "S$_^[", "L($\"SA", "FMouseControl", "> >$>(>,>0>4>8><>@>N>`>s>", "hIcon", "0:1J1", "imHanguel", "UserInfoPage,5_", "TList", "InsertComponent", "GTDictionary.TKeyCollection;", "7TList.arrayofT", "FOnNavigated", "=$=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "0c1v1~1", "}&FOu", "kwhtClient", "GetTempDir: GetTempPath failed (%u, %u)", "Procno", "IsHeaderDefined", "737`7", "8'838D8U8f8x8L9P9T9X9\\9`9d9h9l9z9", "VisibleXZQ", "TChunkzTXt", "738p8", ";CLw9", "AllocPattern", "UhTYE", ">??i?y?", "0(060N0V0d0r0", "dsDragMove", "4&5M5", "3 383D3H3L3X3\\3`3h3p3t3x3|3", "6H7a7i7v7", "ExProc", "FPasswordChar", "2,202?2R2^2p2", "ScalePixelsX", "FNeedToUninitialize", "BackButton0._", "2$232D2R2i2w2", "Values,FM", "> >$>(>,>0>=>l>", "Current /E", "%TList.arrayofT", "FMethOfs", ";IComparer`'@", "0D0h0", "9#999K9S9a9s9", "2.2D2X2t2", "tebHeaderClosePressed", "incorrect length check", "tkPointer", "WinClassName", "ktfListItemTextNormal", "9#9>9[9i9|9", "teToggleSwitch", "='=0=P=`=p=", ">2>J>`>s>", "OnDragOver", "2=2A2b2f2", "TComdlgFilterSpecArray", "1$141D1`1", "6$74787<7@7D7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "ttTopTabItemBothEdgeHot", "SystemParametersInfoW", "%TObjectList&", "AsInteger", "wipmLinear", "Category", "uPSUtils", "RunProcPVar", "GetStyleDescriptor", "TList&", "computername", "4\"4&4*4D4Y4g4|4", "\"TList,+P", "function RemoveBackslash(const S: String): String;", "ttdExpandedFooterArea", "5 5.5>5P5m5{5", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$6$Intf`'@", "FRemoveSharedFiles", "ttbDropDownButtonGlyphNearHot\"ttbDropDownButtonGlyphOtherSideHot", ">TDictionary.TItem", "OnTimer", "060L3W4", "This installation was built with Inno Setup.", "function HighContrastActive: Boolean;", "6)6=6R6g6", "claPlum", "TUxThemeGridElements", "FHintControl", "<7=>=b=f=j=n=r=v=z=~=", "RootKey", "FAppIconic", "AText", "pulVal", "FTasksList", "9@9r9", "<4", "<;Rt", "Value", "6 6(6,6064686<6@6D6H6L6P6T6X6\\6i6", "BorderStyle@CA", "FCustomFooterIcon", ">/>D>R>e>{>", "iso_8859-2:1987", "FOwnsEncoding", "CHECKFORMUTEXES", "RVcl.Dialogs", "5#585H5Z5p5", "cp-is", "TTASKDIALOGFORM", "Stack", "AQueue", "Uhf!S", ":v;HS", "SetBiDiKeyboard", "= =(=0=^=b=f=j=n=r=v=z=~=", "CheckDownloadResume", "ktscPage", "FPreparingYesRadio", "&TCollectionNotifyEvent", "PSimpleStringListArray", "FindChunk", "8<8L8P8T8\\8d8h8l8p8t8x8|8", "IsInstance", ": :@:s:~:", "JTDictionary.TValueEnumerator;", ">B?y?", "3qy62", "RestartApplications", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$41$Intf`'@", "DragCursor,GA", "TOnSimpleDownloadNoProgressC", "ZTUWVSPR", "fPPUnitY", "WriteLine", "888T8p8", "DwmGetWindowAttribute", "8$8e8", "tmPopupItemDisabledHot", "BalloonFlags", "RefType", "TCreateProcessOutputReaderPipe", "U:/Q6_", "0H1j1", "S<+Sl;U", "$YZ]_^[", "lpSecurityDescriptor", "Disk full", "Columnsl)>H>f>w>", "ksbcLeft", "8#8H8L8k8w8", "080T0", "(YQ=jmT", "? ?$?(?,?:?B?T?f?x?", "function GetWindowsVersionString: String;", "HtEHtl", "UnregisterWeakMethodRef", "*TList.TEnumerator", "5/595", "0;1p1", "invalid literal/length code", "5&5.565>5F5N5V5", "FBlendColor", "rtBitmap", "D$D;G", "TSeTextObject6", "GetVar", "FSubject", "9&:o:", ";';0;=;K;T;a;o;x;", "StylusHotImageNameXFA", "tgGradientFixedCellHot", "TScriptRunnerOnLog", "1G1K1r1y1", "False", "HasSplitButton", "4'4C4l4t4x4", "MainForm", ";&;0;>;O;Y;e;|;", "93979T9X9s9w9", "THAI_CHARSET", "9%9F9O9", "656=6E6M6U6]6e6m6u6}6", "8#9I9", "FHelpButtonRect", "SetEnhMetaFileBits", "QQQQQQQS", "819h9x9|9", "9+:A:I:Z:o:", "", "TMouseActivateEvent", "System.DateUtils", "InfoBeforeMemo$", "GetSelectedTasks", "AGraphicClass", "Callback#TLoginCredentialService.TLoginEvent", "SelectLabel", ":):7:F:]:", "6%6J6h6", "=>CDE", "ABottom", "ToolItemTextNormal", "OnDestroy\\oG", "SelectGesture", "1*282W2", "DeleteDC", "4)4B4P4", "kpscPanel", "FParentControl", "Version error", "ShowHintL", ";-;?;G;U;d;v;", "TProxyAggregateStream&", "csgb2312", "TTextFileReader3", "tdbDateBorderHot", "{cf}\\Microsoft Shared\\DAO", "2 252=2", "SendMessageW", "TControlCanvas", "ACount", "FComponentsList", "TSendDataEvent", "9[9{9", "?9?_?f?m?t?{?", "ktfComboBoxItemDisabled", "TSetupDisablePage", "TEvent", "ttTabItemLeftEdgeDisabled", "tdpDatePickerDontCare", "2*2c2h2{2", "relocType", "<)<;.TItemArray", "ETPair", "GetLogicalProcessorInformation", "?0?8?F?T?h?{?", "Invalid ImageList Index)Failed to read ImageList data from stream(Failed to write ImageList data to stream$Error creating window device context", "G0u0y0", "FSharedVar", "O-20 >.>@>T>k>s>{>", "tkWChar", "TRttiField", "function IsX64OS: Boolean;", "FStatusLabel", "Cursors", "IComparer`'@", "6z7~7", "FDialog", ")TList.arrayofT", "v4.8.1", "OnFolderChanging", "FOnUpdate", "l$0A;", "FErrorCode", "0w1y7", "CoTaskMemAlloc", "clAzure", "saMinimize", "get_MDIChildren", "FHintHidePause", "FindProcResource2", ":\":*:2:::B:J:R:Z:b:j:r:z:", "GETEXCEPTIONMESSAGE", "2%2B2S2b2", "UNREGISTERFONT", "fsStayOnTop", "TSetupFileLocationEntryY", "<*<91U1Z1p1", "ImmAssociateContextEx", "121C1Y1g1", "4e4z4", "4TEnumerable'", "FCustomElements", "OnGetSiteInfo", ";#;9;[;i;", "Cannot access 64-bit registry keys on this version of Windows", "1'2:2b2o2", "iso_8859-3:1988", "MaxSubKeyLen", "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;", "Sig_r", "5&5.5@5R5d5y5", "4D5|5", "FShowImage", "= =-=?=L=T=b=o=", "FCopyMode", "TInterfaceList&", "BP_^[]", "pyTop", "WorkAreaRect", "AppVerName", "fdCreateNew", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$11$Intf`'@", "FInMenuLoop", "Relocate", "9(9,90989@9D9H9L9P9T9X9\\9`9d9h9l9p9t9", "TSeTabSubclass", "FProcNames", "ktfToolItemTextNormal", ">(>,>\\>", "'TStackPanelControlHorizontalPositioning", "GridDraw", "pRecInfo", "5TList ", "MTDictionary.TItem0", "393C3G3d3t3x3|3", "FSmallChange", "&Close", "tbRadioButtonUncheckedDisabled", "IUnknownH", "=-=@=T=m=u=", "u4WVS", "FindWindowW", "RemoveChangeNotification", "VirtualQueryEx", "FRenderTarget", "khdsDraggedOut", "FDefaultBorderSize", "8N8e8", "ACenterInsideControl", "8<8R8Z8`8n8|8", "btnPost", "uiVal", "textstyle", "OnMouseUpxZQ", ":IEqualityComparer`'@", "AGestureID", "Chord", "/TCollectionNotifyEvent", "FThreads", "0D0H0o0y0}0", "ktisLeftLast", "4 5t5", "84888_8i8", "ShowTopicHelp", ":8;g;", "FFastYearlyArray", "ktfCategoryButtonsSelected ktfCategoryButtonsCategoryNormal\"ktfCategoryButtonsCategorySelected!ktfCategoryPanelGroupHeaderNormal", "FTotalOut", "TLBGetDataObjectEvent", "8/8O8i8", "UhC4G", "Uhc1n", " %u.%.2u", "AddFontResourceW", "UpdateThreads", "020T0i0w0", "!Setup.SecurityFunc", "TResType", "OpenBit", "&", "taAlignBottom", ";,<><", "tspMoreProgramsArrowNormal", "AWizardIconsPostfix", "clAntiquewhite", "CopyRect", "7$7@7P7X7`7h7l7p7t7x7|7", ">:>>>h>t>x>|>", "Keys@9W", "TSelectFolderForm", "?S?W?", "VTEnumerable>'", "FExplicitHeight", "ActiveCustomForm", "ecAccentColorHint", "Uhd.k", "#t6Ht=", "EndOfBlock", ";l$tu", "CLSIDFromProgID", "otSWord", "TSeButtonDrawState", "Key to delete is not deletable.", "TMarshaller.IDisposer`'@", "210322000000Z", "ToPointer", "RadiusX", "0+0@0N0d0y0", "crIBeam", "&", "RaiseCurrentException", "Z_GROUPICON", "FlatFace", "fFilters", "IsAppThemed", "5D5j5", "QNAUV", "wCode", "+TCollectionNotifyEvent", "ProgressGetClientRect", "tfCalcRect", "@SUVWH", "4;4Z4", "GridDrawText", "475f5", "p(1T]", ">:?I?\\?`?o?", "ContainsKey", "IsEmptyD", "FLicensePage", "kbcdsPressed", "JmpRel_E9", "0$050I0Q0b0p0x0", "FOnFolderChanging", "*TEnumerable'", "2*2?2T2l2", "clSalmon", "TEnumerable>", "8#9y9", "FMarquee", "tkInterface", "FInactiveForegroundColor", "AppCopyright", ":(:9:I:Q:_:p:~:", ";-;>;P;j;n;", "Uh=nc", "CTList.TEnumerator5", "tsiTextDisabled", "twSmallCloseButtonDisabled", "TSeListGlyphInfo", "=#=t=", ":\":0:C:T:p:t:", "= >3>P>`>r>", "FViewer", ";D$Dt", "3TList.TEnumerator5", "FBtnLeftDetail", "NewCheckListBox", "IsPublicType", "BackButtonClick", "Winapi.RegStr", ":?;r;", "FStylusHotImageIndex", "tsHorzCenterTile", "Deleted file: %s", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$29$Intf`'@", "Request", ">$><>M>Z>b>p>", "TPropInfoEx", "FOnActiveFormChange", ":&:8:s:w:", "1.1?1T1b1u1", "9$:4:<:D:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "NTEnumerator>", "tcpThemedChevronClosedHot", ":1:8:N:V:\\:i:x:", "FPreemptiveAuthentication", "=$=8=N=a=i=w=", "ParentDoubleBuffered", "VTDictionary.TKeyCollection;", "tmbSeparatorHot", "EVariantDispatchError", "CharToOemBuffA", "? ?$?(?,?0?4?8?>'", ":M;Q;U;Y;g;u;", "Uhukd", ": :P:T:{:", "clLightblue", "Invalid variant type conversion", "6+6@6P6`6p6", "FInstance", "6(666E6\\6o6", "0'0;0O0", "TPSList(", "SetupMutex", "FSizingDC", "GetPrivateProfileStringW", "2;2K2\\2t2", "71757S7{7", "bdRightToLeft", "ISADMIN", "9?:>(", "tmcNavPrevPressed", ">#>'>+>/>3>7>;>?>C>", "4-4;4M4\\4d4t4", "/IEnumerable", "pbData", "9,:s:", "001F1V1\\1n1z1", "*0Z0q0", "Be u%", "GetStyleColor", "FAutoMerge", "7TPair", "qps-ploca,ja", "NTDictionary.TPairEnumerator;", "<=.TValueEnumerator", "FOnDialogConstructed", "7 7$7(7,7074787<7@7D7H7L7Y7o7w7", "565=5R5V5Z5^5h5|5", "tbRadioButtonCheckedPressed", "ADefaultExtension", "Drawing", "TGestureEventInfo ", "GrabberVert", "Vcl.GraphUtil", "/SaveInf=", "FConnectionTimeout", "Helper isn't responding; killing it.", "PreProcessMessage", "=$>d>h>l>z>", "fdoNoReadOnlyReturn", "BeginExecute", "9<:Q:_:q:", "Uh-Er", "FMDIChildClientOffsetCX", "%TObjectList&", "4#4+434;4C4K4S4[4c4k4s4{4", "pszManifestFilePath", "UserInfoOrgEdit", "UhT}J", "HorzSlider", "TReferenceNameEvent", "454^4", "ParamInfo", ";!;3;B;J;\\;", "TCredentialsStorage.TCredential", "TRttiFloatTyped", "TInteractiveGestureOptions", "Uh=Dd", "5!9*9z9", "3TList.ParrayofT`", "=!=2=H=Y=g=o=}=", "\\$8Vj", "GetKeyboardLayout", "2%3]3", "3%4M4", "031U1t1", "Shared.DebugStruct", "ufAlwaysRestart", "[6x8J;a;", "tfLeft", "clBlueviolet", "7 7$7,7074787<7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "fCritical", "Collisions0FI", "d28]w", "Unregistration successful.", "MoveFile", "2*2@2O2W2e2p2", "Size@", "4(484K4^4l4~4", "ttdExpandoButtonHover", ">(?o?", ">,>4>Y>a>{>", "SaveInf", "vaCurrency", "1-1C1]1r1", "CallSpawnServer: Unexpected response: $%x", "NextToken", "diGrayscale", "Y_^[Y]", "+TList.TEmptyFunc`'@", ";#;1;H;V;i;y;", "TSysScrollingStyleHook", "030D0W0h0{0", "tfFlyOutLabelSlected", "GetAlphaScanline", "TGlassFrame6", "?%?)?-?H?P?j?n?r?", "szInfoTitle", "3#3(363;3G3L3Z3g3l3~3", "9H:w:]=", "626I6Q6_6r6", "dJ&)93", ">!>/>=>Q>i>|>", "FActive", "tmpbPlayDisabled", "FParamList", "tfSizeToContent", "AdjustWindowRectEx", "function InitializeBitmapButtonFromStockIcon(const BitmapButton: TBitmapButton; const Siid: Integer; const BkColor: TColor; const AscendingTrySizes: TArrayOfInteger): Boolean;", "+TList.TEnumerator5", "akBottom", "clLightsalmon", "FPreparingMemo", "IOleObject`'@", "SecureProtocolsH:h", "uintVal", ":(:2:P:`:d:h:p:x:|:", "5TListT", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$42$Intf`'@", "*TList.ParrayofT\\NF", "cp1257", "7\"727P7o7", "MSWHEEL_ROLLMSG", "EHeapException,", "9$9O9", "tmcGridCellHasStateHot", "TChunkgAMA_", "TTask(", " :TMultiWaitEvent.TMultiWaiter.:1", "1)1>1L1Z1o1}1", ".TEnumerable'", "April", "tpUpNormal", ";TListt", "_DGWeeeee", "%s5Could not convert variant of type (%s) into type (%s)", "CreateSuspended", "tpDockPanelHorzSelected", ".TList.ParrayofT0", "DefaultFolderT", "070;0T0`0d0h0l0p0t0|0", "149l9{9", "skFMXLabel", "Exception3", ";1;Q;b;B<", "FSnapBuffer", "AsSet", "$TList.arrayofT", "Registering 64-bit type library: %s", "6$6,6064686<6@6D6H6L6P6T6X6\\6`6m6", "GetImageList", "SetText", "TSeTextObject", "3B3o4", "cTDictionary.TItem", "?ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$4$Intf`'@", "TOnSourceLine", "EPropReadOnly", "GetType", "EInvalidGraphicOperation", ";TEnumerator(", "realm=\"", "lTDictionary.TKeyCollection$", "6!7?7", "CaptionFont", "9&939D9f9s9", "8$828@8T8g8v8", "VTEnumerator>(", "RegCreateKeyExW", "FOnAlignPosition", "tgGridRoot", ";,;c;", ";(;=;W;j;|;", "pfReference", "D$(RPQ", "'TChildFormMessageHandler.TSysButtonType", "AConstant", "DecompressFile", "=Q=q=z=", "FLockCount", "ServerCredential", "Uh8(j", "VerQueryValueW", "btnPlay", "D$|;F", "EVariantNotImplError@SC", "/:*?\"<>|", ">\"?&?*?.?2?6?", "OnNavigated\\oG", ".TArray>", "6&6@6J6e6k6", "Unmerge", "First", ";7;;;?;C;G;K;O;S;W;", "csshiftjis", "3;3b3", "tmpbBackHot", "TBoundArray", "userdocs", "3%333E3_3m3}3", "8-8C8V8o8", "tmpbBackNormal", "UNPINSHELLLINK", "0+030S0u0", "HTDictionary.TPairEnumeratorh", "Line too long List capacity out of bounds (%d)", "TFileFormatsList&", "6'6=6L6X6f6u6", "TTypeData", "e|5JB", "function LogFmt(const S: String; const Args: array of const): String;", "teMenu", "P+]VW", "CategoryButtonsGradientBase", "?'?8?Z?g?x?", "hTDictionary.TItemArray", "AURLClientClass", "iso_8859-16", "TSysListBoxStyleHook7", "FRestoringConstraints", "pvarRole", "*TEnumerator", "ktfGridItemFixedNormal", "FStdErr", "GetVar2", "EnableWindow", " TEnumerator(", ";ScriptFuncLibraryRegister_R.RegisterOtherScriptFuncs$6$Intf`'@", "8':3:::B:Q:[:m:", "PRQh|", "6!676U6]6e6m6u6", "imSKata", "4+6i6|6", "? ?$?(?,?0?4?8?6O6]6e6s6", "CheckSysClassName", "Expand", "TEnumerator", "TCursorRec", "6h8ig", ":P:X:x:", "RunList", ":Shared.CommonFunc", "EPNGUnknownInterlace", "0@1I1", "3!3)373E3Y3a3o3}3", "8)8-8T8[8b8i8p8w8~8", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8y8", "ExtraClientWidth", "ttsHyperLinkTextPressed", "CalcSize", "%TEnumerable'", "AChecked", "tpDownHorzHot", "000F0W0o0w0", "srTop", "Unable to load style '%s'", "comctl32.dll", "FOwnsStream", "eeRaised", "TSeStyleFilterp", "1,1I1W1g1|1", "zcFastest", "2#2+232;2C2K2S2[2c2k2s2{2", ">L?Z?l?", "TAlign", ";ScriptFuncLibraryRegister_R.RegisterOtherScriptFuncs$2$Intf`'@", "2TPair", "NotifyNewLanguage", "TSeState", "claOlive", ">+>3>A>Q>_>w>", "4Y\\\\ddd", "TypeInfosT", "6&6B6a6j6o8~8", "FKeyPreview", "PVmtMethodEntryTail", "claDeeppink", "1J2T2Y2^2", "FCurrentPosition", "WakeConditionVariable", "teEditBorderVScrollFocused", "grfStatFlag", ">)>J>N>R>V>Z>^>b>f>j>n>r>v>z>~>", "FindComponent", "clLightyellow", "ErrorStr", "=#>n>", "Can only call function \"ExpandConstant\" within parameter lists", "AEngineClass", "Bytes", "*TDefaultLoginCredentials.LoginEvent$0$Intf`'@", "*TList&", "SetWindowsHookExW", "060H0V0c0k0y0", "TPSAttributeUseProcs", "5%565C5Y5q5", "EInvocationError", "Vcl.WinXPanels", ">(>6>f>s>", "GetDlgItem", "303H3e3x3", "tsGripperVertPressed", "3(3=3E3", "<%<,<3<:>,?I", "TypeCount", "?6?_?", "GetParentOf", "sfSmCaptionTextNormal", "676F6]6", "clLightcoral", "TNewNotebookPage", "csReflector", "trGripper", "TCustomFormD", " TList&", "ExportPublicKey", "393p3{3", "kpbcRollRight", "cmZip", "7$7,747<7@7D7H7L7P7T7X7\\7`7d7h7l7p7", "Uninstalling from GAC: %s", "#TEnumerator(", "99:h:s:", "tcReadOnlyDisabled", "Recreate", "bmiColors", "FAbortButton", "CalcHintRect", "PendingFileRenameOperations", "5P6e6s6", "9)9>9S9f9t9", "Uh+rk", "SVWQf", "@d+FD+", "fbuffer", "Deleting file: %s", "C\\+D$", "function ParamCount: Integer;", "function IsX64Compatible: Boolean;", "> ?0?8?@?H?L?P?T?X?\\?`?d?h?l?p?t?x?|?", "TCustomZStream${P", "454D4L4\\4", "=%=3=E=_=m=}=", "BRINGTOFRONTANDRESTORE", "262I2Z2m2{2", "Control<6Q", "Uht`Y", "TSeActiveStyleObjectP", ">0>u>", "TMarshaller.TDisposer'", "BTDictionary.TKeyEnumeratorH", "-IEnumerable", "Uh(.V", "R4YZ^[", "PageSize", "TCustomStyleTreeViewElements", "RadiusY", "function WizardDirValue: String;", "tgGradientCellRowSelectedRight", "<&<2<@2", "ParamList", "TBreakCondition", "9#9B9J9R9Z9b9z9", "646<6J6[6p6x6", ">)>9>G>[>u>", "404u4", "Non-default bitness: 64-bit", "9%939O9W9e9w9", "1$121B1U1f1y1", "DockDraw", "EVariantArrayCreateError", ";TObjectList$", "FOldIdx", "FLicenseMemo", "Uh0$f", ":2;?;t;", "FreeInstance", "TVarRecord", "tgCellNormal", "8)8D8^8v8", "7Q7f7w7", "5f5u5", "epWordEllipsis", "CharCase", "415w5", "TWinHttpLibh", "clMediumvioletred", "CTPair", "Setup.SpawnServer", "Public_y", "function GetSHA256OfStream(const Stream: TStream): String;", "IsDarkInstallMode", "Asking user for new disk containing \"%s\".", "SubRect", "757t7", "InheritsFrom", "1/1E1^1y1", "FOnStateChange", "2$2(2,2024282<2@2D2H2L2P2T2X2|2", "4)414?4L4^4z4", "need dictionary", "C#2C 2j", "stream end", "function ExpandConstantEx(const S: String; const CustomConst, CustomValue: String): String;", "tcbCategorySelected", "wParam", "Q#>=>[>l>w>{>", "8=8m8", "D2D1_DRAW_TEXT_OPTIONS", "Systemd1e", "* cf.", "GoForward", "6+6?6R6Z6h6u6", "=-=K=", "20251124160441Z", "ExtractTemporaryFiles: Invalid character in matched file name", "=<=Q=l=", "z KLgy", "CertFindChainInStore", "= =$=(=D=X=\\=x=", "FKeyIndex", "XKENu", ":TDictionary&", "Vcl.ButtonGroup", "5TCollectionNotifyEvent", "4Y4k4{4", "?-?@?D?K?^?r?", "mkSafeFunction", "4*4B4S4l4z4", "%TEnumerator", "^&''YZZ\"", "Endian", "<$<2.arrayofT", "UhK`t", "AsInt64", "efAdjust", "0'0/0J0p0x0|0", "SysParent", ":3;U;t;", "2%202o2", "TCookie", "TStreamCapability", "DragModed", "7,7>7S7_7g7x7", "FVerticalAlignment", "<.===", "0 0(0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "(TList.TEnumerator", "8A8[8t8|8", "tpDownHorzDisabled", ">ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$3$Intf`'@", "8*898P8", "csSimple", "626D6c6g6", "UninstallProgressForm", "UhLzR", "cTDictionary>.TItemArray", "AUsername", "IOffset", "TSeLabelDrawState", "ReadSingle", "=TEnumerable0td", "RegisterServerData", ":.:D:Y:g:y:", "kescComboBoxLeft", "1$1,141<1L1T1\\1d1h1l1p1t1x1|1", "function ExecAsOriginalUser(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer): Boolean;", ";D$Xwi", ">:?h?", "CreateStdAccessibleObject", "TTaskDialogProgressBar7", "TEnumerablel", "IsEmpty0", "TEnumerable>'", "csisolatin2", "MoveFileEx", "5'6F6O6", "System.Win.TaskbarCore", "ttPane", ";\"<,<0.TKeyEnumerator(ce", "sfMenuItemTextSelected", "tsGripperHorzDisabled", "WStrSet", "TLZMACustomDecompressor'", "90E0X0", "(A;OICI;", ">->7>;>X>h>p>x>", "ktfPanelTextNormal", ".!OJ$d", "939A9T9d9s9", "CSVWQ", "TScrollingWinControl6", "&op_UnaryPlus", "=%===[=n=", "|Winapi.Windows.PkgHelper", "?0???G?U?d?r?", "303Q3_3q3", "FormHook", "clPowderblue", "parray", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$22$Intf`'@", "FDeviceContext", "RestartManager", "?(?C?T?j?|?", "TSharedImage\\", "e;sDu", "IHelpSelector`'@", "4;4`4", "Fixed", "HasSubKeys", "function SuppressibleMsgBox(const Text: String; const Typ: TMsgBoxType; const Buttons, Default: Integer): Integer;", "TShortCutEvent", "ssMaximized", "=\"=4=F=X=j=|=", "0)0:0O0W0", "IsEmpty$", "FExportedVars", "%TArray", "ExportNameHash", "DTDictionary.TValueCollection;", "THTTPDataReceiver.TResult", "#TEnumerable8zF", "4)4>4D4P4_4u4{4", "HeaderDrawGlyph", "<0=e=t=", "8 80888@8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "#TEnumerable", "22282D2H2L2P2X2`2d2h2l2p2t2x2|2", "FReceiveDataExCallback", "HorzRightRect", "BHl~q", "FromOrdinal", "aaaaa", "ShowImage", "EVariantBadIndexError,QC", "RebarWindow32", "EditMargins", "Uhv,Y", "4&4<4J4\\4g4o4}4", ">'>>>S>a>t>", "TLS11", "TSeEditButtonInfo", "dddd, dd MMMMM yyyy HH:nn:ss", "5%5J5", "1TList.TEmptyFunc`'@", "ceftEnabled", "1-1B1P1_1q1", " ", "teEditBorderVScrollNormal", "3`3d3P5T5X5\\5`5d5h5l5p5t5x5|5", "clsid", "NewDockSite", "MaxWorkerThreads", "FrameIndex", "TForm", "TPSInternalProcRec'", "626=6B6R6]6b6r6}6", "tdnbLastPressed", "PrepareToInstallFailureMessage", "APrivateKey", "biXPelsPerMeter", "%.4u-%.2u-%.2u", "COMPARETEXT", "2-3:3N3]3t3", "SetEvent", "function GetDateTimeString(const DateTimeFormat: String; const DateSeparator, TimeSeparator: Char): String;", "k`+l$L", "373m3", "CreateInputQueryPage", "npbstNormal", "tcpChevronClosedLeftHot", "3'3/3<3Q3b3v3", "UhT1v", "IsClear", "GetControlIndex", "skLineUp", "?1?9?G?Y?o?", "bsSizeToolWin", "3'3S3m3", "FKind", "scale", ":TTaskDialogForm.:2", "ASite", "ReturnType", "Visible@oG", "TPanningWindowClass", "Rolling back changes.", "CurrentBuild", "8 8$8(8,8084888<8@8D8H8L8P8T8l8~8", "FFontList", "FAsSingle", "2 2$2(2,2024282<2I2b2{2", "=V=h=", "1%1;1C1Q1d1", "checklistbox", "PProcedureParam", "4 424H4V4e4x4", "=%=*=", "eP>.;", "localappdata", "UhHgf", ";TEnumerable", "<$<(<,<4<8<<<@\\?k?", "989&:@:", "?\"?/?B?Z?v?", "CaptionTextNormal", "InitialSize", "Invalid property path", "ReplaceDockedControl", "iso-8859-8", "kmscMemo", "GetThemeSysInt", "FGuid", "GETWINDOWSVERSIONSTRING", "WizardSmallImageBackColor", "Jt'Jt5", "ZlibInitDecompressFunctions failed", "claGoldenrod", "DebugInfo", "GETINIBOOL", "lpfnWndProc", "595O5h5", "IsRightToLeft", "Variant overflow", "_RTL_CRITICAL_SECTION", "FOpenedSlice", "TCaption", "TGlobalContext", "FColorList", "93:H:]:r:", "AsVarRec", "1J1Q1Y1u1", "UnitScope", "hij@klmn-opqArstuBwxyz{|}~", "teEditDontCare", "InstanceClass", "FIcon", "MainStackPanelt", ";$;,;4;<;D;f;", "= =$=(=,=0=8=@=H={=", "404Q4", "Cannot create file \"%s\". %s", "Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)", "TMarshaller", "TBasicActionLink", "ScaleForDPI", "FScaledBitmaps", "7&777E7M7[7k7", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$52$Intf`'@", "clFloralwhite", "tdnbApplyUpdatesPressed", "g$}4\"}-", "Enable", "hStdOutput", "kmdsDisabled", "*IComparer`'@", "rdMultiString", "tspMoreProgramsArrowBackPressed", "OnResize4", "ControlWnd", "RESTARTREPLACE", "TAlignment", "", "user32.dll", "StrongAssemblyName", " language=\"*\"", "FOnHint", "@TDictionary.TItem", "tebHeaderBackgroundHot", "mtidsNormal", "tcTransparentBackgroundFocused", "474t4", "%TObjectList4", "TEnumerable", "9,9N9R9l9|9", "DrawRoundedRectangle", "claOrchid", "iso-2022-jp", "teEditTextAssist", "SetFileInformationByHandle", "DTDictionary.TValueEnumerator\\", "737D7\\7m7", "Extended", "ShellExecuteEx failed (%d).", "tsArrowBtnUpHot", "TObservers.TObserverAddedEvent`'@", "poProportional", "TSELECTFOLDERFORM", "=(=c=l=", "-IComparer`'@", "3?3h3o3v3}3", "teEditBorderNoScrollDisabled", "IsThemeDialogTextureEnabled", "Separator", "5\"5C5X5f5z5", "5%5H5X5`5h5p5t5x5|5", "itinfo", "teEditTextSelected", "spvpFill", "fpDefault", "ExtractTemporaryFile: The file \"%s\" was not found", ":%:):H:T:X:\\:`:h:p:t:x:|:", "thHeaderItemRightHot", "DeleteFileW", "PixelInformation", "ReplaceColor", "FRichEditViewer", "tTDictionary.TValueEnumerator;", ":\":;:V:^:f:n:", "AQualifiedName", "SetProc", "TChaCha20Ctx@", "666>6I6W6`6m6w6", "kbidsPressed", "Signature is bad", "sbsDown", "283d3", ".arrayofT", "Uh7N\\", "142v2", ";/;6;=;D;P;`;h;p;x;|;", ":!:+:0:A:V:b:h:p:|:", "RetryButton", "RmShutdown returned an error: %d", "5\"505=5O5a5s5", "323;3\\3s3", "GetURLClientInstance", "TSeToolGlyph", "TGraphicControl6", ";!;9;Q;i;", "function IsAdmin: Boolean;", "function GetPreviousData(const ValueName, DefaultValueData: String): String;", "ksadsNormal", "AES_192", "CallCleanupX", "5 515J5[5y5", "UInt64", "CurrentD6M", "ibm863", "Owner\\oG", "3$3,3<3z3~3", "'Sectigo Public Time Stamping Signer R36", "function MakePendingFileRenameOperationsChecksum: String;", "function PackVersionNumbers(const VersionMS, VersionLS: Cardinal): Int64;", "teHint", "NTEnumerable>(,W", "Successfully deleted the key.", "itMask", "TImageMargins6", "clLightseagreen", "TabWidth", "TCheckBox(", "", "t)j7j", "3G3X3u3", "SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v2.0", "DesignInfo", "Margin", "7(7L7P7w7~7", "TStringsOption", "scComboBox", "4'4=4Y4l4{4", "Handler", "ActionComponent\\oG", "TSeBarDockInfo", "<.=N=e=", "9 989M9[9n9", "Scaled", "HasPalette", "FOle2Menu", ";Z;r;{;", "=$=x=|=", "function IsX86Compatible: Boolean;", "(TArray", "1+1T1", "OKButtonl", "Uninstall Tool ", "7.7<7S7h7v7", "File I/O error %d", "&TListx", "GetCurrentDirectoryW", "GETSHA1OFSTRING", "FWSession", "Vcl.Controls.ParrayofT", "TStyleHookClass", "868R8[8", ";(;4;8;<;@;H;P;T;X;\\;`;d;h;l;p;t;x;|;", "maActivate", "TEnumerable'", "i6H6X6\\6`6h6p6t6x6|6", "RightClickCancelsP+Q", "EA>P?", "4!4<4D4\\4`4~4", "393a3", "tcpChevronOpenedHot", "3#3X3o3", "TResourceManager", "5\"585F5N5\\5n5~5", "SYSERRORMESSAGE", "6+777", "hSystem.Win.Taskbar", "OriginalSize", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$27$Intf`'@", "EnumFontFamiliesExW", "4+5j5", "akLeft", "tpTransparentBarVertNormal", "ACapacity", "UhNX`", ";ClwD", "clBrown", "PhH0x", "<`.TPairEnumerator", "kcdsUncheckedNormal", "''%s'' expectedECheckSynchronize called from thread $%x, which is NOT the main thread", "607D7T7", "pmBlack", "TOutputMsgWizardPageD", "Version of our file: (none)", "5 50585@5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "t$DVS", "paArm32", "hpAbove", "ACheck", "%LazyLoadAttributes.MakeClosure$ActRec", "LoadFromClipboardFormat", "FShow", "tlLinkNormal", "6$6(6,60686@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "SetDefaultIcon", ":$:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:m:", "vaWString", "4f6t6", ">'>=>R>`>w>", "tspMoreProgramsTabSelected", "6'6-676A6G6Q6[6a6k6u6~6", "Container", "2t2|2", "tpSysTop", "2\"2'24292F2K2X2]2j2o2|2", "BeveledLabel", "Invalid style handle", "claBlue", "TPSListD", "93:f:", "3/373N3V3l3t3", "tcDropDownButtonLeftPressed", "8)8;8K8S8a8s8", "?!?5?9?=?A?f?{?", "ShowLinesXFA", "TFontStyle", "9*9G9t9", "FActiveClass", "pfConst", "9*949X9d9h9l9p9x9", "cnDeleting", "8\"888J8_8", "8$8V8\\8", "tsGripperHorzPressed", ":0:@:D:H:L:P:X:\\:`:d:h:l:p:t:x:|:", ";$;,;_;q;", "?*?.?2?6?:?>?B?F?J?N?R?V?Z?x?|?", "aType", "8 8H8l8", "4 4'41454W4[4}4", "4!4q4", " ", "666@6", "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);", "7(707>7N7\\7t7|7", "tsScrollBarDontCare", "2V3m3", "_od#:.", "(TList.TEmptyFunc`'@", "CaretPosd", "9D:H:L:P:h:t:x:|:", ">,>:>M>\\>n>", "2 2$2(2,2024282<2@2H2P2X2`2h2p2x2", "GetInitializeSize", "GetThemeSysString", "1:1B1J1R1Z1b1j1r1z1", "FHintColor", "&op_GreaterThan", "OnFindComponentInstance", "FMouseInNCArea", "BZ2_bzDecompressEnd", "BTPair", "PTypeInfo", "WizardBitmapImage2$", "TChildControlInfo", "6)6@6S6l6", ";$.ParrayofT", "csibm861", ",Y]Lac-", "@ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$10$Intf`'@", "tttWrenchNormal", "FDockManager", "MaxClassesInCache", "Setup", "ibm860", "Viewer", "UhhmC", "bsEnabled", "9,9?9U9c9s9", "TSeStyleMetrics", ";5;];", "System.Generics.Collectionsx>h", "FDescription", "CharCount", "File hash is incorrect", "CheckSerial", "seltype", "!TEnumerator(", "TIUnknownH", "4 4+40454@4E4J4U4Z4_4j4o4t4", "4 4(4,4044484<4@4D4H4L4P4T4X4\\4d4", "758O8", "PhlQk", "VTDictionary.TKeyEnumerator;", "[TArray>", "1%191L1d1", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$12$Intf`'@", "TWICImageFormat", "Setup.Install", "IsGridDefined", "tfFlyOutDontCare", "-TCollectionNotifyEvent", "ZTDictionary.TValueEnumerator;", "CatgeoryButtonsCategorySelected", "TMarshaller.TDisposeRec", "9TEnumerator(", "ISWILDCARD", "emContent", "SLEEP", "6&6-646;6B6I6S6W6w6{6", "=9=^=", "TPNGTransparencyMode", "Scanline", "8#8@8r8}8", ">2>B>P>b>x>", "Uh]0d", "jjjjj", "dkMessage", "FCommonPrograms", "csPenValid", "EBitsError", "=.=@=H=V=d=x=", "DTList.arrayofT", "IgnoreIndex", "AnEncoding", "tcbCategoryGlyphClosed", "tcbCategoryChevronClosed", "XLSQR", "?ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$6$Intf`'@", "BeginDraw", "twMaxCaptionInactive", "2I3\\3", "0!020G0S0[0k0", "ClipRect", ";);7;F;Q;c;s;", "PercentDone", "GetBool", "5R5V5}5", "OnSendData", "FAsObject", "Params", "8!8<8@8\\8", "TCloseEvent", "<(<:`'@", "Fonts", "3+3?3P3d3u3", "GetWindowsDirectoryW", "61cjD", "DialogFontBaseScaleWidth", "ttbThumbHot", "405S5v5", "claMediumvioletred", ";'<4<", "FSize", "tbCheckBoxMixedDisabled", "Inno Setup home page:", "csibm869", ":2:A:X:", "FMargin", "9+9:9O9", "MenuEnter", "9*929N9V9w9", "xXZZ\"", "kbdsCheckedFocused", "0)1<1", "Include", "~Setup.WizardForm", "Uh\\sS", "7 70787@7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "9L:[:e:", "WizardSelectedComponents", "/TCollectionNotifyEvent", "IComparer`'@", ",IEnumerable", "psInsideFrame", "FBreak", "BeginTrace", "7a-eF", "46;6f7", "IsValidLocale", "8$8,848<8D8L8T8\\8d8l8t8|8", "_CERT_PUBLIC_KEY_INFO", "7Su.4", "3 3$3,3034383<3@3D3H3L3P3T3X3\\3d3h3p3t3x3|3", "0u1S2", "buffer error", ";4)>D>R>d>v>z>", "kwdsRolled", "UnRegisterStyle", "", "FTaskCountdown", "SaveData", "bsDiagCross", "~Q>\"h", "AIntf", "TLBFindDataEvent", "zlib: Internal error. Code %d", ":TReader.:1", " = function", "ttbBackgroundLeft", "PListp", "TThreadPool.TBaseWorkerThread;", "TGesturePointArray", "doOwnsValues", "DataModules", ":/:7:", "ttsToggleSwitchDontCare", "WaitForSingleObject failed: ", "TCustomTaskDialog6", "1/2X2c2l2", "5W7y7", "ExceptOffset", "twMDIRestoreButtonNormal", "G Z_^[", "AcceptEncoding", "COMCTL32.dll", "NumIniEntries", "3.3H3V3f3y3", "8 818?8G8U8d8", "UpperCase", "RemoveComponent", "FRightClickCancels", "<,<@5", "TlsSetValue", "UhBXf", "StrSet", "8%8B8^8~8", "CastToVarRec", "sphpLeft", "TSeStyleSysColors6", "939;9C9K9S9v9", "T$(F;", "2!222H2P2^2t2", "< <$<(<,<0<=`'@", "<&<8`xX", "twFrameRightActive", "WriteByte", "FolderTreeView", "8(94989<9@9H9P9T9X9\\9`9d9h9l9p9t9x9|9", "FGlobalVars", "CertFreeCertificateContext", "7&797H7Z7m7u7", "7#8k8", "aClass", "FExplicitWidth", "SetNonBiDiKeyboard", "ReadCurrency", "ReadyMemo$.^", "0&070L0]0k0s0", "TSeTabButtonClass", "C`@t-", "clGradientInactiveCaption", "PK:SKu", "Invalid argument to time encode", "tsLowerTrackVertPressed", "EraseRect", "function GetShellFolderByCSIDL(const Folder: Integer; const Create: Boolean): String;", "Rni($", "7!8l8", "TNameValuePair", "tiBoolean", "BCryptVerifySignature", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$20$Intf`'@", "goSkew", ">p.NB;", "Existing file is protected by Windows File Protection. Skipping.", "FLastReportedProgress", "0/0G0_0w0", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;`;", "-0.bin", "?ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$ActRec", "Invalid access$Error creating variant or safe array)Variant or safe array index out of bounds", "TSysTabControlStyleHook7", "twSmallMinCaptionInactive", "Ce tm", "=TEnumerable", "FMenuItem", "CompareFileTime", "StatusDrawText", "?2?D?S?w?", "LineDDA", "CheckTokenMembership", "sr-Latn-RS", "next_in", "4!4*434<4J4#5", "Not restarting Windows because Uninstall is being run from the debugger.", "JTEnumerable>", "TObjectCache.PCacheEntry", "(invalid)", "Vcl.SysStyles", "CurStep", "EditBoxTextSelected", "Style class '%s' not found", "Warning", "6<6c6", "ShowWindow", "Cannot hide an MDI Child Form)Cannot change Visible in OnShow or OnHide\"Cannot make a visible window modal", "RichEdit41W", "iso_8859-14:1998", "tipClose", "8-9m9", "lrDefaultColor", "scPageUp", "25292=2A2E2I2M2Q2U2Y2]2a2e2i2{2", "FFontDisabled", "5*5E5O5T5x5}5", "FPressedColor", "erInvalidOpcode", ";!.TPairEnumeratorx", "GetDiskFreeSpaceW", "%1 %2", "/NoStyle", "TThemedTaskBand", "GetLocalTimeType", "747X7z7", "ctNative", "TPositionData", "ImageIndex@", "tpFillVert", "0 0$0(0,0004080<0@0D0H0L0P0T0l0}0", "EOperationCancelled", "BarDrawText", "6!6<6W6r6", "OnActionUpdate\\oG", ")TList&", "ToString", "CheckToken", "cOk4G", ">4>K>Y>p>", "laDestUnique", "commonstartup", "6(656=6K6X6j6|6", "243M3l3", "TPrivateHeap", "PrevSelectedComponents", "94999W9l9q9", "Uhdpi", "claDarkolivegreen", "FSavedActiveCard", "8*848D8L8T8\\8`8d8h8l8p8t8x8|8", "FServerCertificateValidated", "0<1S1r1", "CreateParentedControl", "fdoAllNonStorageItems", ";#;D;L;o;w;", "FBufSize", "BeginGetRange", "4%4M4", "Windows Server 2008", "%d_AsyncMessage", "3\"3*383J3]3e3s3", "p8022", "TFolderTreeViewt", "Terminate", "Restore", "dmAutomatic", "function RemoveQuotes(const S: String): String;", "sloCompareStrings", ":&:4:F:V:^:l:~:", "wrSignaled", ":TApplication.:1", "AdjustHeight", "0(04080<0@0H0P0T0X0\\0`0d0h0l0p0t0x0|0", ":%:F:T:d:v:", "Winapi.WinHTTP", "UhN_f", "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;", "7)7;7C7Q7c7y7", "Registering 64-bit DLL/OCX: %s", "TExceptionHandlerEvent", "000<0L0P0T0\\0d0h0l0p0t0x0|0", "TSeScrollAreaDrawState", "tpMoveOverlay", "RegisterVirtualConstructor", "1W1G4s4w4{4", "Out of system resources", "1[3p3|3", "TRttiProcedureTypeQ", "FnumItems", "=ScriptFuncLibraryRegister_R.RegisterInstallScriptFuncs$2$Intf`'@", "tspLogOffSplitButtonDropDown", "ecTextColorHint", "compressionLevel", ";TEnumerablexQM", ">\">8>F>S>d>", "0TList.TEnumerator", "UhY/D", "gdi32.dll", "windows-1250", "argErr", "K>O>S>W>[>_>m>{>", "UnhandledExceptionFilter", "TBorderWidth", "363>3_3", "TrackOn", "PRQhX", "?1?K?Y?h?{?", "About", "TRttiPackage'", "9/9U9]9v9~9", "7\"727B7R7b7r7", ":/:V:", "TThreadLocalCounter'", "skFMXListBox", "3TPair", "Winapi.FlatSB", "Item not found", "4TEnumerator@'M", "FStatus", "PopupMenu", "function ScaleX(X: Integer): Integer;", "UhE;r", " version=\"6.0.0.0\"", "CTDictionary.TItem", "function CreateOutputMarqueeProgressPage(const ACaption, ADescription: String): TOutputMarqueeProgressWizardPage;", "s@_^[", "DeleteUninstallDataFilesProc", "FAnchorMove", "FInternalPopupParent", "IEnumerable", "323@3O3_3q3", "=$=6=L=]=p=", "FListBoxInstance", "dispIDMember", "FYOffset", "8]8f8k8t8", "skFMXTabImage", "FinallyOffset", "BeginInvoke", "AComponent", "tbCheckBoxCheckedNormal", "TScriptFuncTyp", "FixString", "9/9X9", "GetReferenceToRawData", "7\"7*7.7D7L7j7r7v7", "FWindowHooks", "2$222>2L2Y2]2q2x2", "1 1(10181@1H1P1X1`1h1p1x1", "FGHIJKLMN&OPQRS", "SetScrollRange", "greek8", "AIntegerType", "5+565D5Z5h5x5", "UninstallString", "<%=4=?=P=X=o=}=", "8F9n:", "GetKeyboardState", "PathEdith", "clScrollBar", ":TEnumerator>(", "ReadMethod", "CurrentPPI", "1 2P2", "TArray>", "FPSExec", "SAMESTR", "TPSExternalProcRec,", "NoIconsCheckClick", "DTDictionary.TValueEnumerator", "WU|UEm", "SetViewportOrgEx", "FromDays", "function CopyFile(const ExistingFile, NewFile: String; const FailIfExists: Boolean): Boolean;", "InstanceRoot", "PADTPF0", "6=6J6Y6k6p6", "3I4i4", "TRttiEnumerationType", "7G8|8", "LCMapStringW", "EnumByCategory", "ShowLanguageDialog", "(Uninstall Tool Setu", "EOperandSizeMismatch", "NTDictionary.TPairEnumerator", "bmBits", "BeginPut", "ATPair0", "iso_8859-1:1987", "FAccObjectInstance", "ITDictionary.TPairEnumerator;", "5%6)6P6Z6|6", "4TCollectionNotifyEvent", ">3?'", "7.7@7H7V7d7y7}7", "BALTIC_CHARSET", "7$797=7T7^7b7", "FSystemColors", "iso8859-9", "?(?P?`?h?p?x?|?", ":*:|:", "tpBarVert", "TChunktIME", "=\"=*=2=:=B=J=R=Z=b=j=t=", "FSourceEnd", "DownloadTemporaryFileWithISSigVerify", "MenuAnimation", ".ParrayofT", "ExecAndLogOutput", "FSafeExcHandler", "function ExtractTemporaryFiles(const Pattern: String): Integer;", ">N?X?", "7=8j8", "2'2:2", ";<;P;];q;~;", "twSmallCloseButtonHot", "SetInt", "NumberParameters", "FromEnd", "TSeTextStyle", "Kl;K`r", ":):7:F:Y:s:", "TArray", "TMouseMoveEvent", "<(<=P>k>z>", "EClassNotFound", "An unexpected memory leak has occurred. ", "AcceptList", "PushVal", "Invalid slice header (4)", "c\\J$y", "OK/Cancel", "nL,hn", "?9?=?X?\\?x?", "tlTop", "BoundingRect", "TTaskDialogRadioButtonItem:", "GREEK_CHARSET", "=TEnumerable'", "=9=F=Z=a={=", "PRQh8", ";2;X;\\;", "OrigBaseUnitY", "tdnbCancelNormal", "FIsClicked", "FPassword", "", "bsTopLine", "TRttiType3", "4U4z4", "PolyBezier", "VarNot", "VarType", "efDiagonalEndTopRight", "LockRegion", "TURLEncoding.TDecodeOption", "GETSHA256OFFILE", "ttsTrackOffHot", "FFocusChanged", "515B5O5W5h5w5", "?(?,?0?4?&>.>6>", ";B<~l", "ActivateKeyboardLayout", "WriteDate", "6A7{7", "0)080@0N0\\0j0n0", "ktfHeaderSectionTextDragging", "CheckApplyChanges", "function CompareText(const S1, S2: String): Integer;", "Cannot get number of items", "UhdYq", "484z4", "TSeekOrigin", "c:\\directory", "+TEnumeratorx", "91:::", "TextWStr", ">'>/>7>?>G>", "\"TEnumerable'", "0B0W0h0}0", "FDockSite", "CheckMutexes", "vaIdent", "60F0y0", "4#4=4W4q4", "6 646R6`6z6", "VCLSTYLE", "!TCustomStyleMPlayerButtonElements", "ItemClass", "1G2a3", "RefAttribute", "PRect", "PRQhL", "FFile", "EMonitor", "QQQQQQQQSV", "9I:o:", "GetRegion", "7+737D7", "FInfoAfterClickLabel$", "=I=P=d=h=l=p=t=x=", "ImageList_GetImageCount", "tclCheckListBoxRoot", ">8?G?", ";7;;;\\;`;", "FTipMode", "decoder doesn't support this archive", "FOnMouseMove", "OnDownloadFileCompleted", "%TEnumerable", ";7;?;M;];w;", "CustomFooterIcon", "GetStyleName", "%TList.ParrayofT", "5,5E5S5f5w5", "function RegWriteDWordValue(const RootKey: Integer; const SubKeyName, ValueName: String; const Data: Cardinal): Boolean;", "TCustomStyleGridElements", ";%;,;3;=;A;b;", "2,2=2Q2p2", ";,;4;P;X;\\;s;{;", "imHira", "DialogFontName", "fdoForcePreviewPaneOn", "RegisterLoginHandler", "?2?B?J?X?h?s?", "[TEnumerator>|", "\"BeforeInstall\" or \"AfterInstall\" parameter with no CodeRunner", "FHandleRedirects", "FindObjectByName", "ktigSysMenu", "System.Generics.Collectionsl", "tsSizeBoxLeftAlign", "5'6j6", ">H?Q?", "TMenuItem", "Tahoma", "3%3<3D3L3T3\\3d3l3", "FOwnerDraw", "Windows Server 2003", "SaveToStream", "]TEnumerator>|=I", "OnExtractionProgress", "1<1t1", ">->D>U>m>u>", "InstallingPage", "clBtnShadow", "(TCustomGestureEngine.TGestureEngineFlags", "WizardIsComponentSelected", "Unsupported clipboard format", ";#;';+;/;3;7;M;x;", "ttdExpandedContent", "9*9>9R9f9{9", "3(373M3\\3{3", "Unexpected end of stream", "DirTreeRename", "5'505@5H5P5X5\\5`5d5h5l5p5t5x5|5", "iso8859-11", "TTextFileWriterRedir", "4,4C4]4r4", "", "klidsDisabled", "LTDictionary.TKeyCollection;", "TMouseTrackControlStyleHook8", "FClicksDisabled", ",TEnumerator(", "1 2O2", ";.;>;P;j;x;", "CanCreate", "898=8[8", "kescSingleComboBox", "fltVal", "5&545B5R5e5t5", "tipDontCare", "QQQQQSVW", "ktigMax", "6 6-6D6Y6a6", "DefaultEncodingL", "TPSRuntimeClassImporter&", "0%030J0_0m0|0", "1TDictionary.TItem", "?\"?*?2?c?x?", "/FIRSTPHASEWND=", "0TArray>", "NewBottomLine", "(TList`,g", "{TArray>", "8\"878L8a8", "BScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$10$Intf`'@", "TCustomCardPanel6", "%59)$J+", "function FindNext(var FindRec: TFindRec): Boolean;", "Running ShellExec filename: ", "<(<>`'@", ":%:t:", "4X4j4s4", "ttdMainInstructionPane", "> >5>C>W>j>", "TSeListItemInfo", "2C2b2t2", "OnMouseUp\\oG", ">ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$8$Intf`'@", "isRunning", ";N;u;", "Z_JD{", "rdIntegerBE", "maDefault", "TStartDragEvent", "IProgress`'@", "8\"8&8*8.82868:8>8B8F8J8N8R8V8Z8^8b8f8j8n8r8v8z8~8", "4 5%5<5J5R5X5g5t5", "TExceptionHandlerProc`'@", ":*:<:Q:k:", ">?>I>M>l>", "3$393G3Z3o3}3", "D2D_POINT_2F", "GetKeyboardLayoutList", "0/070E0X0g0x0", "Failed to parse \"cm\" constant", "MAKEPENDINGFILERENAMEOPERATIONSCHECKSUM", "tcReadOnlyHot", "7$7r7z7", "8$8,8=8K8S8a8p8~8", "BarVert", "3%3)3H3X3`3h3p3t3x3|3", "< <8`'@", ":%:):D:H:d:", "SYMBOL_CHARSET", "Value name: %s", "trRebarDontCare", "RegisterURLClientScheme", "TPointerArray", "ResID", "FProxySettings", "UserInfoSerialEdit", "=:>z>", "!IComparer`'@", "FOrigBaseUnitY", "3\"303>3", "ShowHintXFA", "VisibleP+I", "0'0f0", "<(=A=X=p=", "UhaC^", "3(363E3^3w3", "8.8A8W8h8", "StrToFloat", "ComponentStateTVH", ":4;];", "ttbSplitButtonHot", "FatalException", "S$_^[Y]", "=<=Z=", "Leaving temporary file in place for now.", "dkDock", "0#0*01080?0F0M0T0[0b0i0p0w0~0", "<$<<<@<^.>C>Q>g>|>", "0$060d0", "SpacingXZQ", "String expected", "HTDictionary.TKeyCollection", "TThemedButton", "1 1=1T1m1u1{1", "pfOut", "6$686I6V6^6o6~6", "L$.TEnumerator", "SetScrollInfo", "bdRightToLeftReadingOnly", "?8?G?X?n?", "ttbThumbLeftPressed", "Uh:Fc", "VisibleChildCount", "FSelectedImageName", "kbdsPressed", "DWinapi.MsInkAut", "?(?6?L?a?o?", ":,:4:B:N:_:j:u:", "8\"8]8n8", "TZDecompressor", "TElementColor", "puintVal", "O%3;e", "ttbThumbFocused", "MIMEName", ";1;9;G;W;i;q;", ">", "vbool", "<:<><", "DragTarget", "Priority", "forDefault", "1.121P1`1h1p1x1|1", "AFilePath", "4.TEnumerator|", "AppendMenuW", "Eljn{K", "jjjjjjj", "TSetupVersionData", "=b=r=", "GetCurrentThread", "AlphaFormat", "=!=/=G=O=]=m={=", "GetVarCount", "Dummy", "919?9Q9l9z9", "toPenTapFeedback", "TFindMethodEvent", "9-919P9`9h9p9x9|9", "LTDictionary.TPairEnumerator", ".edata", "3$3>3T3l3", "6,6A6I6Q6Y6a6i6", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8h8l8p8t8x8|8", "%TEnumerator", ":::c:k:", "tbGroupBoxNormal", "HTDictionary.TKeyEnumerator", "width", "=&=4=D=Z=h=u=", "GetPromptLabel", "TCookies", "clTurquoise", "LastListU", "FExportName", "sltURL", "GetKeyboardLayoutNameW", "8.8D8V8^8l8~8", "CreateSolidBrush", "dkVtable", "tsiAudioDisabled", "QQQQQQQSVW", "AfterID", "C$_^[", "CoInitializeEx", "CreateScaledNew", "2R3{3", "NameThreadForDebugging", "3^3F4f4", "J[=+S", "FOnDebugIntermediate", "? ?7?>?E?L?V?Z?y?}?", "$TList&", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$11$Intf`'@", "TCustomComboBox", "WriteSafeHeaderString", ">'?\\?", "Max-Age", "PaintSite", "teListView", "3 4c4~4", "ExceptionCode", "commdlg_help", "SaveToClipboardFormat", "<6:X:s:", "RegisterClassW", "Range", "PTDictionary.TValueCollection", "Will not restart Windows automatically.", "HResInfo", "FLocked", "GetResource", "rcOff", "><>M>m>~>", "DisposeOf", ":D:g:", "teEditCaret", "8'8:8T8b8q8", "TCollectionl", ":1:U:~:", "Metafile", "FHeaders", "FWideStr", "WriteInteger", "TDictionaryOwnership", "7\"747d7h7", "igoPanSingleFingerVertical", "OnNotifyH\\e", "9#:':T:c:", "cp936", "(TList&", "\" constant but Setup didn't create the \"app\" dir", "UnitName", "UninstallNeedRestart", "wReserved3", "EraStart", "xm$RbQ", "WriteAnsiLine", "ComponentsList$", "'TArray", ";);G;K;O;S;W;[;_;c;g;k;o;s;w;{;", "tpBar", "claLightslategrey", "FMethods", "ANSI_CHARSET", "?*?7???M?\\?n?{?", "CanAppend", "haccel", "Decrement", "4(484]4s4", "=IEnumerable", "hInstance", "$:P&", "TLocalTimeType", "dblVal", "6 6$6(6,60646<6D6L6", "OnDblClick\\oG", "NotBefore", "ENetCredentialExceptionP", "gTArray>", "tlGroupHeaderOpenMixedSelection\"tlGroupHeaderOpenMixedSelectionHot", "(", "ttbThumbLeftDisabled", ":M:y:", "0*1I1P1k1[2g2n2", "TArray", "rtCursor", "7$7,7U7", "DeinitializeUninstall raised an exception.", "List count out of bounds (%d)", ";J;x;", "TDragControlObjectEx0.Q", "7[8h8~8", "FOnGetNVariant", ";H;T;f;s;{;", "5\"5;5H5X5q5", "0)070K0a0o0", "5 5(5U5g5}5", "7*7B7P7b7{7", "/GROUP=", "ATEnumerator(", ">!?6?G?\\?j?", "Uh,gM", "EPSException", "iu-Latn-CA", "ERegistryExceptionD`N", "2(282@2H2P2T2X2\\2`2d2h2l2p2t2x2|2", "crAppStart", "Reset", "Uh[1r", "!|L0?", "HasClientEdge", "5>6^6}6", "TInstItem", "tmcGridCellUpperHasStateHot", "tebNormalGroupExpandNormal", "W@CNu", "TTitleBar", "IValueData`'@", "TStyleElements", "JTEnumerator>(", "UhhCc", "CrystalIDEA Software ", "FMBoxTextPressed", "APool", "SafeCallException", "070?0k0", "TreeView", "FCommandSequenceNumber", "TPenData", "FAutoSelect", "9#9>9B9_9", "kmscMenuBar", "99:~:", "=ScriptFuncLibraryRegister_R.RegisterActiveXScriptFuncs$ActRec", "6 606E6I6t6", "GetValueNames", "34934", "TStartMenuFolderTreeView", "skTopRight", "AccessMask", "EInvalidPointerl", "UhhG`", ">$>2>@>N>j>", ">&>.>?>M>U>c>p>", ";http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#", "RegisterClass", "tdnbNextNormal", "=)=K=X=i=s={=", "CommaText", "ttbThumbVertFocused", "ktfRadioButtonTextPressed", "4%484F4N4V4^4f4n4v4~4", "UninstallSharedFileForm", "*TEnumerator`", "tebHeaderPinNormal", "4/474?4G4O4W4_4g4o4w4", "TSysReBarStyleHook7", "DockManager", "tdbDateBorderNormal", "Uhd'Z", "clTeal", "?+?@?[?p?", "1(1V1l1|1", "4=4d4m4", "CoCreateInstance", "4#5C5O5[5{5", "Duplicates not allowed5Insufficient RTTI available to support this operation", "2,2<2P2T2k2r2y2", "scButtonPressed", "?ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$10$Intf`'@", "TUninstallSharedFileForm", "/LoadInf=", "PathEditChange", "zfree", "FSeekedToEnd", "FFocusedFont", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$7$Intf`'@", "lmAppend", "1 2k2", "CreateForm", "Uh`$j", "TSeTrackInfo", "Failed to parse \"param\" constant", "%TObjectList", "CustomSort", "0*1Q1", "0$1H2", "function RegQueryDWordValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultDWord: Cardinal): Boolean;", "CreateRes", ";:J>X?", "clAqua", ">H>u>", "ktigGlyph", "GetSystemWow64DirectoryW", "JTDictionary.TValueCollection;", "Writer", "FDefaultWinProcCalling", "VRecord", "=*===N=a=o=", "WTSAPI32.DLL", "claFuchsia", "System.Generics.Collections|", "=,=:=N=g=}=", "CastToOle", "T*177gi", "FUTF8WithoutBOM", "8TEnumerable,", "8)878J8Z8j8y8", "AddPair", "CREATESHELLLINK", "PasswordLabel", "7A8V8d8|8", "es-ES_tradnl", "az-Latn-AZ", "Registering 32-bit DLL/OCX: %s", "AES_256", "AsyncCallbackEvent", "FlatChevron", "<(<,<0<8<@3>P>", "MSG_WARNING", "6*6:6L6\\6d6r6", "708V8|8", "kescSingleEdit", "SetFilter", "FNextLineIsFirstLine", "ufAdminInstalled", "5$5(5H5T5X5\\5`5h5p5t5x5|5", "5C5Z5", "T]_^[", "RemoveStream", "EraName", "TThemedProgress", "pmXor", "teSpin", "SVWRPj", "TSetupProcessorArchitecture", "TEnumeratorT", "151L1^1o1w1", "FWheelSupportMessage", "-TDictionary.TItem", "525F5[5s5{5", "/TEnumerable'", "twMDIHelpButtonPushed", "HintGradientEnd", "MaskColor", "617]7r7", ">0>N>V>t>x>|>", "%TEnumerator", "ttdVerificationText", "$TEnumerable", "FActiveCardIndex", "Will overwrite existing uninstall log: %s", "FlipControlsOnShow", "TControlActionLink", "GETPREVIOUSDATA", "LISTBOX", "kmidsHot", "saUnused", "kmidsDisabled", "rTDictionary.TKeyEnumerator;", "0L1P1w1", "Number expected", "iso-8859-10", "4!4f4{4", "TypeRef", "9TObjectDictionaryM", " TEnumerator", "DrawState", "FILESIZE64", "(", "ecEdgeDkShadowColor", "=\"=0=>=K=", "7+787l7p7", "e`'@", "AddReg", "scCategoryButtons", "WaitAll", "TVarArrayBoundArray", "CTDictionary.TPairEnumerator;", "NoButton", "zAx4Vt", "sfCaptionTextNormal", "99:\\:l:", "2F3O3", "0#0'0+0/03070;0?0C0G0K0O0S0W0[0_0c0g0k0o0s0w0{0/191y1", "PListPeF", "Setup.ScriptFunc.HelperFunc", "6 666G6Z6k6~6", "CheckBoxTextFocused", "tfFlyOutLinkHover", "2.3g3", "=D=e=", "8(898Q8]8e8s8", "HTTP/1.1", "FWizardSmallBitmapImage", ";(;U;\\;", "TouchL", "(", "MinWidth", "TLightweightEvent$uD", "TSimpleExpression", "commondocs", "CaseSensitive", "twFrameLeftSizingTemplate", "khdsUnderDrag", "FOwnerships", "2&2T2d2", "InitializeSetup returned False; aborting.", "/TList.TEmptyFunc`'@", "YtE;}", "FMBToWCharFlags", "tcDropDownButtonLeftDisabled", "TGetChildProc", "FWriteSignal", "GetThemeBackgroundRegion", "Classname", "SubCaptionLabel", "ADefaultName", "<&<4`'@", "Cookies", ":$:`:k:t:", "ChangeResource", "3 353J3_3t3", "5.5<5T5r5", "wrMousePos", ";&;4;A;S;`;h;v;", "GetMaskBitmap", "prPowerUser", "1/161=1D1K1R1Y1c1", ";*;E;Y;p;", ">/>7>E>S>g>z>", "OnUnDockJ", "TRttiParameter", "Masked", "TMethodImplementation.TFloatReg", "2?2C2a2", "8?9W9d9r9", "TPropSet", "5&5E5V5", "3.8.1 ", "RecurseSubDirs", "3%3@3H3V3c3v3", "4F4J4N4R4Z4", ">TDictionary&", ">!>)>:>H>P>^>k>y>", "thHeaderDropDownHot", "FileLoad", "EOSError4", "crHandPoint", "ApplyBiDiKeyboardLayout", "GetComponents", "DirExistsWarning", "ttbThumbBottomHot", "iso_8859-1", "_Reserved1", "Queue", "TSeWindowButtons", "InitializeFromStockIcon", "TThreadPool.TSafeSharedUInt64", "+TEnumerable", "LocalAlloc", "ITDictionary&", "Uhhc\\", ":':;:J:X:f:|:", "5 5$5(5,5054585<5@5D5L5t5", "[InternetShortcut]", "BTDictionary.TKeyCollection", "TPSTypeRec_Set(", "PositionAt", "9TDictionary.TKeyCollection;", "ALabel", "TMemoryStream", "DefaultUsrPw", " IComparer`'@", "3 3(3B3J3h3p3", "HFAElementType", "GroupIndex", "FTerminate", "ttbSeparatorPressed", "*TDictionary&", "[F^:HF~", "FAppendDir", "OleCheck", "4*4<4J4Z4b4p4", "saTopRight", "2)2?2Q2|2", "claLavender", "TFileDialogShareViolationEvent", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8p8x8", "ShellExecuteEx", "wipmCubic", "tcTransparentBackgroundHot", "7P7i7", "IStorage`'@", "4Z!S= ", "TURLResponse", "TSeStatusSubclass", "TAbstractTask.IInternalTaskt`'@", "WriteStringAsAnsi", "ttlTextLabelDontCare", ";ScriptFuncLibraryRegister_R.RegisterOtherScriptFuncs$9$Intf`'@", "='=?=G=O=W=_=g=o=w=", " %d bytes done.", "TSeStyleDrawing6", ":@:t:", "tfEditControl", "beTop", "twMinCaptionDisabled", "1#1/14191E1J1O1", "FMaxCapacity", "pidTopic", "ItemRect`", "TabOrder", "FImageListHandle", "TCustomHintWindow", "S`_^[", "AHasInternalChildren", "9 9D9T9\\9d9l9p9t9x9|9", "4:4]4", "iaLeft", "TSeBarSubclass", ">b>}>", "MsgFiller", "5A5g5", "Inno Setup Messages (6.5.0) (u)", "0&0F0", "4 4$4(4,40484@4H4", "HEBREW_CHARSET", "kcdsCheckedNormal", ":,:0:4:<:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:", "7(707>7Q7b7y7", "4TList.TEnumerator5", "clTomato", "DefineBinaryProperty", "ReadPrefix", "FPadEnd", "HasTransparentParts", "CreatePipe", "1(1E1", "FDropDownCount", "HelperRegisterTypeLibrary: StatusCode invalid", "GETSPACEONDISK", "Field", "function SelectDisk(const DiskNumber: Integer; const AFilename: String; var Path: String): Boolean;", "7!7)71797A7I7Q7_7r7", "TLogProc", "clCadetblue", "6TDictionary.TKeyEnumerator;", "Abbreviation", ":TDictionary.TKeyCollection;", "2/2B2S2f2t2", "ControlStyle", "Winapi.DxgiType", "7Q7^7o7v7", ";$;3;G;[;c;q;", "kttdsFocused", "*IEnumerable", "$TList.ParrayofTD", "<'<(=\\=", "tebSpecialGroupBackground", "claChocolate", "Subject", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$4$Intf`'@", "TCustomFileDialog", "$IEnumerable", "$TEnumerator", "FJumpFlag", "StringsAdapter", ";z7YKK", ">H>X>`>h>p>t>x>|>", "\" constant because there is no SysWOW64 directory", "TStackPanel<", "=\"=6=T=b=t=", "ParentShowHintpe^", "UnRegisterChanges", "8 8(80888<8@8D8H8L8P8T8X8\\8`8d8h8l8t8|8", "TBitmap", "sfPopupMenuItemTextSelected", "60A0^0s0", "TSeBarCaptionInfo", "CloseButtonRect", "TabIndex", "BeginBufferedAnimation", "='=H=j=", "tsArrowBtnRightHover", "FMouseInClient", "scEndScroll", "TChunkgAMA0u^", "0 050H0L0S0f0z0", "YesButtonx", "'TMethodImplementation.TRuntimeTypeInfos", "UhXyJ", "Nil interface", "6.6\\6", "FChunkCompressed", "2.252<2C2J2Q2X2o2s2w2", "FlipVert", "; ;o;", ";';1;T;d;l;t;|;", "8 9-9B9b9", "&TEnumerable'", "DeleteObject", "TMemoStyleHook8", "efLeft", "claMediumaquamarine", "-TPair", "pbSysVertical", ":4;m;", "~ Wn&", "zalloc", "=TDictionary", "FOnFindComponentInstance", "NTDictionary.TValueEnumeratorLQX", ";#.ParrayofT", "7+7C7K7Y7i7w7", "clSienna", "jTEnumerable>'", "FGlowSize", "function WizardNoIcons: Boolean;", "8#8-818N8R8u8y8", "PhT5x", "CTDictionary.TItem", "System.Generics.Collections4hX", "FileTimeToSystemTime", "FSourceLine", "Uh33V", "DynUnitName", "9\"969I9X9j9", "3+4P4", ";+", ";6l%P", "header", "TPanelStyleHook", "ReadStr", "1D1Q1\\1e1", "FDisplayTime", ">'>8>F>N>\\>h>", ";B@t@", "0(0:0G0O0]0l0~0", "?7s@~lu", "NewControlFlag", "1(14181<1@1D1H1P1T1X1\\1`1d1h1l1p1t1x1|1", "StrGet", "WriteVar", "TIDispatch@", "FContext", "teSearchIndicators", "ITDictionary.TValueEnumeratortje", "FNeedsUpdate", "HelpJump", ";APtw", "Time stamp of existing file: %s", "1w1{1", "invalid code -- missing end-of-block", "9g:y<", "ksacHorizontal", "ResizePalette", "gTDictionary>.TKeyEnumerator(", "Resample", "7V8k8|8", "pmMaskPenNot", "TImageList", "TPNGList=", "3&3.363>3F3N3V3^3f3n3v3~3", ":TList.TEnumerator ", "?$?\\?", "?&?0?D?P?T?X?\\?d?l?p?t?x?|?", "TSeTextAlign2", "TThreadPool.TAbstractWorkerData", "FMonitorThreadWakeEvent", "010D0H0O0b0v0", "RegSetValueExW", "AResult", "User canceled the installation process.", "ClassType", "TChunk", "CertRevFailed", "D$$Tj", "AnchorsXFA", "96:j:", "iso-ir-109", "pbstrVal", "ttHotGlyphOpen", "3(353C3Y3g3t3", "ADDBACKSLASH", "ecShadowColor", "8.828N8R8V8r8", "TCustomDecompressor", " Description: BThe \"Portable Network Graphics\" image contains an invalid palette.", "Perform", "~array~of~", "8(8o8s8", "0/0C0f0z0", "OnStartDrag!", "\\Setup", ";FPu!", "`TEnumerator>l", "SysTabControl32", "Q(_^[", "bsHidden", "TButton", "", "5@5J5l5|5", "MustActivateMenuItem", "<$ar0f", "TCanvas&", "AContentStream", "twWindowRoot", "1(202O2q2u2", ":$:+:2:9:@:G:N:U:_:", "7*7B7X7`7h7p7x7", "PACKVERSIONNUMBERS", "WizardSilent", "TSetupTypeOption", "claDarksalmon", "TransparentMode", "dwInfoFlags", ":':/:7:?:G:O:W:_:g:o:w:", "Invalid relative URL path: \"%s\",Maximum number of redirections (%d) exceeded Error getting Server Certificate)Server Certificate Invalid or not present", "LeftPanel", "787H7P7X7`7d7h7l7p7t7x7|7", ";/<6d", "UhW4c", " ", "IHelpSystem`'@", "csAlignWithMargins", "5TCollectionNotifyEvent", "DestroyCursor", "5-5;5L5", "%TEnumerator\\", "1(1:1M1U1c1q1", "Systemp,@", "signscale", "<&=w=", "TBaseImageList1", "; ;0;4;8;@;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "7&7.767>7F7N7V7^7f7n7v7", "biYPelsPerMeter", "=$>J>i>x>", "TryLock", "5+6T6Y6", "twMaxButtonNormal", ";D$ }", "8#8-858=8", "AddValue", "6-6C6T6r6v6", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4t4", "FMaskBitsValid", " DrawTextBiDiModeFlagsReadingOnly", "x1234x", "gsFileName", "7)7@7X7p7", "G/}u^S", "9%9O9v9", "The file appears to be in use (%d). Will delete on restart.", "tcDropDownButtonLeftHot", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "485b5", "3!303", "KTDictionary.TValueEnumerator;", "function VersionToStr(const Version: Int64): String;", "?,?2>:>H>]>o>w>", "757=7A7U7]7w7", "PDecimal|TD", "TSeWindowDrawStates", "thHeaderItemLeftPressed", "FHashTable", "DiskSpaceLabel@", "9+9F9T9i9", "CurrentSourceFilename", "3*373?3P3_3g3u3", "InitializeCriticalSection", "URLDecode", "TPSOnGetNVariantX", "MTDictionary.TKeyEnumerator;", "2)2W2", "uxtheme.dll", ",TEnumerable", ">.>?>L>T>e>t>|>", "ktFMBoxTextHot", "ktfGroupBoxTextNormal", "4 5;5V5k5", "tfTabStop", "UVcl.Mask", "HintShortPause", "LHintWindow", "IEditFormatLink`'@", "FIdleWorkerThreadCount", "FillGeometry", "tpProgressDontCare", "TSeBarButtonDrawState", "=7=]=", "TEvent4qD", ":';A;S;", "CoTaskMemFree", "The sizes of unexpected leaked medium and large blocks are: ", ":#:;:C:K:S:[:c:k:s:{:", ";Bdt+", "wMilliseconds", "TChaCha20Context", "AIncludeActiveGroups", "6c7u7", "AScriptFunc", "Failed to set permissions on file (%d).", "?456789:;<=", "?!?&?2?7?.ParrayofT(", ">/>D>R>j>", "5.52565O5S5W5n5r5v5", "Currentt", "Unicode", "ImageList_SetOverlayImage", "imChinese", "<)1z1", "TFindGraphicClassEvent", "3 3$3,34383<3@3D3H3L3P3T3X3\\3`3m3", "csDoubleClicks", "3 3$3(3,3034383<3@3D3H3L3P3T3\\3d3l3", "usersendto", ";#<-<1\">*>8>T>b>w>", "AHeader", "=\"=4=F=", "FOnContextPopup", "cUnusedBits", "OnCreateComponent<", "IsWindowUnicode", "NameListFld", "spoHorizontal", "TThemedNavigation", "7%7-757=7E7M7U7]7e7m7u7}7", "2#2(24292r2|2", ")TList.ParrayofT", "tlListItemHotSelected", "ImageList_EndDrag", "ACopyFormat", "1+1V1", "hTDictionary>.TPairEnumerator@", "MTime", "2(2;2Q2k2y2", "5#5=5E5M5U5]5e5m5u5", "kticRestore", "059G[~", "4&474B4J4[4o4", "ComboBox", "SurfaceExtraHeight", "ktcBorder", "procedure WizardSelectTasks(const Tasks: String);", "/TCollectionNotifyEvent", "FEntered", "ActivePage", "OnActivate", "3?3X4", "Uh/ld", "6 636A6Q6b6v6", "> >$>(>,>0>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "tebHeaderCloseHot", "7$7(7>7E7L7S7Z7d7", "OnMouseUp", "CreatePenIndirect", "FOnExpandConstant", "='=/=X=m=~=", "5 5.5@5U5a5i5z5", "TIFF Images", "sbaRollDown", "CurIndex", " TArray", "040@0D0H0T0\\0d0l0p0t0x0|0", "TMetafileImage'", "address", "TFileDialogOverwriteEvent", "TItemState", "N0d0y0", "toj@j@hH", "FFocusedControl", "PVmtMethodExEntry,", ">G?i?", "UhP4a", "twMDIMinButtonDisabled", "Invalid property value", "7$8H8", "FPrevPos", "klidsHot", "HandleMessage", "IsEmptyP", "Vcl.ActnList", "?'?/?G?\\?j?}?", "ReadWideString", "TArray", "GetFullPathNameW", "OnReceiveData", "8 8$8(8,8084888<8@8M8d8l8t8|8", "3&3R3g3u3", ".TKeyCollection", "9 9$9(9,9094989<9@9D9\\9l9p9", "KF99(", "; ;$;(;,;0;4;8;F;N;`;r;", "Failed to parse \"ini\" constant", "999q9", "FOnChanging", "_TrackMouseEvent", ":TEnumerator>", "_unins.tmp", "FTemplate", "UhiXC", "esMinimum", "2 2$2(2,20242A2S2k2s2{2", "?\"?D?Q?b?l?t?", "8.8@8H8V8h8~8", "tnMenuButtonPressed", "System.Generics.Collections4", "MustExist", "get_accRole", "StyleFileName", "6 616F6T6m6", "230410000000Z", "pscode", "9*9<9K9S9d9", "TokenWideString", "&TList.ParrayofT", "?\"?t?", "nButtonID", "SetOptions", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5v5~5", "0!0)0", "FRetinaDisplay", "LoadFromResource", "lbVirtual", "UnregisterTab", ">)>H>j>", "eFb7#", "ttdExpandoButtonExpandedNormal", "4\"4*484G4U4l4z4", ";&<|<", "OnStartDockP_Q", "8$828B8]8s8", "_^][Y", "; ;e;o;y;", "tiEOF", "Uhd6D", "HTDictionary.TKeyEnumerator", "FSizingWnd", "<2<:@?P?", "twVertThumbHot", "ksc_5601", "9!9/9C9Z9k9", "WriteMethod", ";*;2;W;_;", " TList&", "clWindowText", "; ;(;6;H;^;l;{;", "idskb32", "? ?(?0?4?8?t", "TInteractiveGestures", "rkBottom", "+TEnumerable'", "FDefaultButton", "Uh@hk", "scButtonFocused", "TEdit", "Got EAbort exception.", "A call to an OS function failed", "FullPaths", ":7:O:g:", "WVcl.ComStrs", "TScriptRunner.SetPSExecParameters: Invalid type", "1;1_1", ";*;2;B;J;U;a;u;~;", "=/=G=c=v=", "tsiTextHot", "IInternalHelpManager`'@", "GetCursorPos", "ktcButton", "PopupMenuItemTextNormal", "Failed to open Fonts registry key.", "iso8859-10", "LoadKeyboardLayoutW", "2'2>2I2`2k2", "8'8;8Q8b8s8", "FDropDown", "FChecked", "oaEiC9>", "TLS1_2", "ufWizardDarkStyleDynamic", "CanLoad", "Uhh3t", "7F8N8T8Y8%=g=", "Subscribe", "0(0:0O0]0m0", "8Q8Y8d8l8", "OnActionExecute", "Sh|}j", "IconIndex=", "VInt64", "ATList.TEnumerator5", "ECS1t", "DrawTextExW", "<$<,<:", "FScrollLinesMessage", "CallWindowProcW", "claCyan", "ListB", "OnClickCheck\\oG", "AppsUseLightTheme", ":1:9:A:I:Q:Y:a:i:q:y:", "Ce u#", "/CloseApplications", ">@>P>_>", "FlushBuffer", "LocalPush", "FReadyPage", "333m3", "QueueWorkItem", "IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)", "QQQQQQQQSVW", "7*7;7P7`7", "TCertificate8", "7TList.TEnumerator", "", "AGrid", "FTotalLinesRead", "\\_unins.tmp", "OnOverwrite\\oG", "HidingControl", "libNewPosition", "FOnExit", "TListBoxStyleHook", "GetWindowsVersionEx", "FOS2Format", "clLightslategrey", "FValueData", "Listl", "URLEncode", "&TSysToolbarStyleHook.TSysToolbarButton ", "FTextAlign", "Font.Color", "PopupParent", " h|3x", "UserMenuFlagFiller", "SelectDiskLabel", "ACTIVELANGUAGE", "6(6C6q6", "$TArray", "?K?Y?g?u?", "fsDenormal", "System.HelpIntfs", ">0>T>X>", "TOutputProgressWizardPage6", ">&>1>6>;>H>X>]>b>l>u>z>", "D$\\Pj", "FWaiter", "1#2*2g2", "=TDictionary&", ":1;a;", "function CreateInputOptionPage(const AfterID: Integer; const ACaption, ADescription, ASubCaption: String; Exclusive, ListBox: Boolean): TInputOptionWizardPage;", "V*q+C", "&IEnumerable", "4(464G4U4k4s4", "EXPANDUNCFILENAME", ":>;T;", "EncodeForm", ">,>:>Q>f>t>", "TBaseImageList", "GetTabRect", "EVariantInvalidOpError", "4F4V4", "<-", "tsArrowBtnLeftHover", "EnableScrollBar", "The file being read is not a valid \"Portable Network Graphics\" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis \"Portable Network Graphics\" image is not supported or it might be invalid.", "StateXFA", "Frame", "=(=9=J=c=w=", "QhFOu", "Function %s returned error code %d", "GetVolumeInformationW", "Uh~vl", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$0$Intf`'@", "2&2.2R2Z2{2", "8/878E8U8i8q8", "767g7", "TMemoryAddress", "Palette", "FavoriteLinks0", "tebSpecialGroupExpandPressed", "ADock", "AddSite", "FooterIcon", "MTEnumerable>'", "kbdsFocusedHot", "claLightseagreen", "9/9<9D9R9d9u9}9", "TStringRef", "Forms", "unins", "System.Net.Mime", "cp866", "TNeedClientCertificateCallback", "8-8@8O8a8z8", "Timespan too long", "TCustomMultiSelectListControll", "BidiCtrls", "818f8", "oleobj", "RedirectsWithGET", "0'090O0`0u0", "GetControlsAlignment", "THTTPClient'", "?(?y?}?", "< <$<(<,<0<4<8<<<@4I4O4`4x4", "sr-Latn-CS", "3/373H3`3h3x3", "QQQQ3", "AItemFontStyle", "1*121D1t1x1", "Found a file to register with RestartManager: %s", "OnShareViolation", "PArrayPropInfo", "REGQUERYBINARYVALUE", "?0?>?N?V?d?r?", "FCustomForms", "2$282Y2g2", ";.;<;O;u;", "YZ_^[", ";R>'", "cbWndExtra", "TArray", "FDelimiter", "function CreateCallback(Method: AnyMethod): Longword;", "xW,]_Og\"SO,i", "AStatus", ":\":*:2:::B:I:Z:b:j:r:z:", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$23$Intf`'@", "function PackVersionComponents(const Major, Minor, Revision, Build: Word): Int64;", "CreateOutputMsgPage", "FDragImmediate", "PrevSetupType", "TDockZone4", "*TEnumerator(", "203B3Q3j3", "TList@", "ENetHTTPException,4h", "=TEnumerable'", "1#1u1", "<%<)", "5;5e5", "8$8X8\\8", "5$595G5W5l5t5", "TextColor", "FRunList", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$16$Intf`'@", "9!9:9A9H9O9V9{9", "tspProgList", "WindowGetFixPosition", "2!3:3c3l3", "0#0E0R0c0m0u0", "===G=K=l=|=", "AtLeast", "-TList.TEnumerator", "OleInitialize", "tspSearchView", "FZStream", "1$292J2`2q2", "Authorization", "DefaultPixelsPerInch,", "3 4)4", "soTrailingLineBreak", "function WizardSelectedTasks(const Descriptions: Boolean): String;", "TRttiRecordFieldh", "TShiftState", "ttbThumbTopPressed", "ITDictionary", "SetUInt", "?%?5?G?V?^?l?", "3-3V3^3|3", "/DIR=", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$43$Intf`'@", ">9>A>E>X>d>}>", "2)3U3", "MenuDrawItemText", "CharLowerBuffW", "FProgressGauge", "odReserved2", "Uhk#_", "sfComboBoxItemDisabled", "&TEnumerator(", "BalloonTimeout", "\"IEnumerable", "UseMetropolisUI", "}System.Net.HttpClient", "wn>Jj", "NonBiDiKeyboard", "DownloadTemporaryFileSize: Invalid Url value", "KTDictionary.TValueEnumerator;", "=0=F=U=a=o=~=", "TAcceptValueItem'", "<:<><]", "0L0{0", "saNone", "%d %s", "IsWindow", "9D9^9b9", "AMessageClass", ">\">'>3>8>", "Uh++n", "tpDownDisabled", "ttbThumbDisabled", "+TList.arrayofT", "teWindow", "tbCommandLinkDisabled", "2IComparer`'@", "=C=U=t=", "RepeatCount", "%TEnumerable", "TProcedureSignature", "windows-1256", ">:?O?]?u?", "FCommonButtonFlags", ">\">4>F>X>j>|>", "cp949", "tmbNewAppButtonNotChecked", "DispatchPopup", "0,0?0G0U0m0|0", "imClose", "byRef", "tsArrowBtnLeftNormal", "TSeAction", "TPropSetK", "function AddPeriod(const S: String): String;", "S\\;S,|H", "8'9^9", "tlGroupHeaderOpenSelectedHot#tlGroupHeaderOpenSelectedNotFocused&tlGroupHeaderOpenSelectedNotFocusedHot", "FStyleHook", "; ;$;(;,;0;4;8;<;@;D;H;U;l;", "_TEnumerator>(", "FTimerHandle", "tspLogOffButtonsNormal", "function PageFromID(const ID: Integer): TWizardPage;", "{language}", "D$(SU", "2(2H2Y2l2~2", "0'0@0", "TComponent6", "v4\\Full", "tbGroupBoxDisabled", "FScrollBars", "biClrImportant", "=TEnumerator(", "FInteractive", "HeaderHandle", "Kl#K4", "OnDataX", "DarkMode_Explorer", "claRoyalblue", "ZTDictionary.TKeyCollection", "IsHFA", "TDownloadFilet", "AGroup", "beLeft", "tgIndicatorInsert", "-)V(!l", "IsControl", "dllhandle", "sTDictionary.TPairEnumerator", "7#7+737;7C7K7S7[7c7k7s7{7", "8,8B8X8g8u8", "4\"454F4Y4g4}4", "TPointerStream", ":[:o:", "sfCheckBoxTextPressed", ">3>Q>o>", "(A;OICI;FA;;;BA)", "t0)1X1", "T$ +T$", "Vcl.WinXPanelsJ", ".TValueCollection;", "\\TDictionary.TValueCollection;", "TGlassFrame`", "ENetURIResponseException", "SetClipboardData", "3<3D3c3k3", "3.4X4", "lpFrameInfo", ";(;8;<;@;D;H;P;T;X;\\;`;d;h;l;p;t;x;|;", " TCustomEdit.ObserverAdded$0$Intf`'@", "claOrange", "?7?>?E?L?c?g?k?", "FSource", "tmcBackground", "; ;$;(;,;0;4;8;<;T;`;d;h;t;x;|;", "claRosybrown", "2 2(2024282<2@2D2H2L2P2T2X2\\2i2{2", "OnDragDrop", "TTipMode", "888]8", "csBrushValid", "<#.TEmptyFunc`'@", "222I2", "GetViewportOrgEx", "Uhc*j", "EPngInvalidIHDR@J^", "ADrawingStyle", "x5678x", "ibm857", "OverridePaint", "PathLabel", "3G4K4O4S4a4o4{4", "Uh_\\T", "TRegistry&", "QTZ]_^[", "tsVertCenterStretch", "FInternalStream", "5%5-555[5p5~5", "1\"1/171H1U1]1k1y1", ":%:3:J:_:m:", "SectionRect", "9%9<9Q9Y9", "1)262X2c2", "616G6X6k6|6", "9;9D9w9", "System.SyncObjsTpD", "HorzTrackRect", "KTDictionary.TValueEnumerator", "!G$_^[", "fqProof", "Uh'\"L", "TCanvasStates", "101@1R1d1x1", "-0?0\\0M1Y1w1", "tmMenuBarDropDown", "_TEnumerable>'", "VTEnumerator>(", "kpdsNormal", "Ht0Ht6", "Same time stamp. Skipping.", ":TSeStyleObject.:1", "ssPen", "GetContentCharSet", "csFontValid", "TRttiOrdinalType@", "AValue", "8 9-9M9", "FHelpSystem", "TAlignPositionEvent", "sfToolItemTextNormal", "FShellItem", "csFixups", "4TPair", "cfFormat", "bsToolWindow", "UpdateTextFlags", "Vcl.ListActns", "pcVal", "HTDictionary.TKeyCollection", "FindType", "ktigMinRestore", "W)UkL", "Iww7]]]", "GetScrollRange", "AnsiChar", "IComparer`'@", "saIgnore", "-TList.TEnumerator5", "7 7(70787@7H7P7X7`7h7p7x7", "RoundedRect", "SetupCustomStyle", "CopyEnhMetaFileW", "ModalFinished", "SelectComponents", "Uhx3p", "GetActiveObject", "ApplyNonBiDiKeyboardLayout", "FProcSig", "283N3W3e3", "TSysStatusBarStyleHook", "4$424D4[4i4y4", "=1=9=X=`=x=", "C*...", "GetDIBits", "EArgumentNilException", "ChildHandlesNeeded", ">$>,>4><>D>|>", "1B1X1}1", "ktigMaxRestore", "RD]_^[", "StartAt", "iso8859-14", "FAcquireInnerException", "1.121:1t1", "< <$.TItem", ">2>?>L>", "ProgramFilesDir", "=F>J>N>R>V>Z>^>b>f>j>n>r>v>z>~>", "NTVersion", "cxLeftWidth", ":b:q:", "Message box (%s):", "FCallerPopsStack", "<0<>.TPairEnumerator;", "DoIterateMenus", "DialogFilter", "ktfRadioButtonTextNormal", "HelpContext\\oG", "ExpandedDefaultGroupName", ">h?q?", ",i???O", "clDimgray", "$TList.TEnumerator", "AClassName", ":TProxyAggregateStream.:1", "ATask", "Critical Service", "808H8e8i8p8", "CodeInstance", "2#242\\2`2|2", "FMouseOnRight", "maciceland", "ttnAnimBackground", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$19$Intf`'@", "0+1@2", "claHoneydew", "2$2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "function IsIniSectionEmpty(const Section, Filename: String): Boolean;", "FDropped", "GetRgnBox", "Uh_sq", "?4?W?", "Disabled", "7,7?7^7", "FGroupIndex", "e&@gld", "1J2_2m2", "1(101>1L1", "Ph|}j", "6&656G6", "1F3z3", "THTTPRedirectEvent", "Cannot cast an object", "3$4k4", "FCustomHint", "HTDictionary&", ":%:,:3:::A:H:O:V:]:d:k:r:y:", "function ForceDirectories(Dir: String): Boolean;", "bmiHeader", "TDockTree8", "EXTRACTFILEDIR", "v4.0.30319", "VTEnumerator>", "TEnumerator(", "dlibMove", "C PjT", "FCryptKeySet", "4#4+434;4V4k4|4", "CharsetpHA", "FMonitors", "TokenInt", "Uh=V\\", "TBZDecompressor9", ": :/:?:Q:_:q:y:", "maNone", "AnsiString", "=0>O>y>", "RmRestart returned an error: %d", ":):W:w:", "6$6O6X6", "%TArray", "cbSize", "727[7g7}7", "ITEnumerator>(", "tttBalloonStemUpRightWall", "BackUpFileName", "PatBlt", "FTouchManager", "IsShortCut", "PList|pI", "6\"6)60676>6E6L6S6Z6a6h6o6v6}6", "/MergeTasks=", "QT_^[", "clBtnHighlight", "+SX+SP", "Uh+\"^", "GetSubMenu", "Internal error: InternalRunIntegerFunction: invalid BreakCondition", "Sender", " processorArchitecture=\"x86\"", "TCreateComponentEvent", "pwcsName", "EInvalidOperation", ">!>)>1>9>A>]>r>", "FLastAdjustBoundsRTL", "EPNGUnknownCompression", "BackColor", "ManualReset", "ADictionary", "3.3H3P3j3", ">*>7>x>", "6 6$6(6.6O7i7", "9.9<9J9[9o9", "G?r.#", "KLQRP", "pbCertEncoded", ":&:8:", "8U9Y9]9a9o9}9", ")TList.TEnumerator", "CreateDIBSection", "1*181K1a1r1", ">]?d?}?", "fqDraft", "Winapi.Dwmapi", "Too many open files", "K\\+L$H", "? ?$?(?,?0?4?8?>", "function UninstallSilent: Boolean;", "1m1x3", "TypeLib", "='=/=7=?=G=O=W=_=g=o=w=", "tmSystemRestoreDisabled", "FTextEffect", "9TDictionary.TItem", ">ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$1$Intf`'@", "tsScrollBarRoot", "FOnSimpleDownloadNoProgress", "TNewButtonStyleHook", "@ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$14$Intf`'@", "fChunkList", "= =(=0=8=@=H=P=X=`=h=p=x=", "9i9m9", "6C8j8", "Margins", "5.5<5L5_5r5", "7.9H9z:~:", "FHostDockSite", "?&?9?Z?k?", "ktmiWindowStandard", "FLogProc", "BAFHu", "x86compatible", "8+8E8S8b8r8", "=0===N=p=}=", "SetIsSaveButton", "TLZMA2InternalDecoderStatet", "GetArrayLength", "sfComboBoxItemFocused", "Winapi.Dlgs", "PRQhh", "FButtonInactiveBackgroundColor", "Server Certificate not accepted", "&TEnumerator|", "%ProgramFiles(x86)%\\", ";.<&>@>L>f>r>", "CenterXHA", "=&=5=K=`=n=", "ATList.TEnumeratort", "tpNormal", "9a9j9", "GetStyle", "2/2A2I2W2g2u2", ">!>%>)>->1>5>9>=>A>E>I>M>Q>U>Y>]>a>e>i>m>q>u>y>}>", "5&595I5Z5n5", "4 4$4(4,4044484<4@4D4H4P4T4X4\\4`4d4h4l4p4t4x4|4", "Phx0x", "FAsSByte", "tsStretch", "<#<1<>'", "FOnShow", "2*2@2W2_2g2o2w2", "kppBarHorz", "ViewerID", "TCustomShortCutList", "*TList.arrayofT", "FTempWidth", "QuerySpawnServer: Unexpected response: $%x", "KTDictionary&", "6 666G6Y6g6t6", "No key has been assigned", "Vcl.StdCtrlsI", "TabDraw", "FNotifyRestartRequested", "1G3T4", "UTF-8", "Stream", "&TThreadList&", "epNone", "IsTaskSelected", "tttBaloonTitleLink", "^/}}}", "ExplicitWidth", "Padding", "#TEnumerable", "TrackMDIChildSystemMenu", "ATEnumerator", "1&1@1N1^1q1", "koi8-r", "window", "FSavePageID", "regsvr32.exe\"", "828C8e8r8", "BitmapByName", "9$9<9\\9l9~9", "scToolBarGradientBase", "e][v|g", "414L4W4", "FAbortedByUser", "FDisposer", ">b>q>", "Content-Type", "THelper('k", "tspPlacesList", "&TArray", "FTasksList|", "beRight", "848Z8~8", "EPNGCannotChangeTransparent", "8.8@8H8V8c8q8", "PropList", "TSeGridSubclass", "2!343O3", "1,1;1?1V1]1d1k1r1y1", "teRebar", "EArgumentException", "SetParentComponent", "FNewComCtrls", ";%;-;;;N;b;z;", "FTailIndex", "?!?%?)?-?1?5?9?=?A?E?I?M?Q?U?Y?]?a?", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5", "hBalloonIcon", "FilenameLabelh", "G{JVHa", "4&4*4B4I4P4W4a4i4", "; ;*;2;<;B;T;", "4\"4D4Q4b4", "CreateProcessW", "ADescription", ";P.TKeyEnumerator;", "claSeashell", "ACharCode", "lrMonoChrome", "FForceLTRReading", "RestartExitCode", "BlendColorpHA", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2", "WinHttpSetTimeouts", "ClearAndResetID", ";7|8U", "<(>,>0>4>8><>@>E>L>S>Z>a>h>", "=+=3=;=", "1.564", "FILEORDIREXISTS", "TrackVert", "function ActiveLanguage: String;", "3IEnumerable", "tclListItemNormal", "1-1K1Y1l1", "klscHyperlink", "1<2D2d2l2", "TBevelEdges", "Unexpected end", "122G2U2m2", "cmd.exe", "BeginGet", "FMemory", "FWizardForm", "4$5(5p5t5x5|5", "FDragCancelling", "6/6C6K6\\6j6r6", "(TCustomHintShowHideThread.Execute$ActRecXoS", "kgscGroupBox", "9G:M:U:b:", "FEnterWithKeyboard", "=<=L=T=\\=d=h=l=p=t=x=|=", "V(+T$", ">,><>D>U>s>", "ttItemDisabled", "WindowProc", "FChangeSizeCalled", "GetIDsOfNames", "Null variant error", "3<3r3", "&op_Subtraction", ">%>,>C>", "4.4@4e4i4", "5#5'555C5O5\\5", "6\"626B6R6b6r6", "edddS", "[Content]", "UhVcp", "8#8H8X8`8h8p8t8x8|8", "4?5n5w5", "FException", "FCryptContext", "Cannot expand \"", "3H3b3m3~3", ";http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0|", "^i('p", "FRttiDataSize", "0*0H0\\0p0", "5N6V6^6j6r6", "Uhp}O", "TFileTypeItems@", "HorzSliderRect", ";C@t(", "5\"6B6J7g7", "< <$<(<,<0<4,", "5\"5E5Z5h5v5", "<)<8<@", "=%=8=J=d=y=", "0h1w1", "FText", "979[9", "=*=?=G=", "FocusedFontpHA", "ttUser", "565:5>5B5F5J5N5R5V5Z5^5b5f5j5n5r5v5z5~5", "BTDictionary.TKeyEnumerator;", "Calling RestartManager's RmGetList.", "EncoderContainerFormat", "*TDictionary", "4)414?4P4^4q4", "ISSigUrl", "Uha%t", "FVCLComObject", "TPopupForm", "4%434K4S4a4q4", "ExtractArchive: Invalid DestDir value", "", ";!;;;S;i;", ": :$:(:,:0:4:8:<:@:D:H:U:l:", "RunProcedures", "5lho;", "/SILENT", "Invalid style format", "Q4Z_^[", "GestureList", "tttStandardTitleNormal", "EPngInvalidCRC", "t,CNu", "AStream", ";+;<;P;X;i;w;", ";G@t+", "az-Cyrl-AZ", "TCustomFolderTreeView6", "Out Of Memory", "odNoFocusRect", "UseDockManagerh", "kttdsNormal", "IsWindowDefined", "TGestureOption", "6$6,64686<6@6D6H6L6P6T6X6\\6`6h6p6", "ResType", "242M2b2|2", "s:0s^&_", "FVerificationText", "DTWorkStealingQueue`}e", "ERangeError", "VVariant", "FReturnTypeInfo", "AuthorEMail", "TNewStaticTextStyleHookD", "0&070E0M0[0p0", "DelphiRM_GetObjectInstance", "tsCenter", "; ;$;(;,;0;4;8;<;@;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "\\TEnumerable>$\"X", "IsEditDefined", "function SendBroadcastNotifyMessage(const Msg, WParam, LParam: LongInt): Boolean;", "9+939A9N9d9z9", "ktcTreeView", "FBalloonFlags", "System.Generics.CollectionshjW", "csDPIIsolated", "rv64Bit", "4%505>5", "FOnEndDrag", "3#343B3V3u3", "TrackingRect", "ReleaseCapture", "RestartManager found no applications using one of our files.", "Uh[+f", "Execute", "imAlpha", "=+=B=`=", "%'+jO", "Callable", "LoadKey", "> >(>0>F>[>l>", "AsString", "slYes", "6-6165696=6A6E6I6M6Q6U6Y6]6a6e6i6m6q6u6y6}6", "sccCompressedBlocks1", "iso_8859-7:2003", "PRQh0", "forAccept", "Not creating the key or a value, skipping the key and only updating uninstall log.", "=,=0=>=L=p=t=", "6@6Z6d6t6|6", "tsStatusRoot", "4n4u4", "CharLowerW", "CustHeaders", "THintEvent", "ifMethRef", "656O6n6v6~6", "tsiTextNormal", "TFolderTreeViewStyleHook", "Uh&>.><>M>f>{>", "7=7S7i7x7", "ufChangesEnvironment", "pfnDeferredFillIn", "kTEnumerable>", "SD^[]", "TThreadList8", "888S8", "9IComparer`'@", "iso_8859-10", ":-:;:O:b:q:", "WriteDouble", ": :8:F:V:g:z:", "WriteString", ":TWinControl.:3", "Uh'1N", "1 1(10181<1@1D1H1L1P1T1X1\\1`1d1l1t1", "CurPageChanged", "1D2`2x2", "TRttiIndexedProperty6", "VByte", "CheckNamingAttribute", "?,?H?O?d?h?l?p?z?", "8\"858P8^8q8", "SAVESTRINGSTOUTF8FILEWITHOUTBOM", "TStandardGestures", "IsSingleByte", "SetPngImage", "8 8)8E8", ">ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$7$Intf`'@", "FStarted", "444F4O4g4", "APopupForm", "Not stripping read-only attribute because the directory does not appear to be empty.", "|NewUxTheme.TmSchema", "9TEnumerable", "trSlipperVertPressed", "FUserInfoOrgEdit", "paArm64", "\\TEnumerable>'", "MainPanelx", "0*1=1c1", "CreateMutexW", "ASetDefault", "3&343D3V3l3", ">K>n>", "UseLocale", "UhGPf", "&TList.TEmptyFunc`'@", "TSetupPrivilegesRequired", "CreateOutputMsgMemoPage", "9<9g9p9", "9 9$9(9,9094989<9@9D9H9L9P9d9h9", "TThemedEdit", "DrawControlText", "= =$=(=,=0=4=A=X=m=u=", "Accepted", "?)?H?", "GetArrayElement", "GetEnhMetaFilePaletteEntries", "=\"=)=0=7=>=E=L=S=Z=a=h=o=v=}=", "tlGroupHeaderOpenHot", "4#414A4O4g4o4}4", "tbRadioButtonCheckedDisabled", "zuCQ[2", ":TDictionary.TKeyEnumerator;", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$2$Intf`'@", "8+9U9", "ktfHeaderSectionTextHot", "tspPlacesListSeparator", "TNewProgressBar6", "GdiFlush", "H.2{T\"", ">5?j?", "< <,<:k>", "TEditD", "=*=?=M=_=w=", "Shared.TaskDialogFunc", "? ?5?J?_?w?{?", "GETSYSTEMDIR", "TIntfFlagsBase", "cdPascal", "dsSelected", "afPremultiplied", "tmMenuBarItem", "THTTPCompressionMethod", "iso_8859-4", "<)<1<9<", "?6?@?d?t?|?", "1&181@1N1`1z1", "TCustomPanelPeV", "-TEnumerable(", "GetFileVersionInfoSizeW", "thHeaderItemPressed", "TabTextInactiveDisabled", "344g4", "skNone", "7 7]7x7", "1I2M2U2", "1/1G1O1W1_1g1o1w1", "AFunc", "+GX;D$", "Setup.SelectFolderForm", "TReader'", "claDimgray", "8 888J8N8l8|8", "TextMarginRightStretch", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6|6", "function ExpandUNCFileName(const FileName: String): String;", "3/3<3J3\\3l3", "0 0$0(0,0004080<0@0D0H0L0Y0l0~0", "Failed to load DLL \"%s\"", "CreateWindowExW", "VarBoolFromStr", "UnregisterClass", "FD$0P", "4 414B4R4Z4k4|4", "485<5@5D5\\5h5l5p5|5", "<8>(", ">0?h?", "fdoForceShowHidden", "FAnimateThread", "KeyExists", "IDISPATCH", "=$=(=,=0=4=8=<=@=D=H=L=P=h={=", "FOnSimpleDownloadProgress", "(", "FOnBalloonClick", "3!3(3/363M3Q3U3p3x3", "6\"6.6H6o6", "EPNGInvalidNewSize", "3 3.3=3E3T3l3p3", "FCustomHeaders", "DefaultDirName", "GetEnvironmentVariableW", "TabStop", "3 3$3(3,343<3X3m3{3", "4.4H4e4|4", "9L:P:T:X:p:|:", "AddtEXt", "Geometry", "TIntfMethodTable", "FParentZone", "8(:k:", "TArray", "TStringList&", ":';9;Z;^;b;f;j;n;r;v;z;~;", "SetNamedPipeHandleState", "=!=0=", "tcCueBannerDisabled", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1", "Uh.ag", "8T9c9x9", "tnForwardButtonNormal", "0%080R0`0o0", "MinValue", "GetKeyNames", "emCaption", "6'62686H6P6X6`6d6h6l6p6t6x6|6", ";,;=;D;b;r;", "5!5%5<5D5H5^5b5f5", "WTArray>", ":#;~;", "ecNormal", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$14$Intf`'@", "kwbRoll", "7$7074787<7@7D7H7L7P7T7X7`7h7p7x7", "434F4c4~4", "2\"2(2-272B2r2", "GetMenuItemRect", "EFileStreamErrorN", "PressedColor", "GlobalAddAtomW", "9&9,9<9K9S9b9h9", "ClientGuid", "3*3R3", "Masked\\oG", "tsDownHot", "GetMenuHeight", "CreateComObject", "TSeScrollSubclass", "2-2<2O2i2w2", "Values$", "ktcButtonHot", "ALogProc", "dwVersion", "WinHttpQueryOption", "dwStateMask", "]TEnumerator>", "0TList.TEnumerator", "&op_Addition", "8d8w8", "dnnn=#", "k`+l$", "OnDblClick", "WelcomePage,5_", "5 5(5,5054585<5@5D5H5L5P5T5X5\\5|5", "LocationEdit", "Windows Server 2016", "rgbRed", "%fgg-", "3\"303D3Q3Y3g3y3", "TMarshaller.PDisposeRec", "8>F>Y>i>x>", "?I?e?", ":&:4:D:l:p:", "727:7]7a7e7", "kwbHelp", "0\"0*0;0I0Q0_0l0", "Uh~xK", "TFileStream0", "GetAttribute", "DefaultButton", "Brotli", "TArray", "procedure DeleteIniEntry(const Section, Key, Filename: String);", ">#?Z?l?u?", "3 4-4u4w5", ">ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$15$Intf`'@", "2$2,242<2D2L2T2\\2d2l2t2|2", "5 5-5>5S5[5", "vaList", "InnerNotebook,5_", "FShareImages", "2/2C2[2v2", "9(9,929w9I:T:", "PRQhp", "6 6$6(6,60646@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "FCurrStackBase", "MouseInNCArea", "ModalPopupModeXmG", "3!363K3\\3r3", "9f:E;", "<6(", "OnScroll", "CaptureList", "%TList.arrayofT", "tfCallbackTimer", "FLastProc", " TStrings::AddStrings(Strings, Objects);", "0'050A0M0Y0e0q0}0", "707C7\\7u7", "SetThreadLocale", "020C0S0", "FOkButtonLabel", "kwbSysMenu", "849I9Z9o9}9", "IHTTPResponse", "TSeToolInfo", ":FruR", "EditBoxTextHot", "Release", "%&'()*+,-. ", "FWindowMenu", "skLineDown", "D2D1_ELLIPSE", "Image", "ChevronClosed", " TOutputMarqueeProgressWizardPage\\", "skFMXSpeedButton", ")TList.arrayofT", "OnDrawItem", "ktxsSingleLine", "GroupedWith", ">#>B>5?F?g?", "TBase64Encoding", "Not calling NeedRestart because a restart has already been deemed necessary.", "FOrphanPackage", "?ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$9$Intf`'@", "353t3", "FReadOnly", "ttbSeparatorVertPressed", "3W3l3z3", "SetInt64", "AddInstItem", "ktigMin", "7#717B7[7i7z7", "Designer", "0(1D1V1", "clMaroon", "OnCloseQuery", "!IComparer`'@", "TCustomEdit", "ttbThumbLeftNormal", "FOwner", "Creating new uninstall log: %s", "Anchors", " name=\"JR.Inno.Setup\"", "FOnExtractToHandleProgress", "TThemedPage", "cp855", "FloatType", " CrystalIDEA Software ", "YesToAllButton|", "+TEnumerator", "ktxsWordEllipsis", ";C", ">6L6V6j6p6", "8 8$8(8,80848A8S8p8x8", "3'3=3J3X3g3{3", "SysListView32", "Embarcadero Delphi for Win32 compiler version 36.0 (29.0.55362.2017)", "ttTabItemLeftEdgeNormal", "4(4,40484@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "7'7,797>7K7P7]7b7o7t7", "838;8?8R8Z8r8", "FDesktopFont", "TThreadInfo", "Uh;mM", "3%333@3R3g3u3", "0`1i1", "7l7p7", "%TArray", "%s.Seek not implemented$Operation not allowed on sorted list", "lrFromFile", ";!;7;H;`;q;", "EventCount", "#TList.arrayofT", "TDrawingStyle", "? ?$?(?,?0?4?8?", "4)414@4\\4`4", "9(969>9O9]9e9s9", "RemObjects Pascal Script home page:", "FindData", "FieldType", "Permission Denied", "6~b\\LJ", "8)8?8C8M8U8]8", "7.7<7O7e7v7", "sfButtonTextHot", "sbmRightToLeft", "Waiting", "2\"2;2L2Z2b2p2~2", "TURLEncoding.TDecodeOptions", "=g=", "1:1>1_1c1~1", "FileVersionMS", "FAsyncList", "fWinapi.KnownFolders", "ButtonCaptions", "commoncf64", "GetWindowDC", "CheckTerminated", "GetProc", "RttiCount", "0+0<0Q0_0r0", "7a8l8", "TArray", "4)4@4U4c4k4v4", "C`+D$L", "TThemedTextStyle", "<(=]=", "9 9$9(9,90989i9x9", "1.2E2g2~2", "=%=6=J=R=c=q=y=", "GrayscaleFactor", "5/5=5T5i5w5", "6 6(60686", "*TList.ParrayofTxHe", "Integer overflow Invalid floating point operation", "Flags", "5,5@5H5Y5g5o5}5", "9 9?9", "-4Mcrs", "FActiveCustomForm", "FClassType", "IsWow64GuestMachineSupported", "iso_8859-5:1988", "1!121R1d1", "tooltip", "OnActiveControlChange\\oG", "PRTLCriticalSectionDebug\\JA", ";$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;n;v;", "Uhkyg", "MainButton2", "5&6_6", "TPosition", ")=h!h", "3)3L3\\3d3l3t3x3|3", "5-5O5W5r5", ".TItemArray", "=+>:>B>T>", "EPNGIHDRNotFirst", "InitializeConditionVariable", "TDWordFiller", "wipmNearestNeighbor", "?$?(?C?G?d?", "3(3,30383@3D3H3L3P3T3X3\\3`3d3h3l3p3t3", "9#919>9P9]9e9s9", "6 6$6(6,6064686<6@6D6L6", "Z_GROUPICON_DARK", "J'\\'Gg", "ScalePixelsY", "TECDSAPrivateKey`", "0V1\"2,262;2B2L2V2[2", "Unregistering 64-bit DLL/OCX: %s", "skTitle", "fsVisible", "<\"0Q0z0", "claDarkturquoise", "TickCount", "iso_8859-4:1988", "LanguageDetectionMethod", "ShowMainForm", "TCustomDecompressor9", "7$7M7", ";(;O;", "tcTransparentBackgroundDisabled", "9\"909G9O9a9m9s9{9", "WorkAreaHeight", "PProcedureSignature`", "Building", "OnExecute$", "7'787Z7g7x7", "Uh/bJ", "Uh$(>?>_>o>v>", "8*8@8Q8n8", "8-8D8U8h8y8", "LoadDesigningStyles", "2G3Y3z3~3", "?5?E?^?z?", "FlatSB_ShowScrollBar", "EditBoxTextFocused", "8'8/878?8G8O8W8_8g8o8w8", "%1:.2d:%2:.2d:%3:.2d", "TBevel", ")Scheme-dependant function not implemented", ";$;O;];k;y;", "PPUnitX", "kescEditBoth", "klscLabel", "OnMouseWheel", "Uh@.K", "^2d=g", "function IsProtectedSystemFile(const Filename: String): Boolean;", "4%4,434:4A4H4O4V4]4d4k4r4y4", "DoHint", "scButtonDisabled", "^)wU[", "1;1F1", "R=*9sK", "ShowErrorDialog", "TOnDownloadProgress", "2,3A3O3a3p3x3", "; ;.;A;P;b;u;};", "Setup.ISSigVerifyFunc", "FromVarRec", "pcbRead", ":(:>:U:r:z:", "r!t3Hta", "LOADSTRINGFROMFILE", "6(6,6064686@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "3&343L3T3b3r3", "BCryptExportKey result invalid (2)", "9)9N9s9", "UhHs`", "_Default", ":GruNFKu", "kwscTextured", ";);.;:;?;E;Q;V;\\;h;m;y;~;", "TSmallPoint(const TSmallPoint& p){ x = p.x; y = p.y; }", "5'6+6R6\\6", "aZ[[)", "4\"4&4*4.42464:4>4B4F4J4N4R4", "= =4=U=]=a=t=", "GetParams", "TFontData", "<;0", "windows-1253", ",//[Qyn", "cFileName", "TIStringComparer'", "TSeStyleColor", "MDIChildren", "QQQQS3", "GetFields", "fYear", "GetSelTextBuf", ": :|:", ";*<9TCollectionNotifyEvent", "PaintBorder", "5=5[5f5", "Invalid argument", "Uh{7F", "FNativeWheelSupport", ":3:B:N:\\:k:v:", "UhVz]", "TMemoStrings%", ";6;R;^;r;|;", "1g2k2o2s2", "FiredEvent", "ttbSplitButtonDropDownNormal", "5 555C5Z5o5}5", "PMonitor", "'TEnumerable'", "9TDictionary.TKeyEnumerator", "718e8", "TSeLabelSubclass", "=!=+=;=u=", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$19$Intf`'@", "MouseLeave", "NTDictionary.TValueCollectionTSX", "4,4<4N4V4d4q4", "csMenuEvents", "GD_^[", "Reserved1", "Capacityt", "8,8<8@8D8H8L8T8X8\\8`8d8h8l8p8t8x8|8", "teBackgroundFocused", "=)=1=K=O=S=p=t=", "Uh'`f", "ControlBar", "scode", "FSavedMaxLength", "AList", "AutoSize", ":.:l:", "kcdsUncheckedHot", "Ordinal", "RichEditViewer", ">$>)>6>>>D>I>V>^>d>i>v>~>", "TGetStreamProc", "ACallback", "break", "tpChunkVert", "VertScrollDisabled", "TFolderTreeView", "EZCompressionError", "SAMEPACKEDVERSION", "windows-1257", "NewUxTheme", "tsiAudioPressed", "GetStandardGestures", "UTF8ENCODE", "Uh<4C", "TStackPanelVerticalPositioning", "6#6*616<6H6L6P6T6\\6d6h6l6p6t6x6|6", "Compression.SevenZipDecoder", "Destroy", "DesignSize", "FMaxButtonRect", ";$3>7>V>b>x>", "\"IEnumerable", "tGf;J", "HandleAllocated", "VarIsClear", "Constraintsx8Q", "*TList.TEmptyFunc`'@", "TVarCompareResult", "USVW1", "ShouldSizeX", "FExpanded", ";TEnumerable", "9.9N9_9q9", "1'141F1b1p1}1", ": :(:0:8:j:", "SolidHorz", "ccPascal", ";I6I6P6X6s6", "SuppressibleMsgBox", "?0?@?N?]?k?", "&S>w3", "FAlignment", "CreateImplementation", "FSaveFocusedList", "NewStaticText", "btnLast", "ControlSide", "diDesaturateBlend50", "ksbdsDisabled", "AutoDropDownWidth", ";?.TKeyCollection;", "5 5.5;5I5]5n5", "SrcRect", "PLibModule", "pf32bit", "AdjustHeightIfCommandLink", "8$8,8084888<8@8D8H8L8P8T8X8\\8`8h8", "8#8+838;8C8K8S8[8c8k8s8{8", "wReserved1", "PopupMenuItemTextHot", "SetDesigningStyle", "TPicture", "<&>1>\\>", "454D4[4", "242E2S2[2i2w2", "ShowText", "TseColor", "5%535F5V5e5s5", "TOutputProgressWizardPage", "tlGroupHeaderLineOpenHot", "KeysTuX", "ResultHi", "function Terminated: Boolean;", "'TCredentialsStorage.TCredentialComparer", ">6>_>c>g>", "tlListGroup", "Dialog`", "FVertBtnSliderDetail", "!TList.TEnumerator<", "Uh\"do", "skClient", "WriteWideChar", "MaxButtonRect", "iso-8859-6", "9Y9t9", "Available", "5)5-5T5d5l5t5|5", ">>>b>", "OnEvalIdentifier0", "3)373C3P3`3d3h3p3x3|3", "sma-SE,sma,se", "FTimerMode", "Allow", "<8T>", "405\\5}5", "TScrollBar6", "TArray", "Saving uninstall information.", "tfExpandFooterArea", "SetInitialState", "ResetFonts", "0x%.8x", "cnNlK", "bsChecked", "bsPressed", "<,=^=", "%4w?u", "ButtonClass", "(IHDR chunk is not the first)", "TCustomShortCutListA", "Put307", "=(=,=", "0G0K0", "khdsHot", "\"TArray", "RunProcedure", "seClient", "TSetupEncryptionNonce", "CustomColors", "GETMD5OFSTRING", "WaitForCompletion", "OnModalEndXE[", "FResources", "TScriptRunnerOnExceptionT", "ElevationRequired", "kmicClose", "RunStringFunctions", "TSeWindowInfo,", "(TRttiPool.GetPackageList.DoUpdate$0$Intf`'@", "<&=5=E=p=S>", "<2<9<@", "8w6]k", "Output redirection error: SetHandleInformation failed (%d)", "invalid literal/lengths set", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;f;x;", "ssCommand", "FHintCursorRect", ">0?E?S?k?z?", "SystemButtonspHA", "UndockWidth", "tlListItemSelectedNotFocus", ";@.arrayofT", "ksscStatusBar", "GetSetupType", "< <$<,<4<<Inno Setup", ": :L:\\:`:d:l:t:x:|:", "DrawObjectText", "0(000@0", "Chunk", "i[5ou", "?&?:?_?t?", "7,7;7L7x7|7", ":$:(:L:P:u:y:", "claLightgray", "OnHyperlinkClicked\\oG", "TEnumerator(", "Aligning", "6!6%6)6D6L6f6n6r6", "UhL3K", "GetSystemWindowsDirectoryW", "FPageDiv", "iso-ir-203", "FPageSize", "ktfMenuItemTextHot", "OnFolderChange", "&TEnumerable'", "unkVal", "", "@ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$15$Intf`'@", "FActivating", "UhPkP", "PlusAsSpaces", "GetExitCodeThread", "2/2=2N2h2z2", "IStreamPersist`'@", "AddBytes", "FClipboardWindow", "key-id", "PointerInList2", "<\"<*<2<:9B9F9J9N9R9", "EvalArchitectureIdentifier", "FActiveOleControl", "CLYZ[", "mpr.dll", "Unexpected ExtractArchive flag", "GetObjectW", "-- INI entry --", "OnTimer\\oG", "FPopAbove", "6!646C6U6h6p6~6", "?-?;?N?^?o?}?", "FilenameEditl", "fsCreating", "ReadDate", " TArray", "PrepareToInstall", "GetItemEnabled", "0*080O0d0r0", "No help found for %s", "141>1`1p1x1", "GetTypeCount", "scrollbar", "1'1G1U1c1u1", "1%171Q1_1n1", "5#505<5", "LocalFileTimeToFileTime", "2 2$2(2,20242L2\\2`2", "tbCommandLinkGlyphNormal", ";5.TValueEnumerator", "TGUID", "fi(6p", "7#7'7+7", "*><>L>b>x>", "1$1@1c1k1", "ChunkSuboffset", "psRunning", "paRight", "IDispatch`'@", "poDesktopCenter", "9+9?9S9g9~9", "TNewLinkLabel", "]TEnumerator>(", "464>4U4]4s4{4", "9*9/9=9B9G9", "*TListH", "PACKVERSIONCOMPONENTS", "RealizePalette", "snControlDestroyed", ":*:?:G:u:", "343E3]3x3", "464?4r6", "AddSpecialProcImport", "7,8X8y8", "AttrData", "?$?;?W?z?", "data_type", "saOther", "ExtractLatestRecData", "tmPopupCheckBackgroundBitmap", "TNewStaticTextp", "1$121?1", "SysMenuButtonRect", "PPRTj", ":$:-:<:", "TrySetDesigningStyle", "<0p>", "UnsignedFunc", "989G9O9`9", "", "ItemType", "kescEditLeft", ":4:E:I:}:", "FSaveSelection", "Couldn't read time stamp. Skipping.", "DestDir", "DownloadTemporaryFileSize", "VarMul", "NewUxTheme.TmSchema", "clGreen", "dsFocus", ":(;,;S;];a;", "FGrowThreshold", "tpDockPanelCloseNormal", "Keys(", "TPropSetd3D", ">Dkk+}}}", " TArray", ";(;S;x;", "UWVSj", ">G?X?z?", "!TSimpleExpressionOnEvalIdentifier", "l}rjk", "function FindWindowByWindowName(const WindowName: String): HWND;", "AName", "twCaptionInactive", "2+2d2", "FGlobalContextCounter", "TResData", "ClickThroughPages", "`TEnumerable>'", "Setup.RedirFunc", "skTopLeft", "tbCommandLinkGlyphHot", "ImageList_GetIconSize", "7&7*7H7X7`7h7p7t7x7|7", "?7???M?_?m?", "AStartIndex", "ButtonPressedForegroundColorpHA", "fsReadWrite", "claPeru", "ktfListItemTextFocused", "FImages", "AddPopupForm", ">!>P>", ".ShellClassInfo", "BkColorRef", "sbtMinimize", "TDockOrientation", "LastExProc", "TFileExtractorB", ":M:i:q:{:", "twMDIHelpButtonNormal", "igRotate", "windows-1258", "vaDouble", "claMistyrose", "2`3~3j4", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$15$Intf`'@", "GetAsHandle", "TSysScrollingStyleHook7", "747P7V7", "51.1052.0.0", "kridsSelected", "SetColor", ">'>?>F>d>M?", "3&3:3Y3g3z3", "ScreenSnap", "<*>'", "FOnClose", "Edits", "TRttiNamedObject", "iso-8859-4", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", "IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)", "tmbSeparatorChecked", "FLicenseNotAcceptedRadio", ">0>H>Z>h>z>", "__COMPAT_LAYER", "0TList.TEnumerator5", "FAsSInt64", "FOnDialogDestroyed", "DataSizepe^", "APrompt", "SetSelected", "WriteSingle", "102f2", "\" constant", "3-353C3P3^3r3", "commoncf", "FYearlyCache", "UseBOM", "ttbSplitButtonDropDownDisabled", "NoToAll", "Winapi.WinInet", "TNewCheckBox", "ktigRollRestore", "6a6s6", "'?IWw%", "varChild", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$6$Intf`'@", "FVariantArrayType", "Uh9Yc", "92989D9H9L9P9X9`9d9h9l9p9t9x9|9", "Last-Modified", "SCALEY", "?3?L?e?", "44484<4@4D4H4q4", "shfolder.dll", "<&<8$", "=%=3=?=L=", "<&<7>", "UhuLJ", "Comparer.TValueEnumerator", "4(4-424>4C4H4T4Y4^4j4o4t4>5^5h5m5r5", "uninstall:", "PageFromID", "FWinControls", "=W=b=o=", "FFontColor", "TSetupTypeEntry.", "9'9.959<9C9J9Q9h9l9p9", "8(8.848:8@8G8W8u8", "FDefaultFolder", "2<3L5", "Focused", "claOldlace", "CustomColor", "4*484H4[4m4u4", "PhhfR", "LoadDebugData", "1*1D1", ">)?F?J?N?R?V?", "Uh+4c", "ReadWideChar", "8\"9A9", "5W5l5z5", "kebcDialog", "83979^9h9l9", "tcbYes", ";?;Z;g;", "Not restarting Windows because Setup is being run from the debugger.", "&op_Implicit", "FAllowScrolling", "InstallSuccess", "UhKgJ", "_CRYPT_BIT_BLOB", "4I4a4y4", "tdSVWU", " !\"#$%&w", "ActivateHint", "FOldHeight", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$3$Intf`'@", "S)!~7", "clWindow", "ClientRect", "@TList.TEmptyFunc`'@", "function ExitSetupMsgBox: Boolean;", "8 8$8<8H8L8P8\\8`8d8l8t8x8|8", "Uh--n", "Creating \"_unins-done.tmp\" file.", "_^[Y]", ">??l?", "%s (Error code: %u)", "function CastIntegerToString(const L: LongInt): String;", "3TEnumerable'", "claBisque", "Weights", "TCookieManager", "3/373Q3U3w3", "FCreateSuspended", "TPSRuntimeAttribute", "tfEndEllipsis", "=TD)%", "5I6C7", "DownloadTemporaryFile: Invalid BaseName value", "!0%0A0K0p0", ",TArray", "MainFormHandle", ":Q5>C>P>b>o>w>", "*TEnumerator(", "ktcEdit", "5<5L5T5\\5d5h5l5p5t5x5|5", "kgicNormal", "<$<,'", "ExceptionProc", "csFixedWidth", "RedrawDisabledXFA", "clInfoText", "Floating point underflow", "IsScrollTransparent", "AUser", "FWaitEvent", "3#3<3X3`3h3p3x3", "ProgressDraw", "AllocMem", " ", "DrawFrameControl", "6/6I6W6g6z6", "btnDelete", "2&2D2J2V2e2", "tbButtonDontCare", "EditBoxTextDisabled", "OnVerificationClicked", "kebcCustom", "ShowHintXZQ", "7$7;7C7e7i7m7", "4.464G4U4]4k4}4", "Uhn9U", "?'?/?C?X?i?", "GetVersion", "t$4SQV", "ecGlowColor", "TWizardPageNotifyEvent", "TSettingChangeEvent", "5&565\\5o5s5", "%s-%d%s.bin", "StyleHook", "DisplayIcon", "Registering 32-bit type library: %s", "StrToIntW", "UnlockList", "9M9]9q9", "GetClass", "kwhtMinButton", "ecGlyphTransparentColor", "Worker thread terminated unexpectedly with exception: %s", "0,1<1", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$9$Intf`'@", "FChunkLastSlice", "ExceptionPos", "function SameStr(const S1, S2: String): Boolean;", "TFontStyles", "7(7;7I7_7r7", "OleVariant", "reserved", "$TComparer", "tiComma", "6$6+626I6M6i6m6", "?ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$1$Intf`'@", "TProgressThrottlerB", "dmStepOver", "OnEnter\\oG", "=&><>n>", "8 8(8084888<8@8D8H8L8P8T8X8\\8`8d8q8", "Unused2", "IndexOfItem", "", "tsDownHorzPressed", "1\\2k2", "NoRepair", "clMedGray", "Rightx=Q", "Y,//c}}", "Uhrzg", "gfEnd", "SelectDirLabel$", "3'3P3", "8 9'9", "AHXLXN", ";A;Q;", "/LogCloseApplications", "CalculateButtonWidth", "v4.5.2", "2D3t3", "474V4^4f4n4v4~4", "<-<9'", "788A8", ";`;R;g;", "NewHeight", "", "CloseThemeData", "Uh,XV", "function ScaleY(Y: Integer): Integer;", "0)0-0105090=0A0E0I0M0Q0U0Y0]0a0e0i0m0q0u0y0}0", "M/pY/", "FSVWQ", "OleAutoVarType", "cp860", "UhTiD", "InfluenceRect", "TrackSystemMenu", "2!272?2X2h2p2t2x2", "desktop.ini", "AddOrSetValue", "Target", "FNextButton", "7%7A7W7e7u7", "?q?v?", "1+1:1F1T1c1n1}1", "FParameters", "tdnbLastDisabled", "MarginTop", "0&0F0N0`0m0z0", "7c8g8k8o8}8", "tmpbStepDisabled", "SmallInt", "4-4F4T4f4", "tmcNavNextDisabled", "ImageHandle", "k]?P?|", "=&=4=H=`=s=", "JTDictionary.TPairEnumerator", "\"TEnumerable'", "THelpViewerNodeD", "<$.ParrayofTP", "TextText", "TPopupAlignment", "TResStringHashItem", "ExecuteAction", "ScaleForPPI", "SurfaceColor", "061g1p1", "UhOOk", "S _^[", "TAbstractTaskl=e", "TTypeTable", "7185898=8A8E8I8M8Q8", "ValuesH%M", "2 242G2Z2", "<(<=.ParrayofT0", "ttbThumbRightFocused", "TMenuItemStack", "CheckItem", "D$X;C@|", "9\"9&9*9.92969:9>9B9F9J9N9R9V9Z9^9b9f9j9n9r9v9z9~9", ";';/;E;];e;u;", "maRightToLeft", "alClient", ">%>->5>", "LoadDesigningStyle", "WizardDirValue", "StrToIntDef", "TProxySettings(", "SPRVP", "4W5[5_5c5q5", ":#:::>:B:]:}:", "=m>u>", "ldLocale", "ATimeout", ";*;K;O;S;W;[;_;c;g;k;o;s;w;{;", "FUseQualifiedNames", "FMDIChildClientOffsetCY", "TSetupWizardDarkStyle", "3\"333;3I3`3n3", ">F>N>T>Y>", "GetHotSpot", "kwhtMaxButton", "kticClose", "TList", "FOnStartDrag", "AnsiLowerCase", "twSmallCaptionDisabled", "SetArrayElement", "6%6D6[6", "Windows Server 2025", "TParamFlags", "Currentl_e", "=*=<=M=_=w=", "<0<4\"?m?", "IsCheckTransparent", "cLocks", "JTDictionary.TValueCollection;", "?n?r?", "UhOgl", "startIndex", "ImmGetContext", "GetDiskFreeSpaceExW", "0*020D0f0j0", "><00p", ":):7:K:a:t:|:", "TIntToIdent", "Invalid code page", "bstrSource", ")g}KM[", "4 434Q4_4v4", "GetField", ">/>L>Z>", "7J8q9{9", "0-0:0K0U0]0k0}0", "@TList.arrayofT", "FFontPressed", "4D5P5T5X5\\5`5d5l5p5t5x5|5", "FOnDropDownClick", "Deleting INI entry: %s in section %s in %s", "t$ SVW", "526`6", "0'050=0K0Y0m0u0", "IsObject", "6+6>6F6T6g6|6", ":Y~IE~6r", "InitializeUninstall returned False; aborting.", "FValidateServerCertificateEvent", "TFiler4", "CoWaitForMultipleHandles", "TSysEditStyleHook", "TreeItemTextDisabled", "Mvm})", "RelPath", "tgIndicatorArrow", ";S8tB", "MMWidth", "0+0<0T0\\0j0z0", "TParamFlag", "1.1N1o1", "IsBarTransparent", "kebdsDisabled", "98:<:@:D:\\:h:l:p:x:|:", "GetForegroundWindow", "1 1(10181<1@1D1H1L1P1T1X1\\1`1d1h1l1t1|1", "RegCloseKey", ";%;.;8;", "7-757C7U7p7x7", "TSysButtonStyleHook7", "TextWidth", "SetData", "FHorzBtnSliderDetail", "SortCredentials", "484H4X4h4v4", "TEnumerable", "FShowing", "trailingWhitespaceLength", "FWindowList", "FMessageFont", " TCustomStyleServices.TStyleFlags", "<.=5=", "FAutoSizeDocking", "3,3>3O3W3e3t3", "TOutputMode", "ttbDropDownButtonGlyphHot", "SetFont", "TSeTreeInfo", "FHits", "0d1D3Q3r3{3", "dwHelpContext", "GetEnhMetaFileBits", "TThreadPool.TControlFlag", "Software\\Embarcadero\\Locales", "OnDeactivate``Q", "%s: Invalid MinVersion string", "PrepareToInstallNeedsRestart", "FLastActive", "UhM|g", "TElementEdges", "Section", "0^1b1f1j1x1", "UhkAb", "NeedRestart", "FBtnRightDetail", "csSetCaption", "Cannot Import %s", "CreateDirectoryW", "2$3(3,3034383<3T3`3d3h3p3t3x3|3", "West-Vlaanderen1", ">&>4>K>`>n>", "RadioButton", "FHintFont", "0.12161:1>1B1", "Aifaa!", "ThumbVertLeft", "TotalElementCount,", "UhCcl", "6,7D7h7", "FKeepSizeY", "OnStartDrag.", "NTList>.TEmptyFunc`'@", "2\"282H2P2X2`2d2h2l2p2t2x2|2", "8.9D9U9i9q9", "FHideSelection", "SerialNumber", "Detail", "IsListDefined", "NSystem.Contnrs", "6\"6/686>6H6N6V6d6i6u6", "function RegisterWindowMessage(const Name: String): LongInt;", "CardIndex", "SafeArrayUnaccessData", "fqClearTypeNatural", "TThemedWindow", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "scSplitter", "W>e>", "GetIndexByName", "S8_^[", "cTSparseArray>", "February", "TExternalThread&", "EditDrawButton", "=C=g=", "Delphi Picture", "saBottom", "=8=J=Y=k=z=", "ttsBodyTitle", "ttsInstruction", "RmGetList finished successfully.", "SysInit", "101=1A1[1b1i1p1w1~1", "747x7", "function GetMD5OfUnicodeString(const S: String): String;", "1<2@2D2H2L2P2", "sfEditBoxTextSelected", "ArchitecturesInstallIn64BitMode expression matched 32-bit system", "System.Win.Registry", "iso-ir-166", "OnShow", "ibm864", "GETINISTRING", "6+6F6N6\\6j6{6", "Uhb_k", "/Tasks=", ";\";*;2;:;B;", "<$=.=P=`=h=p=x=|=", "Vertical", "3C4e4", "ITDictionary.TKeyCollection;", "TControlStyleItem", "Helper process exited, but failed to get exit code.", "3Kck", "9W)%M", "3&373Y3f3w3", "FOnEvalIdentifier", "8%8<8D8R8j8", "pmMerge", "< <$<(<0<8<<<@h\"g", "claDarkmagenta", "ThreadCache", "OnCancelButtonClick", "SHELL32.dll", "kwscStandard", "0 0D0T0\\0d0l0p0t0x0|0", "tebHeaderPinPressed", "TCustomVariantType", "OKButton", "'?ISS", "521C!", "2.353L3P3T3X3\\3`3d3h3A4K5R5m5q5u5y5}5", "<5e1_", "ThumbHorz", "<*.TEmptyFunc`'@", "FParentTask", "FLeftButtonDown", "ComObject", "<,6>D>X>k>", "System.Diagnostics", ";#;1;@;j;n;", "igoPanGutter", "-{6R6", ":TDictionary.TPairEnumerator;", "TDragDockObjectEx", "nn 4&Z", "313(7E7U7d7u7", "cp863", "FInvariant", "FreeSid", "TEnumActionListEvent", ":%:2:H:]:e:s:", "sfTabTextActiveNormal", "5A5d5", "1*1:1U1s1", "kmidsNormal", "0+0I0f0q0w0~0", "VPointer", ":TLocalTimeZone.:1", ">1>?>O>a>i>w>", "VP;VPv", ">(>;>I>\\>k>}>", ":/:G:R>", "?,?9?G?]?k?x?", "3 3$3(3,3034383<3@3D3H3U4\\4L5P5T5X5\\5`5d5h5l5p5t5x5|5", "; ;(;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "tttBaloonLink", "tcBackground", "TInputDirWizardPage", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5x5", "abc?defg", "=#=+=3=P=e=s=", "D$,Ph", "csibm860", ";7;L;f;x;", "Selected", ":':@:V:k:", "Shared.SetupSteps", "FOwnsStreams", ">#>4>", "TCheckBoxStyleHook", " e: Extract files from archive (without using directory names)", "4A4d4h4", "Method already assigned", "FHelpSelector", "TSysRichEditStyleHook", "H]_^[", "AHighLoc", ">8?E?T?g?k?z?", "Gripper", "?-???G?U?c?y?", "NCPaintHint", "ttbThumbVertPressed", "wifGif", "'N\"'d", "Version of our file: %u.%u.%u.%u", "IDNAToUnicode", "1,2U2", "IsThemePartDefined", "FSysMenuActive", "Inflate", "1xtsS", "=<=_=g=r=x=", "pmMergePenNot", "TSeColorButtonObject", "teTrackBar", "$>5>W>d>u>", "8p;t;x;|;", ";@>", "=$=9=L=T=l=", "wrError", "93979Z9^9", "FLastQueuedRequestCount", "sfHeaderSectionTextNormal", "", "5N5[5", "lzmadecomp: Compressed data is corrupted (%d)", "414F4\\4q4", "RDZ]_^[", "EPNGOutMemory|G^", "TSeScrollButtonClass", "AAbort", "THandleObject:", "=+=@=N=d=y=", "5'6P6", "StretchedBitmap", "StylusHotImageIndex", "FSystemButtons", "+IEqualityComparer`'@", "kmgMax", "=%=-=;=M=c=q=", "1TCollectionNotifyEvent", "searchindicators", "HTTP/2", "[Invalid]", "6$9o9[:", "menuband", "sfTreeItemTextSelected", "5Q6U6Y6]6k6y6", "1'1=1S1", "6Z7g7t7", "dkStatic", "GlowSize|", "364>4N4[4g4u4", "2,2C2Q2a2t2", "8 8$8(8,8084888<8@8D8H8L8P8T8a8w8{8", "ktcHintGradientBase", "!0<0V3", "psAlternate", "202>2F2T2`2", "AParameter", "2&2.262>2", "9/:?:P:|:", "FCurrentDebugProc", "495h5", "Windows 8", "3b4f4j4n4r4v4z4~4", "V0]0y0}0", "ACredential", "System.StrUtils", "R(FOu", " const System::DynamicArray Objects) {", "tpPanelRoot", "function IsWin64: Boolean;", "4!4<4G4R4]4h4Y5", ":$:E:S:j:", ":*:A:O:f:{:", "msctls_progress32", "Flush", "OnStartDragI", "Capacity", "TExternalThread", "7#7:7Q7d7|7", "sfLeft", "UhA`Z", "%0:d.", "Windows 10", "ecGradientColor4", "TSeStyleConfig", ":):P:", "ActionPJQ", "697=7d7n7r7", "PanelTextNormal", "FMaxTotalBytesToRead", "=4=U=", "ttbSplitButtonNearHot", "Comparerd", "FTIPIntf", "ExpandConstant", "4%4-454=4E4_4u4", "TSetupLanguageDetectionMethod", ";\\$,r", "I~tEi", "stream error", "Current ee", "6Shared.VerInfoFunc", "-- File entry --", "Unregistering font: %s", "twCloseButtonNormal", "WriteDateTime", ".TEnumerator5", "VUInt64", "TReceiveDataEvent", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$3$Intf`'@", "TBaseDragControlObjectP+Q", "OnStartDrag4", ":!;<;O;b;r;z;", "7 7(7,7074787<7@7D7H7L7P7T7X7\\7`7n7", "TArchiveFindState", "FPageIncrement", "<78U8", "0k0y0", "IAsyncResult", "OutputReader: ", "claDarkslategray", "7W*.;", "Hours", "2(2=2P2T2[2n2", "TRttiInstanceType@", "TStringBuilder", "4#414D4T4c4q4", "ClassRef", "Uh$YC", "456789", "EZLibError", "%USERTrust RSA Certification Authority0", "PFieldExEntry(", "8#818=8L8x8", "FStream", "5%565@5H5V5h5", ">TDictionary", "7.7?7R7c7v7", "4 4(494H4P4`4z4~4", "DoApplicationIdle", "StoredProc", "TPopupList2", "function GetIniString(const Section, Key, Default, Filename: String): String;", "TDate", "kwdsMinimized", "@$_^[", "TFileCreateDisposition", "7:7V7r7", "4 4$4(454H4a4i4q4y4", "FFlCx@", "ImageList_DragShowNolock", "setup:", "MarkedAsRemoved", ":&:.:6:>:F:N:V:^:", "ControlDestroying", "claGrey", "FOnUpdateCookie", "esStretch", "InertiaVector", "FPromptLabels", "8K8x8", "\"FValidateServerCertificateCallback", "5$6T6X6", ":*:?:T:`:r:", "fsNegative", "CheckStream", "2L2w2", ":%:-:>:L:T:b:p:", "FAsExtended", "D$P+C@", "TasksList", "TSeTabItemDrawState", "_FILETIME", "lpPoint", "6%6,636:6A6H6O6V6]6d6k6r6y6", "IAssemblyCache", "pszHelpFile", "Exchange", "bsGroup", "Floating", "ClassDef", "!UnlimitedWorkerThreadsWhenBlocked", ":&:]:", ";'", "btnRefresh", "DestroyWindow", "='=9=R=c=q=y=", "4%494J4[4t4", "tnMenuButtonNormal", "tmpbEjectPressed", "SetCursorPos", "GetMaxCharCount", ";|$$r", "ButtonDraw", "YSystem.AnsiStrings", "5#5+535U5j5{5", "6*6C6T6x6|6", "FrameVert", ";\";>;J;\\;", ">$>l>", "0+030A0P0e0i0", "5D5M6z6", "FGestureEngine", "Observer is not available#MD5: Cannot update a finalized hash$SHA1: Cannot update a finalized hash$SHA2: Cannot update a finalized hash=Error decoding URL style (%%XX) encoded string at position %d1Invalid URL encoded character (%s) at position %d.Cannot start a task that has already completed", "ttdExpandoButtonPressed", "1-131B1U1[1j1}1", "BytesPerRow", "OnClickDgQ", "8(81898c8", "CTDictionary.TItemArray", "J>", "RegisterFileFormat", "1 111F1T1j1", "kridsNormal", "5TCollectionNotifyEvent", "", "&op_Explicit", "clGreenyellow", "MouseZ", "CancelButton", " 0@P`p", "= =$=(=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", " (%d)", "GetInitialCurrentFindData", "2TList.TEnumerator", "TScriptRunnerOnDllImportX", "6TAcceptValueListBase", "5B5G5Q5[5a5j5w5|5", "5f5z5", "OnAlignPosition0", ":$:2:B:T:d:l:z:", "Interface", "&?g?", "TThread&", "TCustomComparerL|L", "function SendBroadcastMessage(const Msg, WParam, LParam: LongInt): LongInt;", "SetBkColor", "1%141K1^1o1", "ShareImages", "?$?7?I?Q?_?n?", "131E1S1e1m1{1", ",TEnumerator(", "TClass", "1*1<1K1]1l1~1", "2$3i3", "2&292N2\\2l2", "InteractiveGestureOptions", "bvLowered", "FHintParent", "csAncestor", "4@4Q4m4u4}4", "AlignInfo", "9D:K:b:f:j:n:r:v:", "FTBDockHeight", "011F1W1l1z1", "TAccObject", "FAuthEvent", "GetMenuItemID", "2+292N2Y2a2o2", "5)5C5Q5a5t5", "GetMessageW", "TMenuAnimations", "Copyright ", "0E0t0", "fdoOverWritePrompt", "1(2B2h2", "6E7T7\\7l7", "2(3F3d3", ":%:):A:H:O:V:]:d:k:r:y:", "tagBITMAP", "?$?8?I?V?^?o?~?", "FindFirstFileW", "TClipboardFormats", "Uh;*r", "caFree", "Alignment", "Uh+/h", "Vcl.StdCtrlsD", "4+4B4P4c4z4", "1.1G1O1b1p1", "Uh9)r", "EOleException", "Privileged instruction", "ReferenceInterface", ";9|", "O1a1h1", ";$;P;n;", "NormalizeAllTopMosts", "WILDCARDMATCH", "fsrDefault", "FFocusedForm", "ErMathError", "kridsHot", "function InitializeBitmapButtonFromIcon(const BitmapButton: TBitmapButton; const IconFilename: String; const BkColor: TColor; const AscendingTrySizes: TArrayOfInteger): Boolean;", "TControlEnumerator", "FOnMouseDown", "tdnbEditPressed", "Warning: SHGetFolderPath failed with code 0x%.8x on folder 0x%.4x", "&TList.arrayofT", "6 6$6,646<6i6", "?:?A?F?P?U?", "EActionError", "@TList>.TEnumerator,", "FOnKeyUp", "7(7V7^7c7", "0.0B0J0[0i0q0", "TZDecompressionStream6", "SetConsoleCtrlHandler", "TSysTooltipsStyleHook7", "bottom", "OnNotify", ";((", "8!8%8)8", "TFormStyleHook.TEnumerator", "TProgressBarState", "TRequestData", "JTEnumerable>'", "575T5s5", "?(?D?R?_?q?~?", "2 2$2(2,202", "0J0T0~0", "6*6.6H6O6V6]6d6k6r6y6", "D$LPj", "TCustomCanvas", "5$5,545<5D5s5", "GetHelpContext", "8$9.929P9`9d9h9p9x9|9", ".TItemArray", "ktfGridItemSelected", ">0>G>\\>t>", "9:9n9", "FDestFile", "CertOpenSystemStoreW", "tebSpecialGroupCollapseHot", "tmpbPausePressed", "Uhs3f", "TSysCheckBoxState", "Winapi.Windows", "Token\\;H", "223`3", "D$DPj", "sfNoUninstall", "InteractiveGestures", "Images", ";G;`;", "Push_68", ">@[{;", ";';5;G;W;_;m;", "Contact", "eTArray>0", "TCookie ", "xF uW", "WindowPlacement", "TJ}KM", "?*?h?", "9%9;9C9\\9d9|9", "TSetupHeader-", "%TEnumerator(", "SetErrorMode", "6\"646I6Q6Y6i6m6", "TEditMargins6", "sr-Cyrl-CS", "FSizingZone", "tfFlyOutHeader", "5$5(5,5054585<5@5D5H5L5P5^5p5", "XTArray>", "PTypeTable\\L@", "EAssertionFailed", ";&;U;p;", "FReturnValue", "MenuIndex", "\"TCustomBase64Encoding.TDecodeTableP", "4+4?4S4", "TRttiStructuredType", "GenericBackground", "tbButtonRoot", ",TEnumerator(", "BitmapInfo", "-uninstall.tmp", "2'2<2L2T2\\2d2h2l2p2t2x2|2", "6@6`6z6", "WideString", "kwbdsHot", "FSmooth", "FBorderIcons", "FReceiveDataCallback", "FChunkDecompressedBytesRead", "Operation not supported", "arxx8911", "TCredentialsStorage&", "AStartTime", "TMenuAnimation", "5O6r6", "AuthEvent", "TUxThemeHintElementsT", "ACookieData", "ttdExpandoButtonExpandedHover", "ksbcUp", "?&?7?E?M?[?h?", "Setup.ScriptFunc", "TItemType", "FDragThreshold", "zh-MO,zh-Hant,zh", "System.Types", "9'9/9@9^9b9|9", "DragCursor", "Secure", "=.=I=[=u=", "ExceptionToString", "jTEnumerable>", "RegisterTypeLibrary", "DataPtr", "DTDictionary.TValueEnumerator;", "2%232@2p2t2", "TThreadPool.TAbstractWorkerData+", "TThemedMenu", "1%1K1O1S1W1[1_1{1", "TFindGlobalComponent", "5*525K5]5f5", "ImageFormat4", "OnMeasureItem", "ReadAnsiLine", "3'3=3K3Z3l3", "TStyleEngine", "7$8r8", "IsSubComponent", "pf4bit", "Vcl.ExtCtrls", "ktfPanelTextDisabled", "AnchorOuterPage: BaseUnitX = 0", "iso_8859-13", "<\"<&<*<.<2<6<:<>.TEnumerator5", "EZeroDivide", "9&9>9F9c9k9", "8Q9\\9", "elSize", "fdoDefaultNoMiniMode", "GetThemePartSize", "IsEmpty@", "BevelOuter(", "141D1L1T1\\1`1d1h1l1p1t1x1|1", "2)2C2Q2a2t2", "TRttiType", "FOnReceiveData", "AMemo", "FProgress", "ElevationRequiredtFA", "AThreadProc", "claBrown", "3*3|3", "000R0", "HostDockSite", "CanvasTLA", "A_A^A]A\\_", "FOnDropDown", "bmDIB", "ITDictionary.TValueCollection;", "UserName", "tttBaloonNormal", "=%=A=W=g=t=", "Uh?[`", "9%;];j;x;", "5u6}6", "Parameters", "THintAction", "RlZ]_^[", "Click", "PRQht", "TThreadList&", "1,1=1]1v1", " hxv_", "3%3;3O3W3e3s3", "9\"9&9D9T9X9\\9d9l9p9t9x9|9", ";(;.;", "DoubleBufferedMode,GA", "Vt.OJ", "Destination", "ShortDayNames", "SetSize", "ksacVertical", "TComponentName", "3TEnumerator", "Sp_^[", ">TList.arrayofT", "6\"6*626:6B6L6Z6d6r6|6", "ToolBarGradientEnd", "TFindGraphicClassContext", "2l2|2", ">@>D>k>s>", "GETCOMPUTERNAMESTRING", "TailHandle", "TIStringComparerE>n>{>", "9 9$9(9,909@9K9O9d9l9", "GetTextColor", ">*>9>J>U>]>k>y>", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$47$Intf`'@", "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "FBitmapHot", "[>|>", "3>3U3", "ImageList_WriteEx", "TCustomStyleTextLabelElements", "Uh|\\c", "Showing", "tsLowerTrackVertHot", "tmMenuBarItemHot", "FCopyFormat", "GetNonBidiKeyboard", ">F>a>", ":,:@:D:p:", ".TValueCollection", "353b3j3p3u3", "8!8%8)8-8C8G8K8g8o8", "TObject\\", "kgidsSelected", ">4?h?", "", "MapWindowPoints", "Ncddd", " t: Test integrity of archive", "TPSTypeRec_ProcPtr(", "GetTypes", "TPropInfo", "FPropPath", "tcpChevronClosedLeftPressed", "claIndianred", "Exception", "WriteCurrency", "9>9O9a9j9", "K#oq;", "WindowState", "ktfEditBoxTextFocused", "ScriptFunc", "FinishCurrentFindData", "function UsingWinNT: Boolean;", "FBytes", "FOrientation", "FDirectory", "FPropertyType", "9 9(90989@9H9P9X9`9h9p9x9", "fData", "DrawThemeText", ":2:::H:Y:h:", "TMenuItem6", "VarMod", ">%>8><>C>V>j>", "EVariantError", "tOFOu", "t/v2Z%", "FFooterIcon", "doHorizontal", "$:P=t1", "TUTF7Encoding&", "6@6D6", "ACodePage", "Charset", "171;1[1`1", "8hm)(od", "C\\;CXr", "EECDSAError", "2#212?2L2T2b2t2", "ShortCut4", "JSetup.RegSvr", "tfFlyOutBodyNormal", "Yes/No/Cancel", "2%232E2S2[2i2w2", "IntfMethods", "FLstPos", "arm64", "2\"2*222:2B2L2Z2b2j2r2z2", "CursorPos", "DescID", "TRttiDynamicArrayType", "TCopyFormat", "kwbRollRestore", "TSeLinkStyleObject6", "5%555H5[5i5{5", "POleStrList", "TCheckItemOperation", "5P5u5", "TPSFreeProcc", "tspLogOffButtonsPressed", "TChunktIME_", ">#?S?\\?", "9':+:/:3:7:;:?:C:G:K:O:S:", "4Y^^fbb", "ExceptionData", "TList&", "&TArray", "929:9[9_9c9~9", ";C.arrayofT", "7!868G8\\8j8", "FLRDockWidth", "Cannot disable FS redirection on this version of Windows", "1$1-1I1_1X2f2", "BZ2_bzDecompress", "6 616S6`6q6{6", "ksbcVertSlider", "Flink", "teEditBorderHScrollFocused", "2+2K2", "8TArray", "TCustomPanningWindow,", "SelectedImageIndex", "FreeImage", "TFindComponentClassEvent", ":3:D:_:z:", "LicenseAcceptedRadio,8^", "212E2Y2~2", "TWizardPageButtonEvent", "tmpbNextNormal", "Used new increased buffer size: ", "Internal error: InternalRunBooleanFunction: invalid BreakCondition", "TTaskDialogIcon", "$0O0W0w0", "Seek32", "HookMainWindow", "?TList>.TEmptyFunc`'@", "8Q8U8", "FUseCOMWait", "ktscTab", "CertNameToStrW", "9.9;9I9]9o9", ":7:`:", "5%5-5;5J5`5r5z5", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$49$Intf`'@", "0>0D0J0d0n0", "TSysPopupStyleHook7", "Reader", "5<5O5S5h5p5", "WICImage", "Uh^+F", "ktxoVerticalBottom", "=(=9=R=c=u=}=", "2;2d2z2", "2#3u3", "ImportPublicKey", "FDockOrientation", "Vcl.StyleBitmap", "CreatePanningWindow", "TFolderTreeViewStyleHook8", "CreateCustomPage", "MaxDataLen", "\\o{=D0O-", "tcbCategoryGlyphOpened", "GetAttributes", "FSourcePtr", "ktcGenericGradientEnd", "Bits index out of range*Can't write to a read-only resource stream+Can't write to a read-only aggregate stream", ";\";*;2;:;B;J;R;Z;b;j;r;z;", "FindObjectByPoint", "Uhl,j", "FontAdapter", "t)HtZ", "Encoding", "C0A0?", "No matching key found", "TTitleBarX", "Uhnjp", "P(;SDv", "ConvertSidToStringSidW", "Error creating window class+Cannot focus a disabled or invisible window!Control '%s' has no parent window", "cExtension", " if (Strings.Length && Objects.Length)", "FOnShowHint", "444^4", "3#3B3a3", "usebase", "ChildControl", "SetGestureConfig", "EnableTheming", "?;?E?I?h?x?|?", "Uhf#K", "FCaptureErrList", "AEdit", "LimitBegin", "<+=X=", ";D$,w", "7/8g8", "FormState ", "iso_8859-7", "ThumbHorzTop", "FStopDrawChilds", "q&mNx~", "4D5H5o5y5}5", "CommandButton", "?9?l?w?", "9IComparer`'@", "TDispatchKind", "OnKeyNotify", "GetValueFromIndex", "OnMouseLeave8[Q", "4\"4D4R4h4", "GetMenuItemCount", "Uhx+t", "0H0X0", "function IsDarkInstallMode: Boolean;", "clMoccasin", "Capacity < Length", "FDisabledImageIndex", "FCheckCount", "5C6J6", "1-1C1X1h1", "DoWindowPreviewRequest", "%TThreadListd", "7$727C7a7", "ktxoVerticalTop", "AllocStringAsUtf8", "ecEdgeLightColor", "AllowDisabled", "CreateWindowHandle", "CreateInputDirPage", "=!=(=/=6===D=K=R=Y=`=g=n=u=|=", "tmSystemRestoreNormal", "kpbcClose", "4+6J6", "=$=Y=", "UTCollectionNotifyEvent>", "?@?W?]?e?j?u?", "ttbTrackBarRoot", "TBevel6", "tbCommandLinkDefaulted", "VShared.SetupTypes", "6 6.666D6V6h6p6~6", "4#414@4N4]4e4s4", ">8?p?", "FMDIButtons", "7B8j8q8", "function ExtractFileDrive(const FileName: String): String;", "TThemedCheckListBox", "bfInfo", "Runtime error (at %d:%d):", "CanFocus", "<6=K=\\=q=", "7>8b8", "sfMenuItemTextDisabled", "? ?T>", "7TCollectionNotifyEvent", "SevenZipLibraryName", "Cascade", "9$9s9w9", "2%2<2B2Q2a2g2v2", "TLoadedDll", ">5>c>", "? ?$?(?,?0?4?8?(", "TImageLinkP!P", "1+1P2r2D3j3", ";(;i;m;", "TCustomStyleToolBarElements|&u", "FEditMargins", "FSaveIndex", "YZXtp", "StyleSource", "?(?,?3?F?Z?o?", "teTabSet", "BorderStylet:Q", "tkArray", "=P>v>", "NeedRestart raised an exception.", "CAT_DRAG_COPY", "7<7G7", "FHandled", "7$747<7J7\\7p7t7", "FName", "OnUpdateCookie", ";';5;E;S;k;s;", "ComponentsListClickCheck", "=0=>=Q=f=t=", "UninstallFilesDir", "DisplayNames", "4>4H4l4|4", "4P4i4", ":&:A:_:g:o:w:", "FDownDis", "191I1V1c1", "mplayerbuttons", "claGreen", "3 4(4A4e4", "$TList@", "1,1q1", "ISystem.Internal.ExcUtils", "0 0.020G0O0f0n0", "TEnumerator(", "AlphaBlend", "!NOTIFICATIONVARIANTGET", "LinkControl", "0&0;0R0q0", "pmNot", "ACheckWhenParentChecked", "3TDictionaryh", ".TValueEnumerator46W", "DateSeparator", "System|", "FilterMethod", "54585X5\\5", "FParentTabletOptions", "TLinkLabelP", "diDesaturateBlend25", "GetLogicalDrives", "Username", "Uha>'", "", "FCornerRadius", "3TjlP", "=P>_>", "5e6x6", "TBorderIcons", "l$HVW3", "TSpecialProc", "TLeftRight", "%TEnumerable", "FRichEditLoaded", "1#171?1P1^1f1t1", "clDarkblue", "l$.TEnumerator5", "Inno Setup Setup Data (6.6.0)", ";$;];j;", "clSpringgreen", "soCurrent", ")TList", "claFirebrick", "TDirect2DCanvas)", "6+6D6Y6s6", "FMouseOnLeft", "AShared.EncryptionFunc", "tagSAFEARRAY", "FDecl", "CurInstallProgressChanged", "lttInvalid", "TStringList.TOverriddenItem", "9$919A9", "TSysListBoxStyleHook", "ITDictionary.TValueCollectionple", "545?5H5X5`5h5p5t5x5|5", "UnitNameFld", "THTTPRedirectsWithGET", "40484F4V4d4|4", "1-171;1\\1l1p1t1|1", "btnPrior", "3,3:3L3T3b3s3", "clLightsteelblue", "EPNGSizeExceeds", "GetTextExtentPointW", "=)>->T>^>", "FScaledDrawer", "FAttribTypeHash", "1*1S1b1", "hebrew", "AnchorsXmG", "IntToIdent", "4,444<4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4", "tcDropDownButtonRightNormal", "<$<)<7<= >'>.>5><>C>J>Q>[>~>", "cxRightWidth", "EVariantTypeCastError", "1\\2e2", "9/9?9G9g9w9", "FindItemID", "TSeTrackThumbDrawState", "lttAmbiguous", "AssignHandle", ":I;h;", "FElapsed", "Uh4NN", "kcdsUncheckedPressed", "DefMDIChildProcW", "SurfacepHA", "DragKind", "tfEnableHyperlinks", "Uhwof", "CreateIcon", "CoDisconnectObject", "Uh\\?Y", "9(9T9X9", ";BN.x", "UTF8WithoutBOML", "? ?$?1?B?W?_?", "tfFlyOutRoot", "ssNone", "sfMenuItemTextHot", "dotnet2064", "pPSVP", "FSourceStream", "TCursor", "hQZ^&", "ASubclass", "FOnCreateComponent", "%TEnumerable'", "IsWritable", "TWinControl6", "psStarting", "GroupDraw", "bsPushButton", "dpYes", "5,5?5R5`5o5w5", "Unused3", "? ?.?=?O?^?w?~?", "64-bit Edition", "ExtraDiskSpaceRequired", "RaiseException", "SetItemFontStyle", "Parameter %s cannot be nil'Parameter %s cannot be a negative value", "10292", "MenuDrawItemGlyph", "-TCollectionNotifyEvent", "3$3,343<3_3n3", "=ScriptFuncLibraryRegister_R.RegisterInstallScriptFuncs$1$Intf`'@", "fsShowing", "<'<.<8", "ktidsActiveDisabled", "jTEnumerator>", "FailCriticalErrors", "%TList", "tdnbDeleteHot", "PTPF0", "wipmHighQualityCubic", "IsWindowEnabled", "< =p=", "FMargins", ">$>5>O>a>o>{>", "-TEnumerator@", "t\\Htg-", "ArrangeIcons", "Could not call proc", "TCloseAction", "GetCurrentPosition", "BlockedCount", ": :$:(:,:0:4:8:E:[:q:", "Floating point division by zero", "sfTop", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "", "9#:E:k:", "?*?L?k?v?", "RunIntegerFunction", "tmChevron", "f;Ppt", "TStackPanelControlItem(", "SecureFailureReasons", "`'@", "pulDisposition", "NumRecs range exceeded", "ButtonHoverForegroundColorpHA", "VerySilent", "TRegistry", "{tmp}\\", "?!?)?7?R?h?p?~?", "function UnpinShellLink(const Filename: String): Boolean;", "<9= 0 and <= $10FFFF, excluding surrogate pair rangesrHigh surrogate char without a following low surrogate char at index: %d. Check that the string is encoded properlyrLow surrogate char without a preceding high surrogate char at index: %d. Check that the string is encoded properly2Source and Destination arrays must not be the same", "2#21282=2H2M2\\2e2p2}2", "csPanning", "!TList", "EObserverException|^H", "inflate", "ksbcRight", "0E0Z0q0", "\"TEnumerator(", "6S7h7v7", "TFileDialogEvents", "FCurrentStream", ":#:+:G:O:S:i:m:q:", ">", "tmpbPauseHot", ">n>r>v>z>~>", "?'?/?7???G?O?W?_?g?o?w?", "1-131>1K1`1f1q1~1", "Filename: ", "Information", "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\", "UnitCount", "FResponseLink", "EnumThreadWindows", "FUserInfoSerialEdit", "]_^[]", "TMonitor", "FOldSelLength", "function AddQuotes(const S: String): String;", "Components", "AreDpiAwarenessContextsEqual", "usersavedgames", "=0=4=\\=`=", "ENetHTTPCertificateException<7h", "tlListviewDontCare", "7 8|8", "4 4.464D4P4", "FStrings", "cd4Bit", "commonfavorites", "TSysStatusBarStyleHook7", "Q>nPn", "ktidsHot", "OnNotifySV", "SendMessageA", "LeaveCriticalSection", "AInheritance", "uPSR_dll", "TImageName", "?TObjectDictionaryM", "function IsX86OS: Boolean;", "5TListl", "EmptyAsAnyType", "&op_GreaterThanOrEqual", "8 8$8(8,8084888@8H8P8X8`8h8p8x8", "UhkpU", "", "ClassParent", "MTDictionary.TKeyCollection$", "GetCustomForms", ";2<6<:<>.ParrayofT$", "6(676I6b6s6", "Algorithm", "TNewButton", "MonitorFromPoint", "GetActiveWindow", "UhkPc", "GetItemFontStyle", "cp819", "S`f+Cp", "claSpringgreen", "twMDICloseButtonNormal", "&e?GW", "2$2?2G2O2W2_2g2o2w2", "_unins-done.tmp", "RegisterViewer", "Invalid canvas operation", "kcdsUncheckedFocused", "TReceiveDataExEvent", "", "ExceptClassl", "kwbdsNormal", "pmNotMask", "6C6l6r6}6", "?!?2?L?\\?`?d?l?t?x?|?", "LocationEditt", "TransparentColorValuel", "ACapturedString", "%s: Invalid OnlyBelowVersion string", "TFindAncestorEvent", "7 7(70787@7H7P7X7`7h7p7|7", "MS Shell Dlg 2", "FTextShiftSysIton", "EHashException", "OnProgress$", "TListd", "Empty certificate list#Unspecified certificate from client", "Post308", "kppChunkVert", "Uh0)Z", "*TEnumerable'", "FRadioButton", "1!1;1C1T1f1{1", "6h7u7", "FChildPos", "TOperation", "Descriptions", "cdDefault", "4$424A4S4j4r4", ":0:I:b:x:", "Reserved3", "userfavorites", "Height|Z^", "Rectangle", "1#1S1}1", "121A1X1", "FreeOnTerminate", "TSysToolbarButtonStateItem", "RemoveFreeNotification", "5D6s6", ".TEnumerator5", "Filter", "182[2", "TSysToolbarStyleHookP", "khdsNormal", "FMasked", "clLightslategray", "76=L=", "fSystem.Rtti", "HTCollectionNotifyEvent", ">%>:>P>a>y>", "System.TypInfo", "function CurrentSourceFilename: String;", "GetFilter", "2+2B2G2`2h2v2", "9%9,939:9A9H9O9Y9a9", "AField", "fsActivated", "< <$<(<0<8<<<@g>q>y>", "'Sectigo Public Time Stamping Signer R360", "groupname", "1,10141<1D1H1L1P1T1X1\\1`1d1h1l1p1}1", "UninstallNeedRestart raised an exception.", "3-3C3Y3h3v3", "758T8", "GetPalette", "TScrollingStyleHook8", "TRttiFloatType", "AOwnsOutputStream", ">5?t?", "FObserverAdded", "RunIntegerFunctions", "TCollection9", "HMENU", "poOwnerFormCenter", "kwhtTopRight", "kcdsUncheckedDisabled", "teBackgroundAssist", "erCustomError", "9 9(9,9094989<9@9D9H9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "-TList.TEmptyFunc`'@", "TCustomActionLVP", "AExceptionHandlerEvent", "Entries", "combobox", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$1$Intf`'@", "crDrag", "twHelpButtonDisabled", "= =2=@=O=W=e=|=", ";7;I;R;u;", "TAbstractStyleServices8FW", "ttbDropDownButtonNormal", "TElementSize", "656T6r6", "(", "FMDIChildSysMenuActive", "ListItemTextNormal", "4 4$4(4,40444<4D4L4T4o4", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$6$Intf`'@", "UnhookWindowsHookEx", "FOnMouseWheel", "OnNotifyt", "volatile bool FFinished", "UpdateScaledDrawer", "TInterfaceListEnumerator>", "Uh!Wn", "Put308", "AccessS", "get_accName", "9!989G9O9]9o9}9", "FAsCurr", "505G5Z5s5", "WriteBool", "mdNull", "ITDictionary.TKeyEnumerator", "AEncoding", ":2:r:", "000G0k0s0~0", "7+7=7E7S7e7{7", "Error creating log file:", "TrackingPos", "HTArray>", "0Z0^0z0", "2(2,20282@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "FTextMarginRight", "H$hnn", "FOverridePaint", "Uht?b", "xZ>/B", "FBackButton", "IsEqualGUID", "8TQueue", "=*===E=P=d=~=", "=%=6=V=d=r=", "Uh&Ol", "?B?Y?", "TSeToolItemClass", "tfCanBeMinimized", "3#3'3?3F3M3T3[3e3", "tsArrowBtnDownDisabled", "FDefaultCursor", "2#2<2K2n2}2", "GetDate", "_\"d]O", "4|4.5b5", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$8$Intf`'@", "aMaxCapacity", "TPSTypeRec_Array", "0\"070?0M0_0t0|0", "= =.=@=W=h=}=", "tspOpenBoxDisabled", "FStandardGestures", "3!303>3N3V3d3s3", "3+3G3k3", "FParentBackgroundSet", "1'1;1J1`1", "0!0%0)0-0105090=0A0E0I0M0Q0U0Y0]0a0e0i0", "Failed to read existing file's SHA-256 hash. Proceeding.", "/IComparer`'@", "TBitmapButton", "Font.Charset", "VTable", "OnEndDrag\\oG", "cnRemoved", "GETTEMPDIR", "ProxyCredential", "function CharLength(const S: String; const Index: Integer): Integer;", "4!444G4X4s4", "XTDictionary.TKeyCollection;", "2-2L2Z2x2", "-TCollectionNotifyEvent", "NotifyWinEvent", "304v4z4", "UhpBo", "Caller", "$ZXw<", "ExpandZoneLimit", "Finalize", "kmdsSelection", "TWinControlMessageHandler", "DeclaringUnitName@", "+TDictionary&", "csFixedHeight", "101E1S1f1|1", "BeginHead", "TPicture.ReadData$0$Intf`'@", "PasteFromClipboard", "8!868S8", "2\"222D2[2i2y2", "5!5(5J5x5", "TFileFormat", "STRINGCHANGEEX", "opRemove", "MaxValue", "Uh.;]", "ddddd", "1 1$1@1P1T1X1`1h1l1p1t1x1|1", "function Trunc(const E: Extended): Int64;", "WindowGetHitTest", "HeapAlloc", "JTDictionary.TPairEnumerator", "4/4C4K4\\4j4r4", "TPSTypeRec_Class", "FArchiveFilename", "4'414;4G4Y4a4q4w4", "7'7/7=7I7Z7h7w7", "Panel", "tspSoftwareExplorerNormal", "ResponseTimeout", "saTop", "7*8.82868D8R8^8l8", " TList&", "ttbThumbTopHot", ":7:?:\\:d:", ";1;A;S;a;u;", "DimCount", ";*;;;T;\\;m;};", "claAliceblue", "Can use RestartManager to avoid reboot? %s (%s)", "userfonts", "ImageList_DragMove", "TCustomStyleServices", "<)<;", "TIAccessible@4b", "dotnet4064", "6 6$6(6,6H6\\6`6", "FParametersAllowed", "1 1$1(1,191J1_1g1", "PRQhl", ":D:T:0;>;R;`;", "FindObjectByPointAll", "1 1$1(10181<1@1D1H1L1P1T1X1\\1`1d1h1l1y1", ":%:4:", "function WildcardMatch(const Text, Pattern: String): Boolean;", "ADateTime", "FInitialized", "Uh7Pq", "9 9$9(9,9094989<9@9D9H9L9T9\\9", "=)>@>[>b>", ";XTtk", ">&>1>J>9?", "InstallLocation", "=.=8=R=i=s=", "TCustomZStream", "&TList&", "ttTabRoot", "4$;t$", ".TEnumerator5", "050=0A0X0}0", "7)7?7T7b7y7", "GestureID", "function GenerateUniqueName(Path: String; const Extension: String): String;", ":*:8:L:T:e:s:{:", "=$=>=W=u=", ":#;$<}<", "kebdsHot", "IsScrollDefined", "323`3p3t3x3|3", "TEnumerable'", "/TList.TEmptyFunc`'@", "8/8C8Z8b8p8", "ShowIndex", "<,", "vaSingle", "function UnregisterServer(const Is64Bit: Boolean; const Filename: String; const FailCriticalErrors: Boolean): Boolean;", ":):6:F:", "AES_128", "4'4/4=4P4g4u4", ":#:2:E:[:l:t:", "TStreamAdapterI", ":A:_:", "EndReferences", "FBalloonTitle", "788>8D8O8", ".TEmptyFunc`'@", "TSHA256Digest ", "; ;$;(;,;0;4;A;U;];e;m;u;};", "FOnSimpleDownloadProgressParam", ">:>M>a>u>", "TWinControl", "QSVW3", "182F2Y2i2", "ProgressBar", "Deleting Uninstall data files.", "^.TValueCollection", "REGQUERYDWORDVALUE", "SetFilePointerEx", "5 6?6h6", "ktfPopupMenuItemTextHot", "969M9[9r9", "Cancel/Try Again/Continue", ";@;g;", "FArrayType", "0:0K0Z0b0s0", "595l5", "Not unregistering DLL/OCX again: %s", "=\\>d>l>t>|>", "teTextStyle", "AObjectType", "ifHasRtti", "@Eu&u", "FSysButtons", "?7?E?S?e?", "LongDayNames", "TSeMenuGlyphInfo", ";<;@;", "ktxaMiddleLeft", "TBaseAsyncResult.TAsyncFlags", "AppData", "UserInfoNameEdit$", "3 3$3(3>3J3`3h3l3", "TFormatSettings.TEraInfo", ",,,l|", "get_accChildCount", "DEFAULT_CHARSET", "kgidsNormal", "CharCasepHA", ":1:@:H:X:", "System.SysConst", "XZ;T$", "?6?", "trBackground", "HeaderSectionTextUnderDrag", "8@8Z8`8p8t8x8", "LTDictionary.TKeyEnumerator", "788Q8`<|<", "Deleting registry key: %s\\%s", "$TEnumerablel", "MobilePlatform", "162H2", "TSelectLanguageForm", "tcpThemedChevronOpenedHot", "tgDropDownButtonNormal", "0TList.TEnumerator", "FSelectComponentsPage", "GraphicClass", "tdnbDeletePressed", "bcrypt.dll", "9'959D9R9h9v9", "0Z1c1i1", "tmcMonthCalRoot", "StreamL", "FNeedToHideDesignerCaption", "FShowHint", "TProcParam", "DownloadTemporaryFileDate", ">+>A>W>e>t>", "function IsX86: Boolean;", "FStyle", "OnAlignPosition", "8,8<8J8e8{8", "=2=6=T=d=h=l=p=t=|=", "OnDockDrop", "issig-v1", "TListBox", "clNavajowhite", "get_accFocus", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$40$Intf`'@", "232A2P2`2", "TTaskDlgClickEvent", ";ia>", "GroupWith", "TObservers&", "PrevUserInfoSerial", "9,9B9P9X9f9x9", ";,;?;N;`;s;{;", "Module", "Synchronize", ":TTaskDialogForm.:3", "AWidth", ">#>*>1>8>?>F>M>T>[>r>v>z>", "!:x=B", "AMainIconPostfix", "%TCollectionNotifyEvent", "[Error]", "Cardinal", "9!959=9N9\\9d9r9", "Software\\Microsoft\\Windows\\DWM", "beBottom", "2TList.TEnumerator5", ".TEnumerable\\&g", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0i0{0", "7;?E{r", "sfToolItemTextHot", "343B3Z3i3q3", "ecBorderColorHint", "kescEdit", "kbscGroupBar", ">,>@>T>i>}>", ";B0}H", "SAVESTRINGTOFILE", "1 2A2", "1 1$1(1,191M1e1}1", "URLInfoAbout", "3TList.ParrayofT", "tsArrowBtnRightNormal", "FOverridden", "3(3@3Q3b3", "UninitializeFlatSB", "8 8$8(8,84888<8@8D8H8L8P8T8X8\\8`8d8h8l8z8", "IsStandardEncoding", "function SetNTFSCompression(const FileOrDir: String; Compress: Boolean): Boolean;", "TSysStyleHookClass", "SetStep", "1@2x2", "ExitThread", "AddDisabledImage", "t2;;u", "?>?f?", "`~.j`", "InterlaceMethod", "GetControl", "GetSingleCastObserver", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$24$Intf`'@", "=.>P>", "An attempt was made to call the \"%s\" function from outside a \"Check\", \"BeforeInstall\" or \"AfterInstall\" event function belonging to a \"[Files]\" entry", "8 8.8S8h8}8", "CreateDIBitmap", "Shared.DebugStruct)Compression.SevenZipDLLDecoder.Interfaces", "CloseApplications", "4 414F4T4f4|4", "FBias", "EndAsyncURL", "Yes to &All", "171;1V1Z1v1", "ttItemHotSelected", "6G7P7", "5 595N5\\5k5", "? ?$?(?,?0?4?8?.TValueEnumerator", "IEqualityComparer`'@", "TPNGPointerList}>", "2'2>2T2\\2j2}2", "TPSProcRec5", "StrToInt", "9\"9&9*9.9", "9*9@9V9d9w9", "$]_^[", "= =$=(=,=0=4=8=<=@=M=c=g=q=y=", "CreateMenuItem", ":TEnumerable>", "Uh4><>[>p>~>", "SysReAllocStringLen", "%IEnumerable", "<*<;>D#J", "Shift", " h x_", "StaticTextNormal", "sfFont", "ATList.TEnumerator5", "FBottom", "ShortInt", "fdoNoDereferenceLinks", "FBufPos", "Range check error", "576v6", "5)5=5V5^5l5", "tgFixedCellHot", "8/YyN", "System.ImageList", "MTDictionary.TValueCollection", ";*;A;P;g;v;", "1\"212", ".TList.ParrayofT", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$48$Intf`'@", "3 383H3P3X3`3d3h3l3p3t3x3|3", "ErTypeMismatch", "7#7+737;7C7K7S7[7c7", "4,4P4`4|4", "PreparingMemo", "ktisLeftMiddle", "EParserErrorPxG", "TSeCustomStyle", "ImageIndexp", "claThistle", "ReturnTypeInfo", "CertOpenStore", "CoInitialize failed (0x%.8x)", "9'9:9I9[9n9v9", "}c+F@nA", "0V0_0", ";*;G;", "0\"0&0L0\\0`0d0l0t0x0|0", "AColumn", ":#:;:C:Q:a:o:", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$10$Intf`'@", "Message", "FSysMenuButtonRect", "WorkerEvent", "Q4_^[Y]", "TabDrawText", "1 1$1(1,141~1", "FSelectStartMenuFolderLabel", "OnRemoteSessionChanged\\oG", "IMsgt", "cAlternateFileName", "AIdentToInt", "twMDIHelpButtonDisabled", "TSeBarItemDrawState", "4)4/4;4J4_4e4q4", "scPanel", "Updating the .INI file.", "InsertIcon", "FBorderWidth", "tttStandardTitleLink", "t=HthH", "/RestartExitCode=", "7+7E7i7", "424A4M4[4j4u4", "TCustomButton.TButtonStyle", "SetClass", "ktxaBottomLeft", "FOnFileOkClick", "UnselectGesture", "StandardDate", "GetSysColorBrush", "UhP%l", "claGold", "GetMimeType", "Delaying registration of all files until the next logon since a restart is needed.", "3 3$3(3,3034383<3@3D3d3~3", "FDrawTextOption", "tsStatusDontCare", "40494", "CheckedpHA", "ktscTrackBar", "7'868X8w8", "8 848G8V8h8", "Ancestor for '%s' not found", "TPSRuntimeClass", "WParamLo", "?D?n?", "LimitSize", "Boolean", ",TList.TEmptyFunc`'@", "CriticalSection", "AutoScroll", "6!707:7N7^7m7", "HKEY_CURRENT_CONFIG", ">&>;>S>[>c>k>s>{>", "Item!TList", "TOrderedList&", "3TEnumerable8", "sfTabTextActiveHot", "434A4Q4g4}4", "bmType", "<)K", ",0<0@0D0L0T0X0\\0`0d0h0l0p0t0x0|0", "free_func", "GETSPACEONDISK64", "UninstallDisplayName", "? ?$?(?,?0?4?8?", ";BPti", "clBlue", "4\"4<4Q4e4r4z4", "ASubItem", "Keys8,E", "false", "ReplaceColorpHA", "=&=H=X=`=h=p=t=x=|=", "tdnbPostNormal", "?,???G?U?c?w?", "=*=?=M=a=w=", "<@=m=!>", "function TrimLeft(const S: String): String;", "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>", "LicenseLabel1D", "DIBSize", "GetArgLoc", "OLE error %.8x.Method '%s' not supported by automation object", "TFileSharing", "twSmallCaptionSizingTemplate", "tsDownHorzHot", "8O9q9", "Expression", "?a?}?", "TSysProgressBarStyleHook7", "D$<+F\\P", "IsPanning", "clCoral", "January", "0:0]0i0", "FTextHint", "TThemedTaskBar", ";&<>", "232<2", "tsiTextPressed", "1%181@1Q1d1l1z1", "ksadsHot", "scTop", "1:1G1q1", "IsCancelled@bH", "2*2E2S2f2v2", ":!:1:C:K:Y:f:t:", "tmAuto", "teEditBorderHVScrollHot", "DisableAlign", "FFormatChanged", "ColorL", "LineBreakL", "[=dl?a", "wifWMPhoto", "TRemoteSessionChangedEvent", "<,(>3>;>I>Y>l>", "+TList.TEmptyFunc`'@", "Uh^0f", "{TEnumerable>>'", "USERS", "Uh\\:F", "QueryAcceptData", "Uh_>J", "9M9b9", "0@0E0R0W0d0i0~0$1;1L1", "erVersionError", "=$=(===G=K=h=x=|=", "", "clYellowgreen", "2K6v6", "ttTabItemSelected", "Script error: ", "thHeaderSortArrowSortedUp", "EndPaint", "Jr9f;", "1#1:1H1Y1t1", "AddExWithISSigVerify", "FrameWidth", "IInterfaceListEx`", "= =g=v=~=", "ProxyIterator", "=-=C=S=g={=", "procedure BringToFrontAndRestore;", "ktcPanel", "TDirect2DPen", "ktfHeaderSectionTextDisabled", "TArray", "TLoginCredentialServiceM", "TRttiPointerType8", "AClient", "ksadsDisabled", "REGISTERTYPELIBRARY", "6$737=7F7N7`7{7", "DropContext", "scCategoryPanelGroup", "Buttons", "scGenericGradientEnd", "StringKind", "AItems", "", "TECDSAKey&", "XTArray>", "TArray", "csReading", "0!0/0=0Q0Y0j0x0", " IEqualityComparer`'@", "FRequestLink", "FAvailIn", "StaticTextDisabled", "TFontt", "FImageListChanging", "", "=3=H=Q=y=", "Colorl0>>>O>[>h>", "teButton", "DesignerStyle", "IconBitmapImage", "1 1$1(1,1014181<1@1D1H1U1o1w1", "9Y:m:*;3>(", "System.NetEncoding", "(", ">4>E>[>l>w>", "VarNeg", "FOnDllImport", "Streams", "6)686M6Q6", "3 3$3(3,3034383<3@3D3H3L3T3\\3d3", ": :$:(:,:0:4:A:X:m:u:", "OnUnDockI", "Install mode root key: %s", "Font.Height", "020S0[0y0", "979N=n={=", "<&<4%>C>Z>o>}>", "procedure UnregisterFont(const FontName, FontFilename: String; const PerUserFont: Boolean);", "4%4+484J4X4g4", "psNoButtons", "tebNormalGroupExpandHot", "nIndex", "WinHttpAddRequestHeaders", "ActiveMDIChild", "9 999D9d9v9", "(;0;8;", "Uhe1c", "0`0d0h0l0p0~0", "?1?9?", "TPrivateHeap&", "FPopupWnds", "TControlActionLink<6Q", "CompiledCodeText", "858j8", "t5B5F5J5X5f5v5", "OnMouseDown\\oG", "6)616u6", "RegisterWeakMethodRef", ":W:e:v:", "*TEnumerator(", "N&o to All", "TGestureType", "TTCollectionNotifyEvent>", "TPicture.LoadFromStream$0$Intf`'@", "UhVp_", "> >$>(>D>Z>^>|>", "041n1", "Uh.AJ", "FRange", "AddField", "R(+B,", "=,=4=<=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=", "ButtonState", "Extract", "6:6H6`6z6", "TCriticalSection&", "\\bcrypt.dll", "7 7$7(7,7074787<7@7h7", "FPages", "PaintHint", "CursorCountXHA", "UNPACKVERSIONCOMPONENTS", "373T3", "6TList.TEnumerator5", "Invalid pointer operation", "GetScrollPos", "dupAccept", "ttbSizingBarRight", "9$9*9/999E9S9`9k9v9", "AOwnsEncoding", "FIndexedProps", "FILESIZE", ";B;];z;", "TList&", "trChevronVertNormal", "\\$T)\\$", "8!8)8:8H8P8^8l8", "ReadVar", "TPropSetV", "SelectComponentsPage,5_", ">(>=>E>", "PRQh@", ":/:C:W:", "3#4A4L4", "7\"7A7S7g7o7w7", "_CERT_EXTENSION", "9*989L9a9o9", "c~;cL", "aTEnumerator>(", "434H4m4}4", "FLines", "?%?A?\\?r?", "kgidsDisabled", "twHorzThumbDisabled", "Uh,,n", "sfTabTextActiveDisabled", "BkColor", "5!5(5/565=5D5K5X5h5l5p5x5", "7R8m8t8", "Uh}Z`", "1+1B1Y1g1~1", "SAVESTRINGSTOUTF8FILE", "function GetMD5OfFile(const Filename: String): String;", "cp1250", "FBuckets", "MTEnumerator>", ":#;:;X;o;", "Defaulting to %s for suppressed message box (%s):", "ttbSplitButtonCheckedHot", "292I2", "listview", "8I9{9c:", "0\"0>0O0d0~0", "8-8t8)9p9", "TBasicAction", "THandleObject", "claDarkgray", "=>>g>", "UserInfoEditChange", ">$>7>J>X>j>", "CLASSES_ROOT", "FAsSLong", "FirstLine", "9TPair", "1vJ9c", "3K3X5|7l8", "ASetForeground", "EVariantNotImplError", "Assign", "tmpbPrevDisabled", "FPopupComponent", "2!2(202@2W2x2", "0$1M1", "4)4-4L4b4p4", "1TList.ParrayofT", "0$0,0>0F0Q0X0p0", "4,5w5~5", "5-5<5", "Sorted", "GestureManagerH#Q", "&TList&", "khdsDisabled", "TWMKey", "7TCollectionNotifyEvent", "2%2H2", "TScreen6", "teExplorerBar", "Uhg$n", "?4?H?[?n?", "858C8R8i8|8", "4H4Q4m4y4", "?.?6?D?K?U?Z?a?i?", "6 6a6g6", "s(Z^[", "tmcTrailingGridCellToday", "procedure RegisterServer(const Is64Bit: Boolean; const Filename: String; const FailCriticalErrors: Boolean);", "BZ2_bzDecompressInit", "twVertScrollHot", "1(1,1H1X1\\1`1d1h1p1t1x1|1", "EvaluateUsedVariable", "GetMenu", ".TEnumerator", "OnLinkClick+", " 0M0s0", "bsDialog", "MethodKind", "&TEnumerator(", "Int64ToStr", "PasswordEdit)", "898Z8b8{8", "Params&", "tmcNavPrevNormal", "tgCellRowSelectedRight", "TWinHTTPResponse", "'TList.arrayofT", "5!5%5)5-515", "D$TPj", "ttsHyperLinkTextNormal", "2D3S3", "2 2$2(2,242<2j2|2", "UhWdU", "7,7:7S7a7t7", "Vcl.Themes", "7TDictionary.TPairEnumerator", "htKeyword", "JTDictionary.TValueCollection;", "Vcl.SysStylest", "?1?B?X?f?t?", "2$272?2M2[2o2", "ClickToStartPage", "IntfUnit", "=@=X=^=f=k=v={=", "OnDblClick``Q", "<#<4", "Uh%2V", ">,>R>x>", "tsLowerTrackVertNormal", "3!3t3", "Metafile is not valid", "VWATH", ":E;m<", "7%737J7a7o7", "6D8T8H9", "TNewStaticText", "DynArrAttrData", "7'767@7Y7`7", "Ct6Hta", "&TList&", "Uh[Yt", "tcReadOnlyPressed", "srBottom", "tsSizeBoxTopRightAlign", "Silent", "*Winapi.WinHTTP", "wdsDynamic", "tpUpHot", "9-9K9\\9l9t9", "&", "claMagenta", "CTDictionary.TPairEnumerator", "efRect", "Uninstall DAT: ", "6 6.6A6Q6`6p6", "BaseUnitY", "AScriptFuncLibraryRegister_R.RegisterInstFuncOleScriptFuncs$ActRecx\\m", "GetLastError", "OnStartDrag-", "TValue", "!TPair", "put_accName", "FHotFont", "Vcl.StdCtrlsE", "teToolBar", "7+7|7", "ReadInt64", "FloatingDockSiteClass", "wdsDark", "ExceptionClass", "969D9S9j9}9", "ARect", "EClipboardException", "TRttiPackage", "TURLEncoding.TEncodeOption", "3(383@3H3P3T3X3\\3`3d3h3l3p3t3x3|3", "]TEnumerable>'", "cd8Bit", "<\"<2", "FUserInfoNameLabelX", "Type_18", ".Shared.ScriptFunc", "4 4$4(4,40444<4D4L4", "2#2'2D2H2L2P2f2n2r2", "0B0J0b0p0y0}0", "VTEnumerable>,", "function RegWriteStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;", "1*121@1N1d1l1z1", "ListA", "TseBitmapLink&", "iso8859-16", "7,707<7@7", "AOnError", "User chose %s for the verification.", ">$>(>,>0>4>8><>@>D>H>L>P>T>X>`>", "utUnknown", "TThread.TSystemTimes ", "1 131A1T1c1u1", "7;8?8f8p8t8", "?/?=?P?g?u?", "9):-:T:[:b:i:p:w:~:", "crHSplit", "0-0@0f0j0", "FUserInfoOrgLabel", "UpdateThemes", "TTextFileReader", "tttCloseNormal", "ListDrawGlyph", "GammaTable", "BackgroundColorpHA", "TCustomForm6", "2?2C2G2b2j2", "TControl6", "SetBool", "<2X", "Invariant", "616D6R6e6t6", "AbortButton", "GetMultiCastObserver", ";%", ">'>?>G>O>W>_>g>o>w>", "&D2W$S\"", "6/6D6R6i6~6", "tpProgressRoot", "MakeWithoutCopy", "3)3>3P3T3^3f3n3v3", "TPunyCode", "011?1M1[1l1y1Q2t2", "0 0$0,04080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "vaTrue", "ParentWindow", "NoIconsCheck$", "#,,.Q", "TStringScanner.ConsumeMulti: Invalid parameter", "ttItemSelected", "System error code: ", "7 7$7(7,7074787<7D7L7T7", "AHelpContext", "dbmDefault", "9TDictionary&", "Critical Process", "TDirect2DFontd", "CursorRect", ":I;M;Q;U;Y;];a;e;i;m;q;u;y;};", ":6:Y:z:", "UhFTp", "DeleteCard", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$1$Intf`'@", "Ownership", "FMainFormOnTaskBar", "D$ P+", "GetStdHandle", "9%9-9;9M9c9t9", "BiDiKeyboardHKL", "ktscToolBar", "procedure RaiseException(const Msg: String);", "vqiP0&", "TEnumerable'", "TPasswordEdit", ">*>=>S>d>u>y>", "ttTopTabItemBothEdgeDisabled", ";)", ">'>H>a>", "WriteBinaryData", "2&252;2G2V2\\2g2|2", "HitTest", " SelectStartMenuFolderBrowseLabel,8^", "2 2$2(2,202>2P2a2u2", "Systemp)e", ">a>e>i>m>q>u>", "tebSpecialGroupCollapseNormal", "Uhr?J", "FILEEXISTS", "TRttiPool&", "windows-1252", "PeekMessageA", "tsArrowBtnUpNormal", "_RTL_CRITICAL_SECTION_DEBUG ", "FHasCredentials", "sig-r", "CaptionButtonsRect\\oG", "e(2=!", "?\"?&?*?.?2?i?", "%s, ProgID: \"%s\"", "FBackgroundColor", "= =$=1=G=O=W=_=y=", "FCheckHeight", "ListDrawColumn", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$9$Intf`'@", "5$5@5x7", "GetContentStream", "6/6=6P6_6q6", "8(8:8M8U8c8q8", "$f;D$", "2=2e2", "FFullRepaint", "ScaleBy", "6!6L6f6j6", "PTDictionary.TValueEnumerator", "LicenseText", "404O4T4", "TDPIContextServiceF", "6#7~7", "FTextMarginLeft", "FSysControl", "Uh*.n", "WizardSetupType", "Enhanced", "5(5B5", "GetBitmapBits", "Setup.LoggingFunc", "S8_^[]", "TInterfaceEntry", "EStyleEngineException(", "csisolatinarabic", "SendMessageTimeoutW", "Graphic", "TSysListViewStyleHook?", "GETMD5OFFILE", "CreateScaledCopy", "AlwaysShowDragImages", "=p/_;", "TSeStyle", "LockCount", "OnResize<", "FCursorCount", "TIntfMethodEntryTail", "[KCpJ", "0%060J0R0c0q0y0", "FTopZone", "iso8859-3", "wDayOfWeek", "WTDictionary.TKeyCollection", "+TList.ParrayofT4", "TPSTypeRec", "8&858C8R8`8o8}8", "OnExpandConstant", "PIntfMethodEntry`", "6L7P7T7X7f7t7", "2%2,262:2U2Y2v2z2", "wReserved", "EVariantBadVarTypeError", "= =5=N=_={=", "uPSR_classes", ";ScriptFuncLibraryRegister_R.RegisterOtherScriptFuncs$1$Intf`'@", "AScheme", "5'555A5P5", "3,373B3S3g3", "CertName", ">$>6>H>]>w>", ":;:Z:{:", "AllowedKeysRuntimeIDs", "Uh2jE", "mdPrimary", "SetComponent", "8*8R8y8", "8%8<8P8q8", "TypesComboChange", "5-5W5z5", "ttTabItemBothEdgeFocused", "+IComparer`'@", "FMobilePlatform", "2#2'2+2/23272z6~6", "ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$6$Intf`'@", "ttTabItemHot", "IHDRData", "INHERITED", "2.2F2[2u2", "InitializeFromIcon", "203s3", "Thread", "macthai", "0 0(0004080<0@0D0H0L0P0T0X0\\0i0", "skItemText", "ktmiWindowToolbarHorz", "userstartmenu", "; ;1;C;H;R;f;p;", "2TList.TEnumerator", "Global", "tgClassicCellRowSelectedLeft", "!FSelectStartMenuFolderBrowseLabel", "GETSAVEFILENAME", "TPropSet", ";$;4;:;G;];c;p;", "191G1V1m1", "TSysDialogStyleHook4", "Uh.TKeyEnumeratorD*M", "7\"7&7;7?7C7[7_7c7{7", "GETSYSNATIVEDIR", "Setup.ScriptClasses", "9A:q:", "PAnsiChar0", "COFREEUNUSEDLIBRARIES", "ContinueStepOver", "3TList.arrayofT", "Unknown ISSigVerifySignature result", "Jt!Jt,", "8:8H8Y8", "TSysComboBoxStyleHook", "HTTP_2_0", "2-2R2w2", "csNoDesignVisible", "tfAllowDialogCancellation", "TWriter", "?0?S?W?x?", ";$;;;R;i;", "EStackOverflow", "tpUpHorzDisabled", "PVariant", "System.Generics.CollectionsPtH", "crSizeNESW", "trChevronVertHot", "334U4s4~4", "?4?F?Z?n?", "~7;sH", "Unlock", "UpdateDesignerCaption", "paUnknown", "VarR4FromStr", "909<9@9D9H9P9X9\\9`9d9h9l9p9t9x9|9", "> ?'?9?=?A?E?I?", "CopyToClipboard", "FHotImageName", "<+<33><>}>", "utMeter", "OnShouldSkipPage", ">6?V?m?", "BTDictionary.TKeyCollection;", "FInputFileDefaultExtensions", "usercf32", ": :$:(:,:0:4:8:<:I:c:k:s:", "pjn]+", " - Dock zone not found", "JTDictionary.TValueEnumerator;", "Uh!IJ", "tpPulseOverlayVert", "ktxsEndEllipsis", "CurPageID", "odReserved1", "ChildCount", "vLJ.?", "7R7Z7k7y7", "D$4PV", ";-;4;", "TThreadPool.IControlFlag`'@", "?-?7?;?X?", "FExplicitLeft", "StatusPanelTextDisabled", "Vcl.StdCtrlsF", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "g:>n3$", "tmFixed", "TFileAccess", "TSysTrackBarStyleHook", "btnNext", "`Zf`M", "efBottomLeft", "5\"6B6H6m6", "skPopupMenu", "RequiredSHA256OfFile", "KeepContext", "FindInstanceOf", "?-?U?m?", "=,>Y>s>", "J67_|", "TMainForm'", "SpecialType", "sfTextLabelDisabled", "2%282F2P2^2h2v2", "Uhv9r", "TEnumerable", "TSePanelSubclass", "+T$t+", "414E4O4Y4k4y4", "596=6d6n6r6", "csiso2022jp", "AcceptLanguage", "7n7}7", "FBitmapFocused", "1!111C1R1Z1h1{1", "FInstances", "tlGroupHeaderOpen", "REGISTERSERVER", "FReadPropData", "IgnoreChildren", "?\\?`?", "1TList.TEnumerator", "Cl+C\\", "File not found", "5)6h6w6", "ParentToClient", "ABytes", "7-7;7O7b7q7", "usercf", "Failed to expand shell folder constant \"%s\"", "TThemedTabSet", "FAutoLineReduction", ":%:?:W:q:", "<'<8%>->5>e>z>", "EOleSysError_", "tmMenuRoot", "707D7^7l7|7", "SeekTo", "EStringListError", "FInfoAfterClickLabel", "2D2X3", ":9:[:", "FReadProc", "FVerticalPositioning", "363@3D3d3p3t3x3|3", "TPixelFormat", "MainButton1", "Vcl.Forms", "FProgressBar", "TSysRichEditStyleHook7", "747C7K7\\7", "DefaultUsrPwDm", "memset", "&((((", "0\"000?0J0\\0l0{0", "SendCancelMode", "(There is no current exception)", "<\"<)<0<7<>)>Q>{>", "dmPrimary", ":TDirect2DCanvas.:5", "cnAdded", "clMax", "5<5@5\\5l5t5|5", "bsSpacer", "IOp6TL,j}", ":':<:J:a:v:", "8_^][", "1q2C3", "TMouseWheelEvent", "1U2l2", "-Winapi.ImageHlp", "Leftx=Q", "J8_8j8u8", "function GetCmdTail: String;", "An attempt was made to expand the \"", "TUxThemeCategoryButtonElements", "Failed to set value in Fonts registry key.", "PopupPoint", ">W?y?", "AddImages", "LastErrorMsg$YA", "9!9G:T:a:y:", "SingleIdentifierMode", "GetSystemWow64DirectoryA", "4\"4&4*4", "Failed to get path of 64-bit Program Files directory", "protected ", "Inno Setup: User Info: Name", "!mlo!002zlb", "OKToRead", "Verification successful.", "tcpChevronClosedHot", "WriteStringToStream: Length limit exceeded", "TDirect2DFont6", "FTail", "GetErrorInfo", "FSelectTasksPage", "Cannot evaluate \"code\" constant because of possible side effects", ";@;P;T;X;`;h;l;p;t;x;|;", "3TPair", "FHandle", "UnsafeAttribute", "9 9$9(9,9094989<9@9D9H9L9P9\\9`9d9h9l9t9x9|9", "TMonitorDefaultTo", "S0i0z0", "RecInfo", "pszDefaultAction", "=)=Q=U=v=z=", "GetTypeInfo", "DWWWe?", "ccReg", "CanChange", "9#989@9N9]9k9", "BottomButton", "V'.:a", "5$5054585<5D5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "Uh%KJ", "psDashDotDot", "P]_^[", "8O8$9z9", "ReadBinaryData", "FSentinel", "FUserInfoOrgEditd", ";,;<;F;];r;", "UCS4String", "kgidsFocused", "8^SVW", ":%:3:A:U:h:w:", "tdnbRefreshHot", "2<2s2w2", "4)4=4U4]4k4~4", "1,1C1Z1h1", ">8>I>^>u>", "BarGetClientRect", "6(6/6P6W6", "b>[P&", "Uh6\"`", "csCheckPropAvail", "FormClose", "TFavoriteLinkItem", "3h4w4", "5Y7m7", ";l$Ts-;|$xs'", "StoredObject", "Stopping cleanup because it's taking too long (>3s).", "<$<(<,<0<4<8<<<@'>X>", "171T1q1", "Uh4g_", "tnForwardButtonPressed", "TabPosition", "TreeDraw", ".TEnumerator(", "$TEnumerable'", "FRect", "?TObjectDictionary", "tsLowerTrackHorzHot", "TSmallPoint", "NewPPI", "4$4=4N4`4v4", "ktmiWindowToolWindow", "AURIStr", "0\"1q2", "ARequestMethod", "OldName", "ListBoxDisabled", "tsSizeBoxHalfBottomRightAlign", "NewProgressBar", "function CreateExtractionPage(const ACaption, ADescription: String; const OnExtractionProgress: TOnExtractionProgress): TExtractionWizardPage;", "TokenFloat", "kmdsReadOnly", "TCanvas", "FileName", "taLeft", "EInvalidGraphic", "LoadData", "SHGetStockIconInfo", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1p1", "?%?)?B?I?P?W?^?e?l?s?z?", "tmpbBackPressed", "teGrid", "Uh=oE", "TCustomListBox6", "tsGripperVertDisabled", "4'404G4X4i4", "0B0I0", "ssHot", "2#2*21282?2F2M2T2[2b2i2p2w2~2", "6-6D6Z6b6p6", "UhS\"j", "FCommand", "TSysProgressBarOrientation", "PPUnitY4r^", "0U1u1", "8@8J8l8|8", "", "m(SGK", "$TEnumerable'", "9-9]9o9S:", "1(1R1y1", "3-3;3P3f3w3", "ITypeLib::GetLibAttr", "TMethodImplementationCallback`'@", "GetDisplayName", "paX86", "3m3|3", "TWICImage,", "2&3*3.32363:3H3V3f3w3", "ktisRightLast", "TSeScrollAreaInfo", ":,:;:Q:c:k:y:", "9,939:9D9L9n9", "7 7$7(7,7074787<7@7D7H7L7T7X7`7d7h7l7p7t7x7|7", "8(888@8H8P8T8X8\\8`8d8h8l8p8t8x8|8", "7-8[9o9", ";54?w?{?", "bsBDiagonal", "=%=1=9=G=U=c=k=y=", "TreeDrawItem", "TDrawItemEvent", ",TEnumerable'", "IsPanelTransparent", "kCRCError", "tpSysLeft", "2E3v3|3", "2_2k2w2}2", "efMouseEvents", "6:7P7a7u7}7", "Uh^Y`", "Invalid class typecast0Access violation at address %p. %s of address %p", ",System.Character", "get_accChild", "sfHeaderSectionTextPressed", "8$9(9O9V9]9d9k9r9y9", "FAncestor", "|-'Pn", "FCaptionHeight", "DisabledFont", ".TEnumerator", "UpdateFormatSettings", "Stream read error", "KERNEL32.dll", "?)?8?@?N?`?n?v?", "kbbcDown", "Color`", "pdate", "FVisualManagerInitialized", "cdDeviceDependent", "5O5^5f5x5", "CTObjectDictionaryM", ":<:m:", "ReceiveDataCallback@;h", "SetMaxWorkerThreads", "FOldRect", "DrawTextCentered", ".TValueEnumerator;", "3#3-3", "HTDictionary.TPairEnumerator", "=3=;=I=Y=g=", "TStringStream", "InstallAssembly", "0+0:0", " cHRM", "; ;$;(;,;0;4;", "6 6$6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "1o3x3", "708O8", "; ;5;C;P;f;", "3.3B3S3i3q3", "IsBarDefined", "Bitdepth", "RichEdit50W", "TCustomLabel6", "Abstract ErrorKAccess violation at address %p in module '%s' (offset %x). %s of address %p", "kbscDropDown", "P8^[]", "=0=I=M=", ";d;r;", "pparray", "TRttiInvokableType'", "toTouchUIForceOn", "TSysTreeViewStyleHook7", ";+;2;o;v;", "UhMPJ", "8Z:i:", "TGetHandleEvent", "ktcEditDisabled", "kbscSpinLeft", "'TList.TEmptyFunc`'@", "sfCategoryButtonsNormal", "8\";8;|;", "TComponentStyle", "NTDictionary.TKeyEnumerator;", "EAggregateException?", "FRecreateChildren", ":6:::X:\\:w:{:", "SetDIBits", "AlignList", "FileMask", "CreateBitmap", "odSelected", "DeselectedComponents", "0)292R3", "TreeItemTextNormal", "tagWNDCLASSW(", "pJWwF", ")AkBpm", "FBtnDownDetail", "0%1T1", "HaveCaption", "D$X+CT", "@ScriptFuncLibraryRegister_R.RegisterBrowseFuncScriptFuncs$3$Intf`'@", "TSeWindowDrawState", "FDialogHandle", "DefaultHandler", "494C4h4x4", "56789", "CreateInputFilePage", "FDecrypt", "2'2:2J2[2j2", "TNewNotebook6", "8#888F8X8n8", "ktscRangeBar", "EndWrite", "LockHandleGC", "OnThreadTerminate", "&0H0g0o0w0", "FCanObserve", "tbCheckBoxImplicitDisabled", "?\"?1?9?G?Y?g?o?}?", "[TEnumerable>'", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1", "SafeDraw", "Invalid brush style", "IsOpenArray", "9%939F9V9f9u9", "8+8C8K8S8s8", "sbaClose", "AddItem", "ReadStringAsUnicode", "=ScriptFuncLibraryRegister_R.RegisterInstallScriptFuncs$3$Intf`'@", "TStackPanelControlCollection#", "E*};_", "wsNormal", "FPopupMenu", "FShiftBy", "GetSystemMenu", " type=\"win32\"", "0!0>0P0a0w0", "Vcl.StyleAPI", "BkU'9", "HTTPS", "FHelpFile", "toSmoothScrolling", "REGGETVALUENAMES", "IsEmpty`", "=F>M>u>y>}>", "TSeWindowButtonInfo", "ParentBiDiMode`TZ", "Download is using basic authentication: %s, ***", "odDisabled", "6#6+636;6C6K6S6[6c6k6s6{6", "FIndex", "TWindowDisablerdCp", "TCustomBase64Encoding", "FrameHorz", "dsNormal", "FExecuteAfterTimestamp", "FVariantType", ">;>Y>w>", "FPasswordEdit", ":)<<.TPairEnumeratorXvX", "0#040B0J0X0j0", "OnActivate\\oG", "7 zql", "FDropAlign", "FInnerNotebookt", "=4=@=D=H=L=T=\\=`=d=h=l=p=t=x=|=", "8!8)878E8Y8a8r8", "Buffer", "twMDIMinButtonNormal", "ANewWidth", "2C2{2", ";1;@;R;k;|;", "AsRecord", "TList&", "OnGetActiveFormHandle", "AllowSetForegroundWindow", "navDir", "j@j@hH", "3+333A3O3f3y3", "%IEnumerable", "SetHandleInformation", "8$8+82898@8G8N8U8\\8s8w8{8", "EZeroDividex", "2/2>2]2|2&383t3{3", "Abort/Retry/Ignore", "FMarqueeStep", "IsHintDefined", "364=4T4]4", "ifUnused3", "1#1?1M1U1c1u1", "5#515H5_5m5", "FResultLoc", "7'7D7L7h7p7", "*IComparer`'@", "3.3b3s3", "ftCreationTime", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7|7", "0\"1x1", "9$9=9K9Z9m9", "ValidateRect", "tcbCategoryButtonsDontCare", "7 8Z8", "GETWIZARDFORM", "TSetupForm6", "TRichEditViewer`", "080v0", "PreparingPage,5_", "iaBottom", "300@KK", "9\"949M9^9l9t9", "< <$<,<4<<:E:L:S:Z:a:h:o:v:}:", ".TList.ParrayofT", "]VL[k@", "clDarkgrey", "claCoral", "RemoveHeader", "TSysTabPosition", "050]0a0}0", "5%6)6P6Z6^6|6", "FDockClients", "AItem", "Q4_^[]", "2 2$2(2,242<2D2", "EXTRACTFILEEXT", "ECompressError,", "8 80888@8H8L8P8T8X8\\8`8d8h8l8p8t8|8", "FMDIChildSystemMenuTracking", "GETPACKEDVERSION", ">)>1>?>M>a>r>", "ASharing", "6,646<6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6", "`~0j`Sj", "Qmi!'", "4?7U7k7", "DIBOffset", "ccSafeCall", "FMsg2Label", "clLightgreen", "1 1$1(1,1014181<1@1M1a1s1", "TDownloadFile", "545D5L5T5\\5`5d5h5l5p5t5x5|5", "FDropHandle", "HookSynchronizeWakeup", "1'1:1H1Y1g1", "Point", "PrevGroup", "btnStep", "ApplyThemeChange", "lstrlenW", "tlGroupHeaderLineOpenSelected tlGroupHeaderLineOpenSelectedHot'tlGroupHeaderLineOpenSelectedNotFocused*tlGroupHeaderLineOpenSelectedNotFocusedHot#tlGroupHeaderLineOpenMixedSelection&tlGroupHeaderLineOpenMixedSelectionHot", "TForm,", "TFunc`'@", "FExportNameHash", "Wednesday", "FileTime", "4'4:4B4S4l4}4", "BZInitDecompressFunctions failed", "GetImageBitmap", "twHorzThumbPushed", "FlatSB_SetScrollProp", "-TEnumerator(", "PPattern ", ":\";,;0;P;\\;`;d;h;p;x;|;", "6\"646B6O6a6v6", "FAsyncFlags", "tcCueBannerNormal", "ListL", "tgClassicCellRowSelectedCenter", "3/3E3^3t3|3", "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x", "1X2d2", "9&9I9Q9h9p9", "UnRegisterStyleClass", ";*;;>.TValueEnumerator;", "(", "DisplayRect", "<$<+<2<9<@(", "1\"1*121:1B1J1R1Z1b1j1r1z1", "6&656=6L6", "tdnbCancelUpdatesDisabled", "?!?.?;?H?U?e?u?", "WizardImageBackColorDynamicDark", "TZCompressionStream", "sbaMaximize", "Change", ",>?>U>f>", "DrawElement", "RegisteredOwner", "fdoNoChangeDir", "GetWindowTextW", "TChangeLink|", "7!747<7J7X7o7", "5(50585@5D5H5L5P5T5X5\\5`5d5h5l5p5t5|5", "BTDictionary.TKeyEnumerator;", ":4:B:T:p:t:", "ttdFootnotePane", "sfToolItemTextSelected", "CaptureOutList", "Uh^NJ", "TArray", "TSeListItemDrawState", "(EAggregateException.TExceptionEnumerator", "EPNGNoImageData", "9.9D9W9_9m9{9", "efMiddle", "MouseDouble", "4!5P5", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "&0E0V0", "TPngImage>", "6TList.TEmptyFunc`'@", "TControlStyle", "3:3A3K3Q3X3b3g3m3r3x3}3", "Failed to remove directory.", "Bitmap", "606U6d6", "C`;D$,~!", "2.3=3C3L3[3a3i3", "Uh~HS", "TranslateMDISysAccel", "WasPopup", ">(>q>u>", "717<7D7c7k7v7|7", "1b4p4", "8 8$8(858P8o8", "tbCheckBoxImplicitPressed", "7!7:7K7]7e7s7", "Helper: Response message has wrong size", "=/=G=`=", "Invalid string constant", "343?3", "Failed to set value in Fonts registry key: per-user fonts are not supported by this version of Windows.", "ktfWindowTextNormal", ":1:;:`:p:x:", "QQQQQQSV", "HttpOnly", "101o1", "Rights", "PixelFormatpHA", "<:=L=", "FAsComp", "TWheelRouting", "UhbBn", "505S5y5", "9 9A9Q9d9v9", "THintInfo", "8 808D8L8Z8l8z8", "1!1)11191A1I1Q1Y1a1i1q1y1", "0@0\\0`0", "t,HtYH", "TPicture&", "GetTextBuf", "FMethodString", "<@t!QS<$t", "9!9u9", "2{2%3j3", "OnDataObject\\oG", "SignatureU", "360321235959Z0T1", ": :$:(:,:0:4:8:<:@:D:Q:d:~:", "1-1=1L1Z1n1", "Y9Mq-", "UhC+o", "ONNR.", "TBalloonFlags", "(0=0K0c0r0z0", "commonstartmenu", "System(", "OnKeyNotify4GM", "<0<@*?c?", "CurrentHelpFile", "OnNotifyU", "FDrawLockCount", "TCustomListBoxp", ">&>{>", "FControls", "New Jersey1", "TScrollBarInc", "clDarkgreen", "goRotate", "ITDictionary.TKeyEnumerator;", "Uhgmg", "DECREMENTSHAREDCOUNT", "SpecialCryptContextType", "tebHeaderBackgroundNormal", "=2>@>e>o>", "2Y3s3", "KeySize", "3#3.3", "ttbSeparatorVertOtherSideHot", "FFirstShowing", "FColors", "Create", "sbaNone", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$13$Intf`'@", "big-five", "FOnAlignInsertBefore", "ReleaseDC", "TDragDockObjectEx1", "FAction", "4TPair", "-IEnumerable", "sfOnlyUninstall", "GetThemeIntList", "TSeCustomStyle&", "AUserPrograms", "FBorderStyle", "939A9Q9d9w9", "9%:2:?:N:g:|:", "D:\\Coding\\Is\\issrc-build\\Components\\ChaCha20.pas", "IRichEditOleCallback`'@", "1(1b1", ";\";4;J;[;n;", "QQQQSV", "TList'", "2\"3-343D3L3T3\\3`3d3h3l3p3t3x3|3", "Uh}'f", "FStateList", "header crc mismatch", "GetDC", "9\"949B9S9i9", "<&<4%>)>E>h>p>", "tgGradientFixedCellPressed", "DisabledImageIndex", "kticNormal", "?'?6?E?Z?}?", "20393C3S3_3t3", "RegisterFileFormatRes", "2L3^3", "616K6S6a6s6", "? ?(?F?[?l?", "@L+FL", "HBRUSH", ";\";&;I;M;o;w;{;", "TSeToolGlyphInfo", "6TCollectionNotifyEvent", "tlCollapseButtonHover", "%s\\%s_is1", "060\\0w0", "FOnFindGraphicClass", "DwmSetWindowAttribute", "1K1[1", "TypeSize", "nTrackPos", "TseBitmap&", "ttbSeparatorDisabled", "TInteractiveGestureFlag", "IInterfaceList", "HelpSystem", "tcCueBannerPressed", "ttTopTabItemDisabled", "`le_3", "TListEnumerator5", "GrantPermissionData", "=>=H=R=W=j=", " IComparer`'@", "\\$$;]", "8 898h8x8|8", "tlGroupHeaderLineClose", "GETINIINT", "commonfonts", "ButtonNormal", "WTDictionary.TPairEnumerator", "clIndigo", "tgGradientCellSelected", "fvISSig", "GetEnumerator", "8 8(8<8R8c8y8", "GetLocalTime", ":Crt#", "WriteIdent", "1 131E1U1g1w1", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$7$Intf`'@", "6\"6*686J6`6q6", "171W1v1V2c2o2", "kUnsupportedMethod", "ksbcMinus", "DeleteEnhMetaFile", "TscTileStyle", "9:9G9V9o9", "\"IEnumerable", ",TArray", "tcpChevronClosedNormal", "Uh$7S", "3+353X3h3l3p3x3", "Uh6Qt", "Shared count reached zero.", "TInputQueryForm", ":#:7:F:N:\\:m:|:", "FList", "5 5.5:5I5X5", "IsLabelTransparent", "System.Generics.Collections`'@", "OnNextButtonClick|;j", ";9;\\;d;", "point", "Int64AttrData", "4TList.TEnumerator", "TList", "TSpawnServer&", "TAsyncConstArrayFunctionEvent", "SystemHeight", "teNavigation", "clForestgreen", "TSevenZipDecodeState8", "2*3X3", "FStartMenu", "5)5F5X5i5", "/CURRENTUSER", "sfCategoryButtonsCategoryNormal!sfCategoryButtonsCategorySelected", "TAlphaColor", "8/8:8?8J8O8Z8_8j8o8}8", "TMetafile", "NewCheckListBox'", "khdsDragging", "RegisterPreviousData raised an exception.", "get_accDefaultAction", "6)61696", "9/989X:\\:`:d:h:l:p:", " const System::DynamicArray Objects) {", ">4>8><>@>D>H>a>v>", "PrevCard", "<1S>h>w>", "FHelpType", "Component", "D$$PV", "Broadcast", "6)656E6S6a6", "FControlStyle", "ETDictionary.TItemArray", "6&686H6L6l6v6z6~6", "\">6>C>K>Y>k>|>", "5c5o5t5", "TNewComboBox", "505;5", "=5=K=\\=r=v=", "waHqM-", "4TEnumerable", "TThreadPriority", "8 8$8(8,80848G8\\8j8}8", "layout text", "csbig5", "pdecVal", "TCustomElementServices", "2TList.ParrayofT", "FPageNameLabel", "Q}4_y", "=ScriptFuncLibraryRegister_R.RegisterInstallScriptFuncs$5$Intf`'@", "2TList.arrayofT", "MrK*}Z", "566o6", "3TDictionary", "0\"0'0", "8!9)9V9^9", "TwoDigitYearCenturyWindow", "tgGradientCellRowSelectedLeft", "clPeachpuff", "GetWindowPlacement", "bstrHelpFile", "MoveSelection", "TUNINSTALLSHAREDFILEFORM", "FCursorList", "344D4c4", "}]]x<", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;e=i=m=q=u=y=}=", "fMDIApp", "efDiagonalEndBottomRight", "2 2?2K2[2{2", "Uh5QD", "Output redirection error: CreatePipe failed (%d)", "tsArrowBtnRightPressed", "0Setup.RegDLL", "GetMessagePos", "sfDesignSize", "DTCollectionNotifyEvent", "UhQ;Y", ";TEnumerator(", "CancelHint", "GetCapture", "intVal", "AFilename", "function RegWriteMultiStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;", "IiGM>nw", "FRefCount", "BuildFilterStrings", ">0><>@>D>P>T>X>`>h>l>p>t>x>|>", "CMD_Err2", "9&91999J9^9o9|9", "TLocalTimeZone.PYearlyChanges", "7$727@7T7j7}7", "<*<2<<U>p>", "BufferedPaintUnInit", "ResourceLoad", "MapArchiveExtensions: Invalid SourceExt", "\\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.16x", "Handle0", "TSeMenuGlyph", "kescEditRight", "clWindowFrame", "akTop", "FWheelAccumulator", "???C?p?", "Successfully installed the file.", "6J7\\8", "ibm855", "ecBorderColor", "TryGetValue", "0!0%0)0-0105090=0A0E0I0M0Q0U0Y0]0a0e0", "IObserver`'@", "InsertMenuItemW", "ResetStyle", "QueryPerformanceFrequency", "(", "TSeTextStyles", "TMessage", "Metrics4+s", "2 3*3I3X3u3", "Uh!qK", "TSymbolName", "CreateResFmtHelp", "ExtraScanline", "function SameText(const S1, S2: String): Boolean;", "> >$>(>,>0>4>8><>@>D>Q>h>{>", "=-=X=", ">(>5>I>W>i>", "TArray", "?,?:?Q?f?t?", "ktcWindow", "ScaleRectSize", "1'1+1/1J1R1j1n1", "ProxySettings@", "949\\9", "BufferSize", "Current(", "3%3-3;3J3X3i3q3", "5$555I5Q5b5p5x5", "\"TEnumerator(", "6*6.6W6m6", "1,1C1Q1h1}1", "<0TObjectDictionary0ze", "<0<4.ParrayofT", "poNone", "TSeGlyphAlign", "CompressMethod", "FMouseDeltaX", "3 383F3T3u3", "PPropData", "CanObserve", "525L5e5~5", "6'6<6J6a6v6", "2'21262O2^2f2{2", "-TLoginCredentialService.TLoginCredentialEvent", "One or more applications could not be restarted.", "tdbDateTextNormal", "Delete303", "2.2>2P2j2x2", "FFooterText", "9>:!;3;H;];o;", "3c384", "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\", "5-5@5Z5h5w5", "?(?8? >$>(>,>0>4>8><>@>M>d>", "tbCheckBoxMixedNormal", "3 393S3^3j3", "csUpdating", "csiso2022kr", "tfVerificationFlagChecked", "TList&", "function ISSigVerify(const AllowedKeysRuntimeIDs: TStringList; const Filename: String; const VerifyFilename: Boolean; const KeepOpen: Boolean): TFileStream;", "6.626D6r6", "5/545m5", "SystemX", "&TEnumerator", "DisabledImageName", "PListH", "CheckHotKeyItem", "clSilver", "Handle4qD", ";IEnumerable", "Checked", "RegistryConnect", "; ;+;6;H;[;_;w;~;", "DotISSigEntry", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$6$Intf`'@", "InstallDate", "6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", ",underline", "CurPage", "VExtended", ")G}KM", "TRegisterFilesListRec", "RAISEEXCEPTION", "OwnerDraw", "void __fastcall AddStrings(const System::DynamicArray Strings,", "ttbThumbVertDisabled", "DropControl", "FSizeBox", "8f8!9*9_9", "TVmtMethodEntry", "ktcCategoryButtonsGradientBase", "_*zf[", "Cannot register 64-bit DLLs on this version of Windows", "8b:q:x:", "FilenameEdit", "FTitleBarFrameRect", "%s failed with error code 0x%x", "=$=(=0=4=<=@=H=L=T=X=`=d=l=p=x=|=", "334r4|5", "363H3d3v3", "TStackL", "claNull", "7&787@7N7[7m7", "GlassFrame", "FldOffset", "GetBitmapByName", "kmgGlyph", "4U4~4", "TGraphicControl", "1H2O2", "UhBoM", "DefaultUserInfoName", "TVarDataArray", "FOnDownloadNoProgress", "0)0=0E0S0c0q0", "5/575E5U5c5{5", "2.2]2q2", "RealSize", ";.;A;I;W;e;y;", "System.Generics.Collections@", "sbaRestore", "4A4O4T4_4e4j4u4{4", "REMOVEQUOTES", "313?3R3h3y3", "Headers", "IntfUnitFld", "psDashDot", "-Setup.Helper", "C`;D$", "2-2Y2n2~2", "1(1=1N1f1n1|1", "MTList>.ParrayofTD&J", "Sp^[]", "scListBoxDisabled", "AExceptionArray", "euc-tw", ";ScriptFuncLibraryRegister_R.RegisterOtherScriptFuncs$ActRec", "7 7.7D7V7^7l7z7", ";=", ":R;+<", "TElementEdge", "twMDIRestoreButtonPushed", "FInvsibleCount", "1!1(1R1Y1", "TObjectCaches>", "DisableProcessWindowsGhosting", "TMarshal", "FCallCleanup", ")TCollectionNotifyEvent", "Administrative install mode: %s", "Unknown constant \"%s\"", "SetDCPenColor", ":6:O:d:", "8'898I8Q8_8q8", "Starting 64-bit helper process.", "MTDictionary.TPairEnumerator;", "FVUpState", "GetProcVar", "ktisBottomLast", "TrackButton<3Z", "?&?>?L?^?m?u?", ";Slt#", "crSize", "6%646[6_6c6g6k6o6s6w6", "csiso58gb231280", "6$696G6[6t6", "DWRITE.DLL", "2$2,2I2Y2a2i2", "pvarID", "ITDictionary.TValueCollection;", "WordWrap", "6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6", "6&6.666>6F6", "<*<>0>K>O>p>", "WNetGetConnectionW", "System", "wMonth", "tfExpandTabs", "1%1-1;1I1]1p1", "FlushFileBuffers", "NewFolderName$", "mtidsCheckedPressed", "kpbcRollDown", "kticExpandButton", "avail_out", "TReceiveDataCallback`'@", "FVertSliderState", "claSeagreen", "Invalid binary value", "kbscButton", "8TDictionary.TValueEnumerator", "bsClear", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$18$Intf`'@", ")Compression.SevenZipDLLDecoder.Interfaces", ";6TList.arrayofT", ";2;X;`;", "FStrm", "IShellItemArray`'@", "<'=7=", "FChunkFirstSlice", ">14{BR", "teStatus", "CheckTokenSymbol", "", "ColorToRGB", "Decrementing shared count (%d-bit): %s", " ;SLt<", "ArrayTypeInfo", "Password", "WizardSelectTasks", "FLastId", "TabTextInactiveNormal", "Shared.ScriptFunc", ">1?8?", "868@8L8", "7R7h7", "GetTopSite", "cp-gr", "2$2M2~2", "FActionLink", "External exception %x", "PhysicalToLogicalPoint", "4K5Z5b5t5", "0/080V0", "2J2x2", "rGYYY", "6%6/676>6H6U6t6", "UseRightToLeftReading", "1T1\\1n1", "1vgs!>)>1>9>A>I>Q>Y>a>i>q>y>", "onv,OUU", "AByRef", "< <(<6", "6)7m7", "TAsyncConstArrayProc`'@", "='=>=X=f=u=", "FTCollectionNotifyEvent", "System.IniFiles", "tttBalloonStemUpCentered", "@UUUUUU", "9 9(9F9T9\\9j9|9", "DupsAllowed", "IsDockDefined", "iso8859-2", "ToolDrawItemGlyph", "0'050H0^0l0|0", "&Abort", "tmPopupCheckNormal", "hd\"rI_", "FPenPos", "dSystem.Hash", "= =$=(=,=0=4=8=<=@=D=H=L=P=X=`=h=p=", "SelLength", "4TList.ParrayofTt", "FDisableFsRedir", "3[3m3r3", "GTDictionary.TKeyEnumerator;", "BarDrawCaption", "FreeResource", "8 8$8(8,8084888<8I8Z8l8", "claMediumturquoise", "9\\:q:", ":-:;:N:d:y:", "FStatusAction", "=*=<=K=S=a=q=", "sfStatusPanelTextNormal", "IComparer`'@", "=3=;=C=K=S=[=c=k=s={=", "THTTPClient.THTTPStateH", "FAutoHotkeys", "Comparer8", "Jt#Jt/", "FRefreshGlassFrame", "0\"0*02090L0Z0b0j0r0z0", "0*0A0P0z0~0", "TConversionClass", "lTEnumerator>xAM", "language", "TEnumerable'", "crDefault", "OnHintXB[", "0!090Q0i0", "macintosh", "RadioButtonTextNormal", "PCursorRec", "Qkkbal", "kticSysMenu", "FCardPanel", "GetImage", "8/9;:", "Vcl.Printers", "GetOptions", ">%>->5>=>E>M>U>]>e>y>", "< <(<0<4<8<<<@", "Initialize", "TSeStyleObject6", "1)181G1Y1f1n1|1", "9;:D:", "=:=B=`=p=t=x=", "BeginWrite", "6-6H6c6", ";);1<>ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$5$Intf`'@", "ShowContextHelp", "clDarkred", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$7$Intf`'@", "#IEnumerable", "wi{y+JVT", "StaticQueue", "Yield", "SetDragImage", "VirtualProtect", "(0:0k0", "Bounds(", "5%5,5\\5", ";G$tF", "353O3i3", "sfListItemTextFocused", "1\"1C1K1g1o1s1", "8;8E8h8x8", "0(0F0d0", "TBDockHeight", "LoopL", "2+2Q2w2~2", "ktfPopupMenuItemTextDisabled", "REMOVEBACKSLASHUNLESSROOT", "statstg", "FBiDiKeyboard", "biCompression", "ktisTopMiddle", "Invalid token '%s' found", "claTeal", "RANDOM", "7*7K7o7", "sfRadioButtonTextHot", "GTDictionary.TKeyCollection", " ", "> >(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "GetInternalStyleElements", "JTEnumerator>", "7#7#8E8^8v8", "7T7s7}7", "TRoundedCornerType", "0'121r1", "FOnTimer", "WWY[[gmi", "9 9(90989@9", "userstartup", "?,?X?m?", "odChecked", "FHasSplitButton", ":p;~;", "0TCollectionNotifyEvent", "506d6", "000@0K0", "Delete308", "Increment", "4$4:4O4]4p4", "claMediumpurple", "<%<-K>T>~>", "<,=d=", "GetButton", "bAsv?", "ReferredType", "file-size", "ArchitecturesAllowed", "Dest file is protected by Windows File Protection.", "LocalFree", "tTDictionary.TValueEnumerator", "MultiSelect", "1 2<2t2", "AutoDropDownWidth@CA", "tgCellRowSelectedCenter", "clBeige", "TGestureOptions", ":6;U;o;|;", "2*3.3U3_3c3", "4;4x4", "Please specify the password using the /PASSWORD= command line parameter.", "InactiveBackgroundColorpHA", "Uh#ZP", "TList.ParrayofT", "Decode", "&", "?TCollectionNotifyEvent", "sASMInline", "fdoDontAddToRecent", "Wow64DisableWow64FsRedirection", ";STt,", "4&5`5", "050D0L0\\0", "? ?$?(?,?0?4?8?'", "4*4I4x4", "<)<10Q0d0", "LTDictionary.TPairEnumerator;", "(TList.arrayofT", "FLastServerAuthScheme", "csCaptureMouse", "FInputFileFilters", "ibm862", "; ;(;Q;g;};", "1'151D1W1q1", "Uh}4v", "CheckNonMainThreadUsage", "clDarkorchid", "wShowWindow", "TProgressThrottler", "9(979M9_9g9u9", " TArray", "/ForceCloseApplications", "FMouseInControl", "<9=[=k=y=", ";#;9;H;`;d;", "6#7P7", "<&<4'", "\"###^:::", "GetAddress", "OnSimpleDownloadProgressParam", " if (Strings.Length)", "<2<:6P6f6<7c7u7~7", "0TList.TEnumerator5", "(000?0G0b0h0", "FOwnsObject", "768N8W8", "4!4%4)4-4145494=4A4E4I4M4*5K5", ">0>E>S>i>~>", "IntfFlags", "JTDictionary.TValueEnumerator;", "TSeButtonInfo", "SHGetKnownFolderPath", "EMonitorLockExceptionH", "CurInstallProgressChanged raised an exception.", "FCustomMainIcon", "ID2D1StrokeStyleX", "FAttributes", "RelTarget", "ppAsmScavenger", "SetForegroundWindow", "SetActiveWindow", "Msg1Label$", "Uh\\8t", "<-=6=l=", "GetVarNo", "ButtonTextDisabled", "ktfButtonTextFocused", "=d?q?", "Restarting Windows.", "DeinitializeSetup", "TRequestGrantPermissionData", "<)<;:Z:", "skPageRight", "0%0<0@0D0_0c0g0", "CharIndex", "t|Htd", "1)10171>1E1L1S1Z1a1h1o1v1}1", "8f9v9{9", "UhtES", "hbrBackground", "FDSTName", "P ;SDv", "TDummyClassx", "NoRadio", "5H6W6", "zcNone", "=!=9=H=P=`=", "Cannot respawn self, not named .exe", "@TList.TEmptyFunc`'@", ";(;@;N;e;};", "UpdateStartupInfo", "Wrong password", "ComposeURI", "RegDeleteKeyW", "Inno Setup: Selected Components", "324v4", "tdnbRefreshNormal", "Param", "HTTPStatusCode", "dispVal", "TWizardPageShouldSkipEvent", "FSysParent", "n0PPd}", "Pinternal_state0xP", ">TList.TEnumerator5", "tcDropDownButtonPressed", "?K?]?v?", "TUE{{{", "FTotalBytesRead", "BeginPatchAlternative", " ", "FindCredentials", "TPropData", "REGDELETEVALUE", "xW4c,", "IsThemeBackgroundPartiallyTransparent", "><>L>P>T>\\>d>h>l>p>t>x>|>", "ReadBool", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$ActRec`~m", "N(+L$", "iso-ir-110", "kbbdsDisabled", "ReleasePalette", ")TCollectionNotifyEvent", "Updating", "929A9", "psEnding", "9'9?9N9V9h9", "Attributes", "UhfzY", "", "DataInstance", "TButtonStyleHook8", "TObjectCache", "0'050G0K0", "5,5;5", "1%1,131:1D1L1d1", "ttlTextLabelRoot", "FAnchorsIsSaved", "=&>0>4>T>`>d>h>l>t>|>", "Actions", "claYellow", "2D2T2X2\\2d2l2p2t2x2|2", "GetThemeEnumValue", "GTDictionary.TKeyEnumerator", "=-=E=f=", "Locale", ";.;I;d;", "9C:S:", "Repaint", "tdnbNextPressed", "FSaveItemIndex", "829p9", "OnStartDragD", "Little", "Invalid count (%d)", "FImpl", "ECDSA_P256", "7?7O7h7t7", "SystemDrive", "FOnRestore", "o0m0F", "6)6;6C6Q6c6y6", "?!?2?@?H?V?d?x?", "FListHandle", "TURLRequest", "4%474I4k4w4", "ImageList_DrawIndirect", "0!0)0F0[0l0", "Uh{cn", "TBitmapp", "ActivateHintData", "8$828E8X8c8v8", "mkOperatorOverload", "0#070K0S0a0t0", "iso_8859-6:1987", "9'909=9B9M9U9[9x9", "6^7~7", "4I4U6", "iso_8859-9:1989", "CLSIDFromString", "EFilerError", "Null Pointer Exception", "R$_^[", "FOleForm", "TExtractorProgressProcr", "Running Exec output:", "FTransparentColor", "BiDiKeyboard", "WaitForInputIdle", " type=\"win32\"/>", "claDarkorange", "pfSub", "iso_8859-16:2001", "TObjectCache@(e", "FInitingScrollBars", "FMarginLeft", "CategoryPanelGroupHeaderHot", "SfcIsFileProtected", "InitObservers$ActRec", "?N?o?", "9 9T9j9{9", "Error opening request: (%d) %s", "EUnderflow", "claLightskyblue", "TThemedTreeview", "FChanged", "SetSelTextBuf", "FMaxClassesInCache", "FHead", "TTouchManager", "TSeProgressInfo", "RTDictionary.TItemArray0", "TRttiNamedObject6", ";*;<;", "8,8>8R8n8|8", "WriteWideString", "EnumChildrenOf", "CommandLineToArgvW", "TabTextActiveDisabled", "7#73777O7d7r7", "S.UI$", "FOnModalBegin", "ITDictionary.TKeyCollection", "<$<4<", "btnRecord", "iTArray>", "TBitmapImageImplementation@", "FEditInstance", "GetParent", ">2>D>b>f>", "EncodeAuth", "AsExtended", "tlListItemHot", "ControlOfs%.8X%.8X", "TSysTrackBarStyleHook7", "*TEnumerable$", "Uhv`k", "IOleWindow`'@", "CreateAssemblyCache", "<-<@.TItem", "Metafiles", "AHash", "= =.=:=H=c=k=y=", "erNullPointerException", "TreeGetClientRect", "8(8,80888@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "function GetSHA256OfString(const S: AnsiString): String;", "3!303;3F3U3f3v3", "<#<+<9", "Uh`,Z", "BCryptDestroyKey", "1+1}2", "Setup.FileExtractor", "PromptLabels", "EThread", "FComponentState", "0'050C0T0h0p0", "FGlassFrame", "MenuItemTextHot", "ktfTabTextActiveNormal", "ReshowTimeout", "<1<@<_ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$8$Intf`'@", "7TCollectionNotifyEvent", "0,1E1O1V1", "CMD_Err", "IS64BITINSTALLMODE", "gTDictionary>.TKeyCollection`", "TButtonControl", "9$989@9Q9_9g9u9", "FItemClass", "6 656C6U6o6}6", "FMDIVertScrollBar", "AdjustWindowRectExForDpi", "6!656B6J6X6j6{6", "N.TValueCollection", "tIG;}", "!TEnumerable'", "HTDictionary.TKeyCollection;", "UhtzS", "Unterminated string", "DTDictionary.TValueCollection", "TDragObject", "MouseInClient", "FParamInfo", "1TCollectionNotifyEvent", "ttdControlPane", "9!909I9M9l9|9", "Uh1R\\", "2TList.TEmptyFunc`'@", "6\"6/676E6R6d6v6~6", ":TDictionary&", "4A4L4T4d4l4t4|4", "1$111>1O1`1p1", "mtidsHot", "Header", "An attempt was made to access UninstallProgressForm before it has been created", "clMenuBar", "6)6{8", "GetStockObject", "7$7,7=7K7S7a7q7", "< <(<,<0<4<8<<<@", "FDisableItemStateDeletion", "FileNames", "8 8D8Y8g8{8", "clSteelblue", "QQQQQQ3", ")TList.TEnumerator", "THeaderValueListt", "2'262>2P2", "PRQhP", "Untitled", "FListBoxTrackDownDown", "DragPos", "0&0*0H0X0`0h0p0t0x0|0", ":%:7:E:X:`:n:", "]jIk7", "dSystem.SysConst", "tagVARIANT", ";&;<;M;_;m;|;", "function CreateDir(const Dir: String): Boolean;", ";TDictionary.TPairEnumerator;", "tSetup.ScriptClasses", "ParentControl", "function WizardSilent: Boolean;", "XTDictionary>|", "5#5+595G5Y5a5r5", "FOnCreate", "3 3$3(3,3034383<3J3R3Z3b3j3r3z3", "GetScanline", "FOnEnter", "kppChunkHorz", "<3<;.TValueCollection;", "Windows Server 2003 R2", "tcbCategoryNormal", "FOnAdvancedDrawItem", "TSeBarInfo", "ForceLTRReading", "9&9.969", "1_1l1x1", "4:4`4", "FDragHotspot", "ttbSeparatorNormal", "6.7a7", "364K4\\4q4", "kldsDisabled", "666^6b6", "iso-8859-13", "crSizeWE", "ToolGetClientRect", "TRichEditViewer", "Setting", "PResStringHashItem48C", "> >&>,>4>?>E>N>r>", "PInterfaceTable(", "Theme", "clPeru", "TrackBar", "TRttiPointerType,", ";@;G;N;U;\\;c;j;q;x;", "{group}", "=1=Y=", "tfCenter", "clPurple", "InOutString", "PRQhT", "AFilter", "9K9i9", "tnForwardButtonHot", "Unsupported stream format", "AAsyncCallback", "FVertDownState", "5 5$5(5,5054585<5@5H5P5X5o5", "4#424>4L4t4", "PrintScale", "AttribTypeHash", "575E5T5d5v5", "Vcl.StdCtrls", "OnDestroy", "Uh~Lr", "TEnumerator", "HTCollectionNotifyEvent", "TMenu6", "?B?R?V?v?", "RequireRadioSelection", "IsMenuTransparent", "TOrdType", "Not calling UninstallNeedRestart because a restart has already been deemed necessary.", "AWriteCount", "7$7,747<7@7D7H7L7P7T7X7\\7`7d7h7l7p7x7", "kwhtBorder", "0'0/0S0[0y0", "BitDepth", "CheckPassword", "TComboBoxStyleHook", "TArray", "GetProcNo", "clOrange", "Winapi.Windows.PkgHelper", "TList&", "7&747A7T7d7w7", "'TEnumerator", "iso-8859-16", "SurfaceExtraWidth,:j", ")0'0%", "SequenceNumber", "UnsafeFixString", "?$?P?\\?`?d?h?l?p?x?|?", "ssLeft", "skFMXProgressBar", "2?2`2p2x2", "FDictionary", "TaskDialogMsgBox", "FGlobalContextToken", "SizeX", "2(2=2E2", "7,707R7Z7{7", "SetReplaceColor", ";!;/;A;S;[;i;x;", "ToolItemTextDisabled", "6*6|6", "<2=~=", "toTouchSwitch", ">ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$ActRec", ":1:8:V:\\:", "bmWidthBytes", "4+5X5", ":(:9:N:\\:o:", "1'1/171?1G1O1W1_1g1o1w1", "OffsetRect", "Item2", "clDkGray", "TSeScrollInfo", "TPropSetV", "1c2g2k2o2s2w2{2", ">#>)>->=>B>g>", "<,<8.TPairEnumerator;", "AssignTo", "FComponentsList(", "uK|+#", "InitializeUninstall raised an exception (fatal).", "TPropSet", "ktfEditBoxTextSelected", "=P>T>X>\\>`>d>h>l>p>t>x>|>", "6=7T7h7", "CheckGetSize", "NumFileLocationEntries", "8TCollectionNotifyEvent", "7TList", "FCurrentRow", "kUnexpectedEnd", "Edges", "Class %s not found", ":7:;:Y:]:x:|:", "ItemNo", ">*>8>", "4Z7F:X:y:", "3$343B3Q3Y3g3v3", "p>", "6$6,6064686<6@6D6H6L6P6T6X6\\6`6h6p6x6", "", "$TArray", "8%8/8T8t8", "LineIndex", "D$0Pj", "\"TEnumerableP", "%s property out of range", "8=8G8O8h8y8", "RestartManager found an application using one of our files: %s", "HKEY_CURRENT_USER", "function IsComponentSelected(const Components: String): Boolean;", "bTEnumerator>(", "TRttiMethod", "FChildStoredMinPosition", "Replicate", ">P?_?", "ActiveClass", ";$<9.TKeyEnumerator", "Vh,$o", "H`e&mq>", "Internal error", "UhOxj", ": :(:0:8:@:H:P:", "jjjjjj", "<+++$", "TCustomStyleListViewElementsP", "OwnsObjects", "Group1", "RethinkLines", "9'979L9[9i9w9", "D$LPW", "969G9U9]9k9y9", "GetThemeString", "bAsV?", "FInline", "CreateFontIndirectW", "Tracking", "UpdateUninstallLogAppName", "4N4|4", "8!8/8A8W8e8t8", "RemoveQueuedEvents", "=0>N>", "stcOSErrorInfo", "TSysTreeViewStyleHook", "<0<_`'@", "838H8V8m8", "ttTopTabItemRightEdgeNormal", "707d7", "7/7L7Z7j7|7", "6@6\\6l6|6", "131M1g1", "SetRTFText", "LMMm@;8{", "ThemesEnabled", "TSeTextAlign", "AHeaders", "System.Net.HttpClient.Win", "clDarkgray", "GB2312_CHARSET", "~y#}y", "Uhz:]", "Successfully extracted the archive.", ": :$:(:,:0:4:8:<:@:D:H:L:Y:s:", "Activate", "=_>s?", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$7$Intf`'@", "7O7c7k7|7", "DynArrElType", "<*<:>", "IsDPIRelated", "BoundsRect", "ecGradientColor5", "CrystalBit Solutions1", "bfError", "Current Uninstall EXE is not named \"_unins.tmp\"; not creating \"_unins-done.tmp\".", "bstrVal", "TArray", "-J5*>", "elType", "tmcTrailingGridCellUpperHot tmcTrailingGridCellUpperHasState#tmcTrailingGridCellUpperHasStateHot", "@?@t ", "Uh5BO", "VerifySignature", "guidItem", "UhwPo", "ScrollCode", "TScriptRunnerOnDebug", "FStyleName", "tclListItemDisabled", "<-<=^?u?", "THeaderValueList.TFlags", ";Plt!", "UhoIJ", "ksadsPressed", "=&=;=Q=h=|=", "TThemedListview", "FForegroundColor", "tfExpandedByDefault", "ToObjectArray", "mdNearest", "LicenseMemoD", "7&737K7a7s7", "DEBUGGING", "tcClockRoot", "202E2S2f2y2", "IsWinDark", "", "TktlMarginId", "Unknown RuntimeID '%s'", "EvalCheckIdentifier", "HasName", "3 3$3(3,3034383<3I3^3w3", "FActualFolder", "Uh`&j", "8\"808?8M8c8q8", "clThistle", "IsThemeActive", ";0;K;O;h;x;", "Stretch", "FListBoxTrackUpDown", "DwmDefWindowProc", "incompatible version (-6)", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$25$Intf`'@", " tJWV", "=+>n>7?", "=)=O=^=i={=", "INLINE", "TDeleteUninstallDataFilesProc", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$22$Intf`'@", "TUninstallRecTyp", "D$,+D$$", "PatchAlternative", "41484b4r4", "fDrag", "BorderSize", "HPPGENAttribute5", "lbOwnerDrawFixed", "vaFalse", "TSeTabItemClass", "2>2P2r2", "FTypeInfo", "0=1T1", "3_6i6}6", "gYY_g`", "050]0", "080f0j0r0", "6\"787t8", "APath", "UTF8Length", "?)?:?\\?i?z?", "1.1q1", ":S;Z;o;s;w;", ";A>", "FOnSelectionChange", "taBottomCenter", "HC{z-U", "FInImeComposition", "TMultipartFormData", "5TList.TEnumerator5", "&mYj{", "llVal", "rcNormalPosition", "4$494G4W4m4", "&TCollectionNotifyEvent", "0hTHl", "TWriter'", "TWinControlActionLink", "j\"j\"j", "tagBITMAPINFOHEADER(", "VObject", "Property '%s' is write-only=RTTI objects cannot be manually destroyed by application code\"%s (Version %d.%d, Build %d, %5:s):%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)", "3K4O4v4", "ValidateGroupEdit", "#TArray", "AGraphicScalerClass", "GetNamedSecurityInfoW", "Inno Setup: Selected Tasks", "Portions Copyright (C) 2000-2025 Martijn Laan", "function DownloadTemporaryFile(const Url, BaseName, RequiredSHA256OfFile: String; const OnDownloadProgress: TOnDownloadProgress): Int64;", "FRightPressed", "kebdsPressed", "tis620-0", "CreateFromID", "RightButton", "OnDeactivate", "tcDropDownButtonRightPressed", "4+4/4P4`4h4p4x4|4", "CurrentMinorVersionNumber", ";$;2;?;G;U;e;s;", ";';8;Z;g;x;", "VarCyFromStr", "1)111O1W1u1", "1TList.arrayofT8", "XTDictionary.TKeyEnumerator;", "FOnBeforeMonitorDpiChanged", "FNCMouseDown", ";=", "TryLoadFromResource", "FNextButtonh", "(", "WizardSmallBitmapImage$", "InactiveForegroundColorpHA", "tmcTrailingGridCellHot", "twMDISysButtonHot", ":#:Z:o:}:", "VarIsEmpty", "FHorizontalPositioning", "$;<$rL", "2TList&", "`'@", "TStack", "SelTextt:Q", "SysCloseButtonDisabled$", "clBackground", "Normalize", "7!767G7]7n7|7", "5'5/575d5y5", "pxLeft", "MouseActivate", "=X>\\>`>d>h>l>p>t>x>|>", "[Variant]", "848B8\\8|8", "CryptKey", ":!;2;D;X;k;", "MinVersion", "9&:>:K:q:", "TSeSplitterSubclass", "2'33383D3I3N3Z3_3d3p3u3z374C4H4T4Y4e4j4v4{4", "!'%s' is not a valid integer value-'%s' is not a valid integer value for %s type('%s' is not a valid floating point value '%d.%d' is not a valid timestamp", "0^1g1u1", "TList&", "TScriptFuncEx", "odFocused", "fsWrite", "TTypeInfo", "&TEnumerable'", "?\"?M?w?", "9b9z9", "IReadWriteSync`'@", "4)4j4x4", "R\\[Y]", "Strings", "TSetupLanguageEntry3", ".4", "FStopCheckChildMove", "bsSolid", ": :$:(:,:0:4:8:<:@:D:`:u:y:", "FUseBOM", "4 4$4(4,4044484P4a4e4", "8G8~8", "TEnumerable", "FWorkerThreadCount", "8%858F8Z8z8", "CurrentProcVars", "srcexe", "+|$DW", "TListEnumeratorx{G", "ktfMenuItemTextDisabled", "444D4L4T4\\4`4d4h4l4p4t4x4|4", ":#:*:1:8:?:F:M:T:[:b:i:p:w:~:", ":#:*:1:8:?:F:M:T:[:b:i:p:w:", "AfterConstruction", "The unexpected small block leaks are:", "*TEnumerable'", "IsIconic", "8F8k8o8s8", "6$646<6D6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "576I6f6", ": :9:A:R:b:j:{:", "ttdProgressBar", "pmMask", "!TScrollBarStyleHook.TScrollWindow8>T", "tmMenuBarItemPushed", "FAttribType", "Uh:vJ", "6(606>6Q6e6~6", "FFatalException", ":f;n;t;y;", "5_5c5", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$54$Intf`'@", "TValidateCertificateCallback,", "(???)", "ecTransparentColor", ">`?k?t?", "; ;2;L;Z;i;y;", "SHChangeNotify", "CaptionNoBorder", "GridDrawGlyph", ")TEnumerable8", "OnError", "X-21_", "3\"414_4l4", "Function and DLL name: %s@%s", "OnShortCut\\oG", "ResInstance", "Uh~Uo", "ButtonHot", "kwscBorder", "GetSaveFileNameW", "8 848K8S8a8v8", "8(8:8T8b8q8", "claPapayawhip", "?G?g?", "Signature is malformed", "GetUserDefaultLangID", ";D$Dw", "TTextLayout", "Trunc", ": :/:a:", "; ;.;6;D;V;f;n;|;", "WTPair", "AppId", "6#6F6[6i6}6", ";,;:;N;[;c;q;", "Listener", "Setup.DotNetFunc", "Winapi.D2D15", "2 2(20282<2@2D2H2L2P2T2X2\\2`2d2h2l2t2", "? ?$?(?,?0?4?8?b>", "tebSpecialGroupCollapsePressed", "ResetActiveDesigningStyle", "alNone", "?4?X?", "TryAsOrdinal", "ETDictionary.TItem", "GetBounds", "3,3:3D3L3\\3k3z3", "PopupComponent", "<;=B=", ";D$D}", "THelpType", "FModalLevel", "THTTPCompressionMethods", "TextFormat", "FAutoCompleteDelay", "Sp_^[]", "tttT7", ":8:v:}:", "121H1]1k1~1", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$56$Intf`'@", "QuoteChar", "PreemptiveAuthentication", "z:IpJ", "FActiveItem", "/TList.arrayofT", "tebNormalGroupCollapseHot", "4H6U6v6", "Uh.qc", "gfInertia", "7*8Y8g8{8", "%Sectigo Public Time Stamping Root R46", "?2?^?", ">(><>^>n>", "<&<.3", "4+4=4L4T4b4u4", "RaiseOuterException", "8,8>8T8k8", "L;.U[", "ParentHandle", "WorkAreaTop", "ttbTrack", "WinHttpQueryAuthSchemes", "5$5?5[5t5", "FindClassName", "OnValidateServerCertificate", "> >%>3>8>F>K>Y>^>l>q>", "4\"6V6", "6=6E6^6", "incorrect header check", "VisibleDockClientCount`", "sfCheckBoxTextNormal", "7 707@7O7U7g7p7", "9(9A9Z9m9", "808C8Y8n8", ">C>N>T>d>l>t>|>", "tbCheckBoxCheckedHot", "FSender", "Uh}[T", "HitTestThemeBackground", "1:2x2", "tbCheckBoxExcludedHot", "3&383M3`3d3k3~3", "kwscNoBorder", "DrawingStyle", "ibm775", "?ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$2$Intf`'@", "ktfToolItemTextHot", "ArrayType", "?(?@?N?d?t?", "IsCustomStyleActive", "#IComparer`'@", "GetParameters", "TIHDRData", "!TList.TEnumerator5", "userinfoorg", "7+.:\"cP", "GETUSERNAMESTRING", "ShowBaseNameInsteadOfUrl", ";\";^;t;", "StringScanner", "ListItemTextDisabled", "CreateObject", "=#=*=1=8=?=F=M=T=[=b=i=p=w=~=", " TEnumerable'", "SubMenuImages", "/NoCloseApplications", "ButtonInactiveForegroundColorpHA", "FAutoSize", "T$$uv", "=!=-=A=O=^=u=", "NuPSDebugger", "52565:5V5]5d5k5x5", "TThreadList", "PlayEnhMetaFile", "0C0k0", "1'121:1H1V1g1", "3i3m3q3u3y3}3", "2;2X2z2", "dmPaused", "function Get8087CW: Word;", "pdispVal", "FThumbSize", "GetUpdateRect", "FBiasWithDST", "FMenuPush", "AReadProc", "@ScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$1$Intf`'@", "04080S0W0t0", "Unexpected end of expression while reading string constant", "?#?1???H?P?", "Content-Language", ":4;v;", "AChildPos", "=4=H=P=a=o=w=", "VSingle", "9L$Pt8", "FGestureManager", "ktxoHorizontal", "PTypeInfol", "\\:l:p:t:|:", "TFont&", "SetPropW", "7 7$7(7,7074787<7@7D7L7", "4-4>4]4y4", "claSalmon", "FShowArchiveInsteadOfFile", "clDefault", "srRight", "FOffset", "3+3<3J3R3`3q3", "DeleteResource", "5(5C5G5`5j5", "rt32Bit", "Winapi.ObjectArray", "#TArchiveExtractBaseCallback.TResult", "DockClient", "6:6B6J6R6Z6b6j6r6z6", "7 7$7(7,7D7P7T7X7`7d7h7l7p7t7|7", "8(8U8Y8", "AFileDialog", "tcDropDownButtonNormal", "EndUpdate", "HTTP_1_1", "0<0H0L0P0T0\\0d0h0l0p0t0x0|0", "FHorzDownState", "Uho5n", "030A0O0`0", "TIAccessibleC", "?+?7?D?T?X?\\?d?l?p?t?x?|?", "TUxThemeTextLabelElements", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "clMoneyGreen", "< <$<(<,<0<4<8<<.TItemArray", "C$PVj", "TCustomCardPanel4", "R$_^[Y]", "9*909@9H9P9X9\\9`9d9h9l9p9t9x9|9", "TlyUU)", "MYSTYLE1_DARK", "iso-8859-14", "ServerCredentials", "IsWow64Process2", "iso_8859-8", "GetReturnType", "scTrack", "%TEnumerable'", "565D5T5m5", "96;L;S;m;", "8<8Q8a8m8s8", "RestoreTopMosts", "1 121D1L1Z1i1", "TChangeScaleMessage", "macgreek", "Row_Buffer", "/TDefaultLoginCredentials.LoginEventUsrPw$0$Intf`'@", "Found no files to extract.", "RegisterStyle", "FFrameActive", "tdnbInsertPressed", "Uh6,d", "tkInteger", "=;=n=", "9t$ vT", " name=\"Microsoft.Windows.Common-Controls\"", "LParam", "$TArray", ";-;G;Y;k;", "ktfEditBoxTextDisabled", "Archive extraction mode: %s", "GetThemeFilename", "Cannot drag a form", "SelectObject", "IconImage", "tpDockPanelPinNormal", "?/?B?J?X?f?z?", " t>mS", "Running Exec parameters: ", "ComponentState", "8@TList`1.Pack[1]$ActRec", "ScaleFactor", "tpDownHorzPressed", "=B=M=T=d=l=t=|=", "FMDIPrevClientProc", "535;5?5U5]5z5", "kgfaBottomLeft", "FPopupPoint", "IInterfaceComponentReference`'@", "=:>Y>", "Setup.MainForm", ". %s is empty+Out of memory while expanding memory stream)%s has not been registered as a COM class", "CONVERTPERCENTSTR", "textlabel", ".TKeyCollection", "sfHandleMessages", "888b8", "csCreating", "?&?-?4?;?B?I?P?W?a?", "/DEBUGWND=", "Software\\Microsoft\\Windows\\CurrentVersion", "System.SysUtilsL", "1 1.1E1Z1h1w1", "PathLabell", ":TNetEncoding.:1", "_SECURITY_ATTRIBUTES", "mn-Mong-CN", "PolyBezierTo", "WNetGetUniversalNameW", "VarArraySet", "9/:_:r:", "<1<5", ": :V:", "EndMenu", ">%>;?", "4$4(4,444<4@4D4H4L4P4T4X4\\4`4d4h4u4", "FCanvas", "&TEnumerableHGe", "9&9B9P9d9~9", "8'9\\9", "FLastUpdateTime", "FSysColors", "efTopLeft", "TMemoStrings", "3\"4)4\\4a4", "FLocalCredential", "0-0;0L0[0c0q0", "Setting NTFS compression on file: %s", "8#8'8+8/838", "TEditStyleHook8", ";B;V;^;|;", "S(_^[", "5(6m6", "tiString", "CreateAnonymousThread", "h", ":#:':+:/:3:7:;:?:C:G:", "3]4o4", "GetKeyName", "FMenuActive", "Uh6fP", "UhWyY", "0/131Z1a1h1o1v1}1", "FFiles", "teControlBar", "3%3M3k3", "=A=_=j=", "FRegProcs", "TScaledGraphicDrawer(", "9g9{9", "FBevelEdges", "Certificate", "<*<2,>4><>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>", "$TEnumerable'", "PopupMode", "Enabled", "< <(<0<8<@5>G>Y>l>", "1:1I1g1n1", "ImageHeight", "9$9(9,94989<9@9H9P9T9X9\\9`9d9h9l9p9t9x9|9", "8Compression.Base", "/NoIcons", "UnInitialize", "OnExpanded\\oG", "2.3O3", "tdnbCancelHot", "CreateReturn", "HKEY_DYN_DATA", "DefaultItem", ":(:6:C:U:b:j:x:", "_CRYPTOAPI_BLOB", "TSeSystemButton", "8$888Q8Y8g8z8", "mvPublic", "sfButtonTextPressed", "tbsRoot", "TSysLinkType", "SetReplaceWithColor", "TContainedActionLink", "TFillStyle", "VertDownRect", "TArray", "5 5$5(5,5054585<5@5D5X5f5j5", "? ?$?,?4?8?", "skLineRight", "FReserved", "AUserData", "%s on line %d", "8IEnumerable", "function MulDiv(const Number, Numerator, Denominator: Integer): Integer;", "MTDictionary.TValueEnumerator;", "tsDownHorzNormal", "kedsFocused", ";5|r^", "FUserInfoPage", "TThemedTaskDialog", ":(:8:<:@:H:P:T:X:\\:`:d:h:l:p:t:x:|:", "function ExecAndCaptureOutput(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer; var Output: TExecOutput): Boolean;", "TThreadProcedure`'@", "9TDictionary", "'TList&", "trChevronVertPressed", "claDarkslategrey", "RegisterPropertyHelper", "%TEnumerator(", "LangCombo", "0J1$242", "WATAUAVAWH", "2)3U3`3", "~Bn;H?", ";.;<;O;_;m;", "f;,$u", "rcSmall", "OEMConvert", " !\"#$%&'()*+,-./0123", "FBoundsRect", "advapi32.dll", "OnTerminate", "ConvertWriteStream", "TIcon&", "9-9@9N9b9o9w9", "<(===K=c=w=", ";-;>;T;e;z;", "function ", "8F8Y8i8", "Percent", "FUpdateCount", "FFloatingDockSiteClass", "AutoHotkeys", "?%?-?;?M?d?r?", "8.8f8", "WriteProfileStringW", "1*222r2", "Uh!Rc", "> >5>G>L>h>", "5'6b6", "AddRecordedGesture", "9-9C9`9v9", "#3.3W3m3", "?%?4?H?c?q?", "kmgRoll", "OTObjectDictionarylcM", ",TList.TEnumerator", "tsDownHorzDisabled", ">9?N?\\?q?", "ADispose", "TTaskDialogFlag", "clBlanchedalmond", "TComponentEnumeratorpSH", "FInterval", "SetGraphicsMode", "IsEmptyh", "FUseVisualStyle", "windows-1251", "3-353=3T3i3q3", "BitmaplLA", "?M?X?`?p?x?", " h(m_", "akhrrr", "2'2=2N2h2v2", "ImeName", "twVertScrollDisabled", "? ?$?(?,?0?4?8?.TPairEnumerator", "ColorType", "ModalResult", "tePage", "+<,<)tM", "0Q1\\1~1", "283G3e3", "TransparentColor$t^", "OnDragOver\\oG", "6#606", "Ce t1", "iso_8859-8:1988", "IsControlDPIIsolated", "7'7/7=7K7[7c7t7", "UhK*n", "TThemedTrayNotify", " IEqualityComparer`'@", "doVertical", ".TArray", "AIntToIdent", "HandleNeeded", "1!1:1Q1m1s1|1", "tsDownPressed", "diDesaturate", "GetIsPanning", "PropCount", "ComparerL'J", "Flags,", "@[utc", "ErrorMargin", "$TList&", "'TCollectionNotifyEvent", ":%;<v", "1%2)2-212?2M2Y2h2", "ResizeData", "TSizeConstraintsx;Q", "SafeArrayGetElement", "thHeaderItemNormal", "{pf32}\\", "ValueExists", "Fraction", "grfLocksSupported", ":\":6:C:K:Y:k:|:", "XTDictionary.TValueEnumerator;", "4TEnumerator(", "t9j7j", "EInOutError", "9FD#C", "91:9:J:T:w:~:", "FOnVerificationClicked", "List([K", "JumpID", "ITDictionary.TPairEnumerator(", "eeSunkenOuter", "tsiAudioHot", "+++C\"", "FVersion", "7(7:7M7U7c7q7", "6,6A6T6X6_6r6", "TIntfMethodEntry", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$12$Intf`'@", ">7?E?", "tfShowProgressBar", "2&2<2Q2j2", ">/>=>J>\\>q>", "&TCollectionNotifyEvent", "W$CNu", "< <$<(<,<0<4<8<<<@->E>Y>a>r>", "UhwgP", "6.666G6U6]6k6x6", "Unexpected End Of File", "ClientWidth", "/U1.M", "8TArray", "\\TDictionary.TValueEnumerator;", "CompareOp", "function PostBroadcastMessage(const Msg, WParam, LParam: LongInt): Boolean;", "cp950", "(TList.arrayofT", "TBZFree", "TCustomImageList", "Popup", "2+2A2R2g2x2", "8%868O8`8r8z8", "=/=C=U=f=", ">%>->6>M>Y>", "System.SysUtils", "8J9R9\\9f9k9p9z9", " The existing file appears to be in use (%d). Retrying.", "VTDictionary.TKeyEnumeratort", "FDisplayName", "FFileDialog", "CURRENT_USER", ">&>+>7><>A>M>R>`>e>j>v>{>", "Images@6Z", "PrevDeselectedComponents", "1!1(1/161=1D1K1R1Y1`1g1n1u1|1", "6%6-656=6E6M6U6]6e6m6u6}6", "Uhg,L", "EndOfList", "Inno Setup: Deselected Components", "-IComparer`'@", "Invalid Method value", "TClass|", "GetStyleConfig", ">0>8>F>T>d>l>z>", "Out of Global Vars range", "Uh@vc", "khssFirst", "=S>r>}>", "071d1", "Indirect", "pfPaeth", "Runtime error at 00000000", "s<+st+sl", "FInnerPageh", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$38$Intf`'@", "5(6>6O6c6k6|6", "PRQhx", "7#767H7P7^7m7", "UseQualifiedNames", "2 20282F2]2k2|2", "6@6P6T6X6`6h6l6p6t6x6|6", "5D5g5", "020L0c0x0", "SetAction", "4B5O5a5~5", "2,2@2S2h2", "@GetPackageInfoTable", "GetElementDetails", "RegisterEventPropertyHelper", "BeginMerge", "6,7U7Y8x8", "<<6U6Y6]6a6w6", "7&8*8K8O8j8n8", "0+0L0Z0", "2P2T2X2\\2j2x2", "deflate", "fkHandle", "bsCommandLink", "Initialized", "FWriteMethod", "=\"=7=E=X=q=", "TSeStyleSysColors", "7%757D7", "THandleObjectArray", "ktfTabTextActiveHot", "fsNaN", "GetStatusCode", ">&>2>:>F>b>f>s>", "rTDictionary.TKeyCollection;", "IsButtonDefined", "Proxy-Authorization", "5%5-5;5N5_5v5", "CLSID2", "='=e=z=", "6 6$616G6K6R6d6l6t6|6", "Invalid characters in pathWThe given \"%s\" local time is invalid (situated within the missing period prior to DST).$No help viewer that supports filters", "TMarshaller.TDisposer$HB", "FOnFindComponentClass", "\"Check\" parameter with no CodeRunner", "1(1;1R1`1w1", "WParamHi", "ChangeBiDiPosition", "ktrbdsNormal", "1TFormStyleHook.TMainMenuBarStyleHook.TMenuBarItem", "file-name", "kbidsHot", "SetCustomHeaderValue", "4?4M4\\4s4", "TOnDownloadNoProgress", "BrushpHA", "diMonochrome", "676E6", "747E7W7_7p7", "4R4h4u4", "TEnumerable'", "WWW-Authenticate", "ElementColor", "sfEditBoxTextNormal", "FHSliderState", ">\">4><>J>X>e>m>{>", "6.6<6^6p6~6", "AResDataSize", "wrTimeout", "LoadImageW", "$YZ_^[", "GetContextMenu", "claNavajowhite", "CreateNewDirectory", "D$8;D$", "6TDictionary.TKeyCollection\\Md", "\\TEnumerable>", "6%7)7J7N7i7m7", " version=\"1.0.0.0\"", "ParentShowHint", "6X6m6", "380118235959Z0W1", "TSeTreeItemInfo", "< <,<3.TValueCollectionH", "FFinishedPage", "dsBitfields", "u#9L$@u", "TCustomComboBoxStrings&", "saDefault", "TChunkIHDR4n^", "3(3/343;3@3G3L3S3X3_3d3k3q3y3~3", "TInterlaceMethod", "lTEnumerable>HCM", "Uh$Vn", "878F8N8\\8j8", "3XF@?", "I/O error %d", "Uh_wp", "QLFMu", "invalid stored block lengths", "=?=R={=", "?7?R?q?", "7G7t7", "EXITSETUPMSGBOX", "<&<4$>[>", "IsSet", "Uh|UK", "2-2;2N2d2u2", "*TEnumerator", "6*686@6N6\\6p6x6", "function CreateOutputMsgPage(const AfterID: Integer; const ACaption, ADescription, AMsg: String): TOutputMsgWizardPage;", "CombineRgn", "8Y8q8y8", "ttbGroupCount", "TSeGridItemInfo", "taCenter", "tebExplorerBarDontCare", "1*2`2", "=!=)=1=9=A=a=v=", ":TInstHashMap.:1<", "6/6B6P6f6y6", "TECDSAPublicKey@", "WelcomeLabel2$", "TUxThemeStyleElements", "CompiledScriptDebugInfo", "001m1", "TArchiveOpenCallback", "K6eH9", "claMaroon", "Source file corrupted: ", "FColor", "001?1", "DefaultUserInfoSerial", "8!9B9i9r9", "SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v1.1", "3C3j3I4n4", "5(505[5", "Read Error", "TRttiInterfaceType", "TSeEditSubclass", "I)Bq1", "SOFTWARE\\Microsoft\\.NETFramework\\Policy\\v4.0", "kedsHot", "Uhs=U", "FInch", "PrefixType", "4&4<4M4f4n4|4", "Skipping RunOnceId \"%s\" filename: %s", "< <$<(<,<0<4<8<<<@", "efBottomRight", "", "Data after end", "STRTOVERSION", "4$4<4", "System@", "HandlerEvent", "FDefaultMonitor", "Round", ">J>_>p>", "Winapi.ActiveX", "UhOen", "CommandLinkHintl", "FDisabledColor", "TSetupEncryptionKey ", "&TList", ";0;E;Y;o;", " TScriptRunnerOnDebugIntermediate", "< <.<@ Strings) {", "FinderClassl", "pmCopy", "twHorzScrollPushed", "G`PSj", "4+454?4P4\\4h4y4", "EventInfo", "RDGNu", "FStylusHotImageName", "=-=5=C=S=g=o=}=", "6>6G6", "243D3L3T3\\3`3d3h3l3p3t3x3|3", "Uhp1l", "D$LtZ", "System.ZLib", "bcTrue", "TextMarginLeft", "", "IsReadable", "4/4E4^4u4", "IEnumerable", "csDesigning", "Unavailable data", "3,3;3I3b3p3", "FScaledBuffer", "FExpandButtonCaption", "04181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "GetThemeSysColorBrush", ">)>:>O>W>", "5Y6|6", "oBrowseFunc", "Enhanced Metafiles", "AWindowHandle", "DTQueue.TEnumerator", "Getting last modified date of %s.", "QPFOu", "Current\\LI", "upbutton", "bdRightToLeftNoAlign", "\"Sectigo Public Code Signing CA R36", "<,<;.TItem", ",StringScanner", "ktisRightFirst", "iso_8859-3", "tbVertical", "0%050E0V0", "Accept", "ErrorFmt", "3 3$3(3,3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3}3", "LOO355E", "TFilter", "> >(>0>O>j>", "efFlat", "MsgWaitForMultipleObjects", "ITDictionary.TValueCollection8", "UhzLn", "0&0B0W0e0z0", ">%>A>I>c>r>z>", "FPath", "/NoForceCloseApplications", ":+;\\;", "BinarySearch", "8+8:8N8^8f8t8", "4,5P5", "2-2C2Q2j2u2", "<,<: ", "November", ";&;.;@;Y;t;", "teTreeview", "UhSlc", "FMerged", "RaiseLastError", "Deleting empty registry key: %s\\%s", "IsBarDockDefined", "8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "4$4(4,4044484<4@4D4H4L4P4p4", "clSaddlebrown", "9IEnumerable", "4%585p5", "0x1|1", "TURLResponse.Schedule$ActRec", ":F;f;};", "FPrevSibling", "TStyleColor", "IsTreeDefined", "PopupMenuItemTextSelected", "kcdsMixedPressed", "010F0", "AWeight1", "tgEllipsisButtonNormal", "T$ ;T$,", "TMultiWaitEvent.TMultiWaiterp6A", "TRttiInstanceFieldClassic6", "ttTabItemBothEdgeNormal", ">(?@?Z?", "InstanceSize", "FOnException", ":B;G;p;", "Invalid variant operation", "; =3=", "2$2;2I2\\2s2", "182E2R2c2", "Uh{JU", "btnBack", "PopupParentp", "CatgeoryButtonsSelected", "Uh^Ql", "DrawLine", "FCheckWidth", "2,2>2P2^2o2", "sma-NO,sma,se", "SHA256", "AllocStringAsUnicode", "@K:GKu", "September", "VarDiv", "505>5Q5g5x5", "twMDICloseButtonPushed", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$33$Intf`'@", "030J0f0y0", "6%636B6P6g6u6", "3!3/3?3P3a3t3", "@e@u*", "void __fastcall AddStrings(const System::UnicodeString *Strings, const System::NativeInt Strings_High,", "InvalidCert", "function GetShortName(const LongName: String): String;", ".TKeyCollection;", "3P5s5", "UserInfoOrgLabel", "^0e0s0", "? ?(?0?8?", "kwhtTopLeft", "ComponentIndex", ">#ut3", "VerticalAlignment", "EFCreateError", "5 5$5(5,5054585<5@5D5H5L5Y5o5s5}5", "System.Generics.CollectionsP", "=F=J=N=R=V=Z=^=b=f=j=n=r=:>>>B>F>J>N>R>V>Z>^>b>f>j>n>r>v>", "222:2U2|2", "WIZARDFORM", "Point0", "EnumCalendarInfoW", "2'2:2P2a2", "TRttiPool", ";P|t!", "CreateDuplicate", "FClientCertPath", "TNewStaticText!FSelectStartMenuFolderBrowseLabel", "IsGroupTransparent", "FGrabberSize", "(TEnumerator$$P", "FObjects", "7&7E7d7j7", "OrigBaseUnitX", "E7`p[", "TGetDeltaStreamsEvent", "Uh:^N", "userpf", "GETOPENFILENAMEMULTI", "ResolveReference", "D7q/;M", ">\"?7?E?W?f?n?", "GetThemeColor", "GetCurrent", "function DecrementSharedCount(const Is64Bit: Boolean; const Filename: String): Boolean;", "ShutdownBlockReasonCreate", "<)<7(", "3>3Q3d3x3q4", "tgCellSelected", "TRadioButton", "Encode_Buffer", "2 30363H3V3g3", ";F;P;U;[;a;l;z;", "JTDictionary.TItemArray", "0'050L0T0b0p0", "RButtonsRect", "An attempt was made to call the \"%s\" function from outside a \"Check\", \"BeforeInstall\" or \"AfterInstall\" event function belonging to a \"[Files]\" entry with flag \"external\"", "UhQ+t", "5'5=5K5_5u5", "FClientHeight", "TransactNamedPipe", "tfFlyOutLinkNormal", "ClearUndo", "TSeLinkStyleObject0", "7(7D7", "DefineOpenArray", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4h4p4x4", "HelpType", "FComponentStyle", "4TList.arrayofT", "=<=@=D=\\=", "tfFlyOutLabelNormal", "FAutoDropDownWidth", "TRttiSetType", "6'6O6l6", "6&696A6O6]6q6", "<$<(<,<0<4<8<<<@(", "EFOpenError", "RegEDX", "z_stream8", "EConvertError", "DeleteValue", "8:9M9", "< <$<1O?\\?v?", "twSmallFrameBottomActive", "889=9", "4 4$4(4,4044484<4@4D4P4X4`4h4l4p4t4x4|4", "VertSlider", "constructor ", "function GetTempDir: String;", "TWinHTTPRequest]", "TCommonDialog,", "Type Mismatch", "ITDictionary.TKeyEnumerator", "EvalComponentOrTaskIdentifier", ":\\;`;d;h;l;p;t;x;|;", ":1:=:L:", "; ;$;(;,;0;4;8;<;@;D;R;Z;l;~;", "9(90989@9D9H9L9P9T9X9\\9`9d9h9l9p9t9", "FOnButtonClicked", ";!;@;L;P;T;X;`;h;l;p;t;x;|;", ";$;2;J;Y;a;p;", "FAsSWord", ";TEnumerator4", "=#=0=<=", "3'3=3O3i3q3y3", "ttsHyperLinkTextHot", "kticComboButton", "ScrollBar", "t(f;{", "clChartreuse", "8*8D8Z8k8", "CustomHint", "teTrayNotify", ";,;?;j;", "claPowderblue", "EVariantTypeCastError4NC", "374D4)666", "BeginOptions", ":\":&:@:H:L:f:n:", "StretchpHA", "8#u]h", "3v3Z4z4", "WaitForMultiple", ":TDockTree.:2", "5%595A5R5`5h5v5", "1$2D2a2", "3M3Q3x3", "\"TEnumeratort$O", "FontPressed", ")TList.ParrayofTL", "=->>>", "clWhitesmoke", "TPSTypeRec_StaticArray(", "Winapi.IpExport", "GetDimension", "FWRequest", "ks_c_5601-1987", "?ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$7$Intf`'@", "dwFileAttributes", ">TList.arrayofT", ":+:O:T:Y:k:", ";J", "1D1T1\\1d1l1p1t1x1|1", "?3?y?", ":_it@", "p>", "8P9n9", "Ctrl+", "4 4,404E4M4g4o4", "TFileTypeItem:", "8!808?8N8b8u8{8", "biSize", "sphpDefault", "7%777I7Q7_7n7", "SupportsClipboardFormat", "function ExtractFileName(const FileName: String): String;", "DragUnlock", "]c!T/", "1*121D1[1m1", "/TEnumerable'", "FOnRadioButtonClicked", "PByteArray", "0;0?0f0m0t0{0", ";3;A;P;`;", "0 10181@1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "TArray", "FVSliderState", "toFlicks", "5/6j6", ":*:2:::B:J:c:x:", "Setup.UninstallProgressForm", "FScrollLines", "GetFilterName", "\"TArray", "ModalLevel", "skPopupMenuItem", "?*?2?C?S?[?l?", "TStrings", "FPaintBuffer", "KXQRP", "9(9;9A9N9`9", "<$zw)f", "h", "FromVariant", "csDesignerHide", "ImageList_Add", "SaveKey", "1=1I1", "SplitType", "Uh2vn", "6 6$6(6,696M6U6]6e6s6", "2o3s3w3{3", "Property is read-only", "function ChangeFileExt(const FileName, Extension: String): String;", ":A:d:", "@0^[YY]", "TURI$", "Wrapable", "818B8R8d8m8", "TMessageManager.TListenerData$", "4Q5^5u5", ";I;i;", "Comparerp", "claSilver", "tspMoreProgramsTabNormal", "FControlsFlipped", "3#313D3\\3`3|3", "=U=Y=]=a=e=i=m=q=u=y=}=", "ZTDictionary.TValueCollectionHUM", "RTGNu", "tcBorderHot", "OnDllImport", "OnFileOkClick\\oG", "GetWinMetaFileBits", "<'<+=Q=W=f=y=", ":TDictionary.TKeyCollection|1W", "FOriginalParentCalcType", "TEnumerator,", "D$,SVP", "&TArray", "9-9@9N9V9d9t9", "TIdleEvent", "3N4,5>5", "HandleObjs", "1#202>2K2Y2d2j2", "TSELECTLANGUAGEFORM", "PFixedUInt", "D$,Pj", "FCommonStartup", "function GetSHA1OfUnicodeString(const S: String): String;", "BrowseLabel", "808G8]8e8s8", "System4)W", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$5$Intf`'@", "ExternalThread|", "0)0<0S0d0w0", "function LoadStringFromFile(const FileName: String; var S: AnsiString): Boolean;", "SaveAsMemory", "2L2]2o2", "0&0.060>0F0N0", "uPSR_stdctrls", "TContainedAction6", "9,:9:", "bvRaised", "t@G;}", "040J0N0t0", "TPersistent", "FOnKeyDown", "msctls_statusbar32", "AdjustSize", "5X5_5", "Iterations", "5H6r6", "9&9.969>9F9N9V9^9f9", "\"FUnlimitedWorkerThreadsWhenBlocked", "skUnicodeString", "TSysTooltipsStyleHookH", "<*<:>", ".TEnumerable'", "fsCreatedMDIChild", "M", "fqClearType", "tebNormalGroupHead", "GenericGradientBase", "AuthTarget", "262D2S2f2", "2@2n2", "D$$)C", "DownloadTemporaryFile", "Smooth", "FirstVisibleChild", "> >$>(>,>0>4>8><>@>M>d>y>", "ttbThumbLeftHot", "RecreateWnd", "ttTopTabItemLeftEdgeDisabled", "biWidth", "Not a solid color brush", "unknown header flags set", ";];i;v;", "NewFolderName", "FAllowTesting", "8)8=8_8g8o8w8", "DoubleBuffered", "ttbThumbVertNormal", "TPSExceptionHandler'", "1\"1*1;1I1Q1`1q1u1", "0(0;0R0`0w0", "@.:C.", ";*", "EVariantDispatchErrorxUC", "?@?D?h?l?", "4b5j5{5", "fUnit", "bkNone", "TSysToolbarButtonStyle", "DrawIcon", "9d9h9", "kbdsChecked", "kticSpace", "Thread creation error: %s", "dsTransparent", "5#5<5J5_5", "4*5i6", "7)7=7\\7j7}7", "303>3P3_3g3x3", ":/:7:T:", "eeBump", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0u0", "ItemsJ", "2!2/2?2G2U2j2z2", ":^Etf", ";>.TItem", "J%fgg", "TCustomComboBoxStrings", "EmptyClipboard", "APosition", "administrative", "Unregistering 32-bit type library: %s", "5(5@5D5[5b5l5p5", "8+8D8]8w8", "TSeMemoSubclass", "C(PVW", "tdnbCancelUpdatesNormal", "===D=K=R=Y=`=g=n=u=|=", "PThemedElementDetails", "NumbersOnly", "CloseClipboard", ";<;D;g;", "8#838D8U8l8", "FOnActionExecute", "kbxdsDisabled", "Dest filename: %s", "Download", "tdnbNextDisabled", "function SendNotifyMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): Boolean;", "4(4;4@4s4", "bfNone", "[>a>y>", "System.Generics.Collections0QH", "GroupTreeRename", "ID2D1Resource`'@", "4!424;4d4m4", "procedure OemToCharBuff(var S: AnsiString);", "ASubItemFontStyle", "7*808X8m8|8", "ExplicitLeft", "SelectDiskLabelh", "Vcl.Styles", " bytes: ", " Vcl.CategoryButtons", "AAutoSizeExtraWidth", ";S;_;k;u;", "Vcl.ExtCtrls+", "List,", ";#;+;<;q;u;", "clDarkmagenta", "4 4$4(4@4Q4U4p4", "csDropDownList", "uFlags", "Visible\\oG", ":8;\\;", "60646l6y6", "GestureIDDFQ", "9-949;9B9I9P9W9^9e9l9v9", "Unknown Identifier", "FBitmaps", "Will restart because UninstallNeedRestart returned True.", "clBurlywood", "RemoveInstItem", "0=0L0[0j0[1m1", "<)<7&", "F(D:9", ";TDictionary.TPairEnumerator0:W", "BCryptGenerateKeyPair", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$44$Intf`'@", "Unable to open Search\"Unable to find a Table of Contents$No topic-based help system installed", "*TList.TEmptyFunc`'@", "TThemedRebar", "DropTarget", "CreateResHelp", "FOuterNotebookPage", "=*=w=", "3 3+3E3P3i3{3", "TEndian", "6 6$6(6,646<6D6~6", "TNewComboBoxD,^", "showCmd", "FLastSuspendTick", "TThemedDatePicker", "CreateAssemblyScavenger", "DELETEINISECTION", "$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)", "DTDictionary.TItemArray", "RemoveControl", "8*828H8P8k8", ":$:(:,:G:O:g:k:", "OKButtonx", "System<", "FOrder", "", "$ZXsB", "3,3C3]3k3z3", "twMDIMinButtonPushed", "TDockZone", "FlatSB_GetScrollInfo", "kwbCustom", "MinButtonRect", "4*4s4", "tinfo", "cp1256", "tmbSeparatorNotChecked", "5)515J5R5r5", " /LOG", "[TDictionary.TPairEnumerator;", "606I6M6h6x6", "7i8'9p9", "4A4Y4o4", ">%>B>J>k>s>", "scListView", "tmbNewAppButtonChecked", "8 9(9H9P9", "FProcNo", "4+494I4\\4n4v4", "4 4$4(4,4D4T4X4x4", "FDiskSpaceLabel", "FBaseUnitX", "212H2V2m2", "2%2,232:2A2H2O2V2]2d2k2r2y2", "=TEnumeratorxHg", "AddObserver", "3 3$3,34383<3@3D3H3L3P3T3X3\\3`3d3h3l3p3~3", "", "Scan line index out of range!Cannot change the size of an icon%Cannot change the size of a WIC Image", "> >$>(>,>0>4>8><>@>D>", "0*3<3P3", "total_in", "SourceLine", "2*3z3", ":4:p:", "6&727A7U7\\7", "WantChildKey", ":!:k:", "5p6%7", "< <.`'@", "FAuto", "UhXNc", "GETDATETIMESTRING", "828?8P8r8", "2F2S2", "TransparentColor", "fHour", "1!2*2m2", "UhbhJ", "?!?4?X?\\?x?", "SysFreeString", "Unknown method%Expected return address at stack base%Scheme \"%s\" already registered for %s$Credential without user and password+Platform-dependant function not implemented", "ifDispatch", "erNoMainProc", "wReserved2", "=4>l>", "uPSDebugger", "?(?,?0?4?8?.TItem", "ExtendedUI", "SdYZ_^[", "ShadowColor", "Rebuild", "Shared.CommonFunc", "TStyleHook", "function DownloadTemporaryFileDate(const Url: String): String;", "FXOffset", "FOnFindMethodInstance", "RadioButtons", "TMenuChangeEvent", "LoggedTaskDialogMsgBox returned an unexpected value. Assuming Abort.", "%s, ClassID: %s", "hStdError", "tsUpperTrackVertHover", "tsiAudioNormal", "ttTopTabItemBothEdgeFocused", "4\"4&4*4.42464:4>4B4F4J4N4R4V4Z4^4b4f4j4n4r4v4z4~4", "tiNot", "6^7m7", ">\">*><>W>q>", ":;:|:", "TThemedExplorerBar", "2.2;2H2\\2l2-4e4", "FUserData", "1\"1'1,171<1A1L1Q1V1a1f1k1v1{1", "Unexpected CustomDestName flag", "RightToLeft", "\"AppId\" cannot exceed 128 bytes (encoded)", "mkConstructor", "OldDPI", ":+:9:S:q:", "GetPixels", "LoadTypeLib", "7-7S7{7", "AppVersion", "4\"41474I4R4n4}4", "&PL@^hD", "DoISSigVerify$1$Intf`'@", "9$9/959>9G9\\9d9l9):0:", "6-6@7", "FParent", "WaitMessage", "=ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$0$Intf`'@", "ENoMonitorSupportException", "f;ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$4$Intf`'@", "FontColorpHA", "C,^[]", "ktfStaticTextDisabled", "&.TPairEnumerator;", "tsUpperTrackHorzNormal", "twSmallCaptionInactive", "csDestroyingHandle", "EObjectDisposed", "=\"=0=@=R=Z=h=u=", "INIKEYEXISTS", "archive corrupt", "/Password=", "8,8=8S8c8w8", "HKEY_CLASSES_ROOT", "LastExObject", "SetProcessDEPPolicy", "NumUninstallRunEntries", "procedure DeleteIniSection(const Section, Filename: String);", "E$PVSj", "Uh6r@", "DoISSigVerify$ActRec", "EXPANDCONSTANTEX", "8\"808F8[8i8|8", ";!;/;=;Q;Y;j;x;", "Object lock not owned(Monitor support function not initialized", ">(>3><>l>w>", "3%333B3P3g3u3", "FSecureFailureReasons", "uQ9D$.TPairEnumerator;", "141T1d1x1", "KernelTime", "tgClassicFixedCellPressed", "AsObject", "AttribType", ">:>Y>", ":/:=:M:_:g:u:", "?\"?*?;?F?N?_?s?", "AutoDropDown", ":6;:;>;B;P;^;m;|;", "trChevronPressed", "<#<'<+.TKeyCollection", "$TEnumeratorP&E", "TMessageManager.TListenerList&", "Error reading %s%s%s: %s", "SuspendThread", "DULJ*", ":K:~:", "%s Log %s #%.3u.txt", "TSizeConstraints7", "GetThemeFont", "ToolWindow", "5u6~6", "GetElementRegion", "OnDownloadNoProgress", "tkClass", "TSeButtonSubclass", "VersionMajor", ">E>U>", "3TList.TEnumerator", "tspMoreProgramsTabHot", "4TList>&", "TSeHeaderSectionInfo", "C@_^[", "='=,=", "is-*-uninstall.tmp", "9\\:j:", ";+;K;\\;q;", "FFreeOnTerminate", "ExtractTemporaryFiles: Pattern too long", "TStreamCapabilities", "sfGroupBoxTextDisabled", "=,=>=P=e=x=|=", "TSetupStep", "lpTitle", "Invalid image size", "i0123456789abcdef0123456789abcdef", "vaString", "Tuesday", "7%7:7O7`7v7", "Put303", "bsSingle", "<4<8<<<@(", "?/?6?=?D?K?R?Y?p?t?x?", "4-4F4b4}4", "8Vcl.ToolWin", "TRegDataType", "teHeader", "1 1$1(1,1014181F1X1v1", "procedure IncrementSharedCount(const Is64Bit: Boolean; const Filename: String; const AlreadyExisted: Boolean);", "2%2:2H2Z2t2", "FClientGuid", "GetObject", "Opacity", "UhvkJ", "Setup.DebugClient", "3)3-3f3q3|3", "procedure CharToOemBuff(var S: AnsiString);", "ITDictionary.TValueEnumerator;", "6>6G6Z6b6j6x6", "7.7?7L7T7e7t7|7", "CreateWithoutCopy", ")TList.arrayofT", "Winapi.DxgiFormat", "iso8859-5", ">H>i>", "5\"50585F5T5", "TVarRec", "kmicSpace", "= =$=(=,=0=4=8=<=@=D=", "WndProc", "UhceJ", "SetEntriesInAclW", "Uht>f", "tmpbEjectHot", "Redirections", "shlwapi.dll", "LoadFromResourceID", "1#1'1=1e1", "FOnDataObject", "CurStepChanged raised an exception (fatal).", "?.TValueCollectionl!N", "ulj@h", "UhT+V", "tebIEBarMenuHot", "TInterfacedObject", "6*686G6^6q6", "FileName<", "csAcceptsControls", "AScriptFuncLibraryRegister_R.RegisterCommonFuncScriptFuncs$29$Intf`'@", "Cards", "TZStreamRec8", "FButtons", "NumDirEntries", "<7=;=?=C=Q=_=j=x=", "FShellItems", "4!4&484J4\\4n4", "Comparer OF", "VisualManager ", "IsEmptyxHe", "FDisplayNameWStr", "NeedProxyCredential", "HPPGENAttribute0#@", "Start index out of bounds (%d)", ": :$:(:,:0:4:8:<:@:D:H:L:Z:b:j:r:z:", "itRadio", "bkFlat", "commondesktop", "TParserH", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$10$Intf`'@", "5\"5(545C5[5a5p5", "TextMarginRight", "33373\\3l3p3t3|3", "RecreateAsPopup", "TResourceManager<", "ExtraImageData", "FontHot", "BTDictionary.TKeyCollection;", "FPaletteModified", "ShortCut", "SimpleExpression", "<$lv$", "TUninstallSharedFileForm`Op", "?'?;?U?c?v?", "TURLClient", "ALock", ">!>)>;>C>V>^>s>{>", "Failed to create DebugClientWnd", "CoUninitialize", "FNoIconsCheck", "ACookie", "TUninstallProgressFormldi", "UpdateTarget", "3!393=3[3_3z3~3", "trSplitterNormal", "7&727>7J7Y7q7", "", "1 2C2d2h2l2", "AutoComplete", "FStringPtr", "Vcl.WinXPanelsK", "avI&Q_", "8<8I8]8q8", "738l8|8", "fvvv[$~OO", "7@8a8", "NewSize", "FNextPageID", "4 5@5H5", "TList\\iF", "6$626>6J6V6b6n6z6", "CreateEvent", "UseDefaultCredentialsl=h", "132z2", "OwnerCriticalSection\\oG", "FDecodeTable", "FUseThemes", "DrawEllipse", "CheckBoxTextNormal", "TPSExternalProcRec", "Uhk2i", "format", "AType", "FCookies", "ReadComponents", "T>", "Must call \"%s\" function with Wait = ewWaitUntilTerminated", "TInStream5", "IsSaveButton", "Out Of Range", "7 7$7(7,7074787<7@7D7H7L7T7\\7d7", "v2.0.50727", "ktfCheckBoxTextDisabled", "MonitorFromRect", ";(<_< =$=b=t=", "TVariantBoundArray", "Union", "?0?D?X?t?", " hX'd", "6\"6/676E6W6d6l6z6", "win.ini", "3&3r3", "sfGridItemFixedHot", "fsMDIChild", ":+:3:;:C:K:S:[:c:k:s:{:", "1#1+191I1W1o1w1", "IntersectsControl", "WelcomeLabel1D", "3TEnumerator(", "<\"<*<8=\\=h=y=", "9$9;9M9U9c9v9", "kwhtSysMenu", "GetTextMetricsW", "3\"343N3\\3k3~3", "ENetException", "PRQh(", "TStatusAction", "5 5,505H5O5V5]5d5k5r5y5", "?#?=?E?I?d?t?x?|?", "function GetSpaceOnDisk(const DriveRoot: String; const InMegabytes: Boolean; var Free, Total: Cardinal): Boolean;", "Invalid numeric input", "SetSubject", "ITask", "scButtonHot", "ff}}0", "ListSeparator", "D0H0h0l0p0t0x0|0", "SmallChangeXFA", "FNamingAttribute", "VPChar", "FAutoScroll", "Systemd", "1 1,181", "5 5(565D5X5i5v5~5", "CreateILockBytesOnHGlobal", "skFMXActiveLabel", "function Round(const E: Extended): Int64;", "ProgressBar$", "ChangeFinishedLabel", "function SetIniString(const Section, Key, Value, Filename: String): Boolean;", "=TList>.arrayofT", "TRttiStringType", "Uh4PN", "8'828H8U8", "Uh+Ff", "FDragTarget", "FCleanCopy", ":$;P;e;n;", "usertemplates", "cp857", "EnumDisplayMonitors", "MonitorFromWindow", "ole32.dll", "UhRWE", "csPalette", "HeaderSectionTextHot", "CScriptFuncLibraryRegister_R.RegisterCommonFuncVclScriptFuncs$ActRec", "`TEnumerable>$", "Flags2", "%s has no owner-Source and destination require the same owner(%s cannot be owned by a different canvas", "CanUseDoubleBuffering", "CloseMenu", "CreatePalette", "080g0o0z0", "DTDictionary.TValueEnumerator;", "<(<6(", "6 6(60686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "LoadLibraryExW", "pllVal", "kwhtLeft", "GetStatusText", "kebcPlus", "TseBitmap0Rr", "SETCURRENTDIR", "tabset", "4!515C5W5k5", "", "90g0t0", ",TEnumerator(", ".TKeyEnumerator;", "FScaleFactorRoot", "UnRegisterSysStyleHook", "scComboBoxDisabled", "CScriptFuncLibraryRegister_R.RegisterCommonFuncVclScriptFuncs$ActRecP5m", "6$7E7l7u7", "5k]|Y", "ktcButtonFocused", ":mEZ;iy[-c3", "TCustomBase64Encoding<", "<24L4[4i4", "1TList.TEmptyFunc`'@", "Windows Vista", "csisolatincyrillic", "TPSOnLineEvent", "5.7@7R7", "Comparer4B4`4p4x4", "l$ ;l$,f", "BevelEdges(", "imm32.dll", "twSmallMinCaptionActive", "PanelDrawButton", "TEnumerator@", "ktfRadioButtonTextHot", "L$@A+", "FCleanUrl", "E PQR", "9I:^:l:", "TIconImage'", "TOwnedCollectionD", "macroman", "081M1T1j1n1r1v1{1", "ThreadProc", "Uh[Ln", "TPropSet,AD", "cbUnchecked", "TBitmapHandleType", "242I2", ">\"?h?", "Uhp.R", "TypeInfo", "=j?u?", "6 838N8f8|8", "7%7A7I7M7c7", "AAsyncCallbackEvent", "UnhookMainWindow", "767>7F7N7V7^7f7n7v7~7", "GetCallStack", "1$141<1M1]1e1v1", "565E5", ">*>7>D>Q>^>k>x>", "><>^>u>", "8=Gy%\"-", "ibm850", "GetSystemMetrics", "0#030E0T0\\0j0}0", "FTokenId", "IAsyncResult(", "TPSExceptionHandler", "TStyleInfo", "Cannot call \"%s\" function during Uninstall", "5TList&", "TURLHeaders3", "gTDictionary>.TKeyCollection;", "8)8-818Q8t8", "6#6'656C6O6\\6", "8(9c9o9{9", "7+797L7a7o7", "TInstItem.TBucketArray|", "PRQh$", "function FreeDLL(const DLLHandle: LongInt): Boolean;", "DeltaY", "TrackDraw", "< <(<,<0<4<8<<<@>", "6+6D6S6W6s6z6", "+TList.TEnumerator", "cbData", "=\"=(===K=Q=\\=w=", "tttBalloonStemLeftWall", "HexToBinary", "FCallConv", "ResultLo", "4$515", "Uh4{a", "%TEnumerable", "WriteCollection", "F77([", "7 7$7(7,7074787<7@7D7H7L7Z7b7t7", ">\">u>|>", "ButtonTextPressed", "flagsSelect", "Winapi.ShellAPI", "Accept-Charset", "EVariantOutOfMemoryError", "UhAjq", "FListeners", ">(>,>H>X>\\>`>h>p>t>x>|>", "Inno Setup Uninstall Log (b)", "4(585<5@5H5P5T5X5\\5`5d5h5l5p5t5x5|5", "6$6I6_6p6", "FDisabledImageName", "6 6$6(656P6X6`6h6p6x6", "OEMTOCHARBUFF", "TPropSet", "Invalid Type/Variant does not reference an automation object7Dispatch methods do not support more than 64 parametersjThis \"Portable Network Graphics\" image is not valid because it contains invalid pieces of data (crc error)yThe \"Portable Network Graphics\" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis \"Portable Network Graphics\" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.", "kwhtRight", "proCommandLine", ";B;a;", "tagEXCEPINFO ", "EOperationCancelled,", "6TDictionary.TKeyCollection;", "$IComparer`'@", "MultiByteToWideChar", "poMainFormCenter", "LogFmt", "FooterText", "2'252F2Z2h2p2~2", "IconFile=", "d2IGg", "TSeButtonObject4", "TSeBoxDrawState", "FPreparingLabell", "Vcl.Consts", "?!?(?8?@?H?P?T?X?\\?`?d?h?l?p?t?x?|?", "TPanel", "XTDictionary.TValueCollection;", "0TCollectionNotifyEvent", "TSetupFileVerificationType", "ktidsActive", "<)= >->K>O>I?g?w?", ">'>;>P>p>", "VWords", "5/6D6R6j6y6", "FindFormat", "3TPair", "bsCheckGroup", "ttbToolBarDontCare", "GroupBrowseButtonClick%", "1 161P1k1", "TIconRec", "PACKAGEINFO", "D$4Pj", "HelpLink", "6 6]6s6", "TSeTextInfo", ";!;=;`;h;", "SheetOfGlass", "tagRGBQUAD", "WindowClass", "RichEdit41A", "invalid code lengths set", "C`+D$,", "InstallingPage,5_", "ComponentsListClickCheck ", "crSizeAll", "<'<59Y9a9e9|9", "VDispatch", "ExecAsOriginalUser", "ProcessMenuChar", "EndDrag", "Feature not implemented Method called on disposed object", ">Y?g?", "PrimaryMonitor", "PPointerList", "7,7D7R7e7u7", "525@5S5i5z5", "DTDictionary.TItemArray", "3)323F3N3X3b3j3t3~3", "TaskbarButtonCreated", "ButtonTextFocused", "EPrivilege ", "ItemObject", "<;=_=", "THeaderValueList&", "RPGKu", "ttsToggleSwitchRoot", "NextCard", "NewImage", "Y^[Y]", "777;7h7", "ksscScrollBar", "pfResult", ";Bh|4", "FLoop", "1$161D1V1h1v1", "ButtonInactiveBackgroundColor", "FComparer", "ReadSafeHeaderString", "ExpandedDestDir", "5H5c5", "ktxsWordBreak", "CreateRegion", "(", "UhJZp", "function GetSaveFileName(const Prompt: String; var FileName: String; const InitialDirectory, Filter, DefaultExtension: String): Boolean;", "OTDictionary.TValueEnumerator", "GetEraYearOffset", "msctls_trackbar32", "ISADMININSTALLMODE", "procedure ExtractTemporaryFile(const FileName: String);", "1&1-141;1E1h1x1|1", "5E5[5", "4$424A4W4e4m4{4", "function DirExists(const Name: String): Boolean;", "+TEnumerable'", "0TEnumerable", "6$676H6i6p6", "SetTextBuf", "Inno-Setup-RegSvr-Mutex", "tdnbDontCare", "%TThreadList&", "Maximum output lines (%d) reached, ignoring remainder.", "Enter", "QQQQQQQQS3", "0hxtg", "DiskBitmapImaged", "_NOTIFYICONDATAW", "1!1/1A1I1W1g1w1", "4'454H4W4_4m4", "tbLeftButton", "FMemoryImage", "FOnAfterMonitorDpiChanged", "TFormBorderStyle", ">#>:>I>Y>f>l>", "Group", "kwhtMenu", ",TEnumeratorxGI", "tdnbLastNormal", "<&`'@", "TThemedMPlayerButtons", "ReadChar", ";-;;;M;\\;d;t;", "020:0>0T0|0", "7&7*7.7H7X7\\7`7h7p7t7x7|7", "<\"", "AWeight", "FFlat", "Windows Server 2022", "FAutoDropDown", "htContext", "FOnDockOver", "5\\5`5", "Layout", ";#;*;1;<;L;P;T;\\;d;h;l;p;t;x;|;", ":]:y:", "TLS1_1", "GetHeaderValue", "wifTiff", ">H>k>", "3!3;3P3t3", "GetLongPathNameW", ": :(:6:I:]:u:}:", "TGraphic", "?0?=?N?p?}?", "PVmtFieldEntry", "function WizardSetupType(const Description: Boolean): String;", "0 0$020@0N0W0`0", "FActionUpdateDelay", ">ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$14$Intf`'@", "FControl", "CoAddRefServerProcess", "BorderStyle", "%IComparer`'@", "cmStored", "OriginalFileName", ">", "CoReleaseServerProcess", "1 1$1(1,1014181<1D1L1T1\\1o1", "TFindMethodNameEvent", "tmPopupBulletDisabled", "Enqueue", "2 2$2(2,2024282@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "1.222Y2c2g2", "code:", "kticGripperVert", "Delete301", "ttTabItemLeftEdgeHot", "TImageIndex", "Width", "mbBarBreak", "0 3/363K3Z3a3", "fdoPickFolders", ":+:D:j:|:", "=)=8=V=Z=t=", "SetCurrentDirectoryW", "EParserError", "?&?4?D?V?l?z?", "IsEmpty,", "v4\\Client", "=)=<=R=c=v=~=", "sfListItemTextNormal", "TArchiveCallback8", "FormCount", "function ShellExecAsOriginalUser(const Verb, Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ErrorCode: Integer): Boolean;", "2'292N2i2w2", "=%=-=5===E=M=U=]=e=m=u=}=", "Dragging", "tmpbStopNormal", "ttTopTabItemFocused", "Ht+Ht;", "ContainsName", "AGraphic", "procedure GetWindowsVersionEx(var Version: TWindowsVersion);", ">#>+>3>;>C>K>", "2$2(2,2024282<2@2D2H2L2P2]2", ".TPfo:", "ReadDouble", "3+313U3", "1>", "5$5,545<5D5L5T5\\5d5l5t5|5", "tfShowMarqueeProgressBar", "fMemory", "PRQh`", "QQQQQQQSV", "tmMenuBarItemDisabledHot", "CertDuplicateCertificateContext", "7$7B7P7e7}7", "8-9r9", "MenuDrawItem", "FTrackButton", "SetMinWorkerThreads", "tfPrefixOnly", ".TList.arrayofT", "igoParentPassthrough", "GETUNINSTALLPROGRESSFORM", "4$5W5", "ttbSeparatorVertDisabled", "pf1bit", ";,;@;T;n;", "808A8R8d8v8", "FSign", "TList.arrayofT", "ttTabItemLeftEdgeFocused", "ttbButtonPressed", ";);7;M;[;j;|;", "1*1<1Q1k1", "AExtraUnsafeChars", "pszName", "2 2$2(2,2024282<2D2}2", "CreateBrushIndirect", "[B:X[", "GetStretchBltMode", "=%>q>", "iso-ir-179", "2/2=2N2h2v2", "skBottomLeft", "FOnAncestorNotFound", "erInvalidOpcodeParameter", "Invalid clipboard format Clipboard does not support Icons", "StretchDIBits", "ExitWindowsEx", "8\"878E8X8k8y8", "IsOrdinal", "767U7c7r7", "KTDictionary.TKeyEnumerator;", "TSeGridInfo", "363>3^3h3y3", "tgCellRowSelectedLeft", "TSeGridItemDrawState", "FHScrollBarRect", "tmSystemMinimizeDisabled", "8?9U9f9z9", "UnregisterWeakRef", "tsArrowBtnDownNormal", "CreateInputOptionPage", "AProgress", "ExplicitHeight\\oG", "5 5$5(565>5P5b5u5", "AM/PM", "Capture", "TSeHintSubclass", "3=3G3l3|3", "ARealm", "System.Generics.Defaults", "D)pai", ":V;o;", "TBaseDragControlObject8", "4\"4*424:4B4J4R4Z4b4j4r4z4", ";S\\t,", "0T1r1,4L4", "3+6W637Z7", "charset", "Grabber", "UhE>n", "shift_jis", "TMenuUpdater", "RandomXorStartOffset", "4:4A4e4i4m4q4u4y4}4", "ktfCheckBoxTextFocused", "121T1", "=8=S=", "=%>>>\\>d>", "3e3m3{3", "VS_VERSION_INFO", "LoginEventUsrPw", "GetMessageExtraInfo", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5|5", "ID2D1GeometryX", "VariantCopyInd", "GetBitmap", "?'?/?7???G?O?|?", "2(2t2", "IInStream", " TList&", "grfCommitFlags", "?/?6?=?D?K?R?Y?`?g?n?x?|?", "tsGripper", "626:6B6J6R6Z6b6x6", ": :$:(:,:0:4:8:<:@:M:d:l:t:", ":TSetupHeader.:4", "2 2$2(2,2024282<2@2N2V2h2z2", "%s (%s, line %d)", "Interface not supported", ";/;4;", "CreateEventW", ";TEnumeratorX", "878>8E8L8S8Z8a8h8o8v8}8", "1/2M2", "SetString", "ktfTabTextInactiveNormal", "2,2F2T2c2z2", "erOutOfStackRange", "Cleanup", ":':3:C:", "TStyleElement", "erOutOfGlobalVarsRange", "FDestroyingHandle", "FShiftScaleOrient", "CategoryPanelGroup", "7(747U7Y7", "sfGridItemSelected", ":h;x;", "tdnbFirstNormal", "414G4V4d4s4", "4)414;4H4Y4a4k4", "1\"111?1Y1a1o1~1", "/Log=", "GetMachineTypeAttributes", "0-0F0N0\\0o0", "FWantTabs", "FCallStatus", ";5;Z;", "t7$", ":&:B:V:Z:^:b:|:", "FNeedChangeSize", "FRealSize", "%s$Parent given is not a parent of '%s'", "GetNearestPaletteIndex", "2+2/2V2`2d2", "YesToAllButton", "scToolBarGradientEnd", "CategoryPanelGroupHeaderNormal", "EraseDockRect", "KeyData", "TFindGlobalComponent<+I", ":TSeStyle.:1", "#A:S!R", "4d6h6r6z6", "BTDictionary.TKeyEnumerator;", "=H=e=|=", "HTDictionary.TKeyCollection;", "<-.TValueEnumerator\\JI", "9!:>:e:", "FormID", "FVDownState", "tmPopupItemNormal", "5!5)575F5T5t5", "ValueList", "0%0-050=0W0i0w0", ":^@tH", "ExportPrivateKey", "CharCodeUnusedFiller", ";APtY", "function ConvertPercentStr(var S: String): Boolean;", "GetCursor", "PRQh ", "1-1?1G1U1e1u1", "ReplaceIcon", "5U6Y6]6a6o6}6", "%s (%s)", "gtRecorded", "; Location: ", "IsDaylightTime", "5TList&", "!TEnumerator", ";.;<;L;\\;o;", "ATypeInfo", "seFont", "maManual", "6O7[7`7e7q7v7{7", "<$<(<,<0<4<8<<<@= MAX_PATH", "0K1O1S1W1e1s1", "InstanceType", "OnContextPopup", "2*2?2U2l2", "gtStandard", "9N9c9q9", "ISHA256", "K", "Collisions|Nd", "NewFolderButtonClick", "?/?d?", "UhSsf", "doNoOrient", "teCategoryPanelGroup", "829:9B9J9R9_9d9o9x9", "grfKeyState", "IsRectEmpty", "FListBoxUpBtnDown", "skPageUp", "0#0:0H0W0h0", ":TListHelper.:3", "MTDictionary.TKeyEnumerator ", "ShortCuts", "5.5S5b5", "?*?1?8???F?M?T?[?b?i?", "tbCommandLinkGlyphDisabled", "TEnumerable'", "traynotify", "AStart", "M{9.TEnumerator5", "TDockOverEvent", "4!434D4T4X4\\4d4l4p4t4x4|4", "invalid distance code", "TypeTable", "FFilenameLabel", "9$9S9", "GetCommandLineW", ": :':.:5:<:C:J:Q:X:_:f:m:t:{:", "8.8E8S8a8o8", "ttbSeparatorCheckedHot", "kpbcRollLeft", "Delay", "ssDisabled", ": :$:(:,:0:4:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ", "7,747R7Z7x7", "CommonButtons", ">,>G>X>m>", "8TDictionary.TValueEnumerator;", "FOnGetSiteInfo", "SVWUP", "UhlGc", "ClearFunctionList", "VarR8FromStr", "-060R0[0w0", "282H2P2X2`2d2h2l2p2t2x2|2", "tspSoftwareExplorerSelected", "tcpCategoryPanelGroupDontCare", "TEnumerator@[N", "TTextFileReaderRedirt", "Window", "clDarkturquoise", "808@8H8P8X8\\8`8d8h8l8p8t8x8|8", ";4;\\;", "YFFFH&", "Solid", "function GetSysWow64Dir: String;", "TChunkPLTE", "8#8'8+8/83878;8?8C8G8K8O8S8W8[8_8c8g8k8o8#9c9u9E:I:M:Q:U:Y:]:a:e:i:m:q:u:y:}:", "AReturnType", "2-2?2K2S2q2", "?ScriptFuncLibraryRegister_R.RegisterInstFuncScriptFuncs$17$Intf`'@", "6;6/7G7X7t7", "FAllocated", ">ScriptFuncLibraryRegister_R.RegisterWindowsScriptFuncs$11$Intf`'@", "MsgBox failed.", "GetCustomSetupExitCode", "ThumbSize", ",IEnumerable", "7oGHp", "TBits'", ";';<;J;];u;", "v$F}%g", "DestroyKey", "TURLHeaders.TValueList'", "=%=3=A=O=]=i=", "4/4Q4b4", "biMinimize", "ListDrawItem", "4K5f5", "DeleteLast", "?(?5?>?M?", "ufWizardBorderStyled", "FillWideCharBuffer: String too long", "claBeige", "1IEnumerable", "[Paused] ", "clSeashell", "8 8$8(8,8084888<8J8R8Z8b8j8r8z8", "TURKISH_CHARSET", ">O?d?r?", "= =$=(=,=0=4=8=<=@=D=H=L=", "7?7v7", "file error", "9(:J:", "TMenu\\IZ", "TImageAlignment", "scCategoryButtonsGradientEnd", "6/7:7@7P7X7`7h7l7p7t7x7|7", "ReadyLabel$", "Identifier", "7+797L7c7g7", "8%8-858=8E8M8U8]8e8m8u8}8", ":TList.TEnumerator5", "WinHttpSetOption", "erException", "tmcGridCellBackgroundToday", "OnFindGraphicClass", "REGWRITESTRINGVALUE", "Ident", "https://www.remobjects.com/ps", "UNKNOWN_HTTP", "8Q8X8o8", "---V'", ">*>K>O>S>W>[>_>c>g>k>o>s>w>{>", "TEncoding%", "Stream write error", "TSeListGlyph", ">&>7>J>h>z>", "IStreamxSD", "373}3", "SecondaryShortCuts", "3&3:3P3a3v3", "FSectionRect", "; <^", "GetComputerNameW", "dmManual", "fMaxIdatSize", "Uh$gJ", "\"TUxThemeCategoryPanelGroupElementsh", "3:5Z5", "Uh'~q", "Uh:&n", ":2:G:U:h:~:", "Icons", "AllowWinControls", "PromptCount", "TSePanelInfo", "GroupBrowseButton", "cmd.exe\" /C \"", "cannot close output file", "TTaskDialogButtons", "Key of value to delete does not exist.", "3\"3*383J3Z3b3p3", "hTDictionary>.TPairEnumerator;", " AddStrings(Strings.data(), Strings.High, Objects.data(), Objects.High);", "Scratch", "Directory for uninstall files: %s", "tgGradientCellRowSelectedCenter", "Colorp", "FOnShouldSkipPage", ">#>'>J>N>q>u>", "4%484R4e4v4", "OnSimpleDownloadProgress", "NeedClientCertificateCallback", "1'2T2", "TBrush", "FOnReceiveDataEx", "Crypt32.dll", "7/8T8", "6/737R7u7y7}7", "2F2o2", "AGlyph", ".TCollectionNotifyEvent", "9'9/979?9w9", "6&6A6Z6", "ManualFloat", "WorkAreaLeft", "tePanel", "tpDockPanelHorzNormal", "class", "@?@t:", "CookieHeaders", "Failed to get data for '%s'", "tmNyV", "6$6,646<6D6L6T6\\6d6l6t6|6", "Stopping 64-bit helper process. (PID: %u)", ":(:;:R:`:w:", "6 6$6(6,6064686`6", ":r:v:", "PWj W", "*TEnumerable", "FOnValueNotify", "ktfTreeItemTextSelected", "FindAccurateCredential", "TControlScrollBar", "GetAnsiString", "324X4}4", "=1=9=G=V=l=~=", "]TArray>", "5)575C5O5[5g5s5", "accHitTest", "CustomMainIcon", "FRegion", "LTDictionary.TKeyEnumerator;", "ecHeading2TextColor", "Rh|,x", "0 0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "5TCollectionNotifyEvent", "MinorVersion", "TPSStack&", "Windows Server 2019", "REGDELETEKEYINCLUDINGSUBKEYS", "979?9Z9b9~9", "COMPARESTR", "value", "OleStr", "TObservers.TCanObserveEvent`'@", "Vcl.Menus", "pPointerArray", "=B>T>", "tmSystemMinimizeNormal", "TLoadResource", "ttsLabel", "FCollection", "WheelPresent ", "2!2/2B2Y2j2", ";8;p;", "Uh1Ya", "Setup.SelectLanguageForm", "9^9b9f9j9n9|9", "Duration", "DrawText", "korean", "8,848T8a8w8", "8 8$8(8,808D8S8W8|8", "function GetSHA1OfFile(const Filename: String): String;", "FTextFlags", "DisableAutoRange", "728G8U8g8v8~8", "laSrcUnique", "ksbcDown", "8!8)81898A8I8s8w8{8", "ItemClassD", "0;0I0", "SetPaths", "LeftButton", "4-4d4", "{olddata}", "7@8D8H8L8d8p8t8x8", "8)8F8a8i8", "REGWRITEBINARYVALUE", "7&747F7]7k7~7", "=!=2=T=a=r=", "FMainButtons", ";,;<;@;D;L;T;X;\\;`;d;h;l;p;t;x;|;", "BaseException", "clPink", "Thread Pool Monitor Thread - %s ThreadPool - %p", "!TList&", "Dispatch", "0Q2|2", "OldPtr", "0*1I1C3l3", "Uh6It", ">T?c?z?", "Selector", "tfWordEllipsis", "@D_^[Y]", "ptmBit", "===f=m=t=", "TArray", "|$DPV", "OnFindMethodName", "9J9\\9", "FOwningThread", "1<1{1", ">9>H>_>", "OiCCPPhotoshop ICC profile", "#[DB~", "FParentCustomHint", "1 1$1@1W1[1|1", "tbCheckBoxMixedPressed", "0-0@0W0[0", "FHUpState", "=\"===X=s=", "DefaultGroupName", "WriteAnsiString", "-- Registry entry --", "FileTag", "5*585M5^5t5", "IEnumerable`'@", "3#3'3+3/33373;3?3C3G3K3O3S3W3[3_3c3g3k3", "twMDISysButtonPushed", "7#767I7_70<", ":-:@:M:Q:k:r:y:", "OnShowHint4", "8A8K8p8", ">ScriptFuncLibraryRegister_R.RegisterMainFuncScriptFuncs$7$Intf`'@", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>`>", "WindowGetClientRect", "TextText|", "yVcl.Consts", "?&?9?H?V?g?u?", "?333333", "ShellExecuteExW", "MtS':4", ";C,r3", "%5-!S", "ImageType", "9*9[9c9h9w9", "PathRelativeToAbs", "tmpbNextHot", "UhWrg", "WriteIndex", "FlatSB_GetScrollRange", "6)6<6", "9$929<9M9^9e9u9", "\\$(#V(", "VTEnumerable>", "1v\"ZH", "kridsDisabled", "TCustomStackPanel6", "2'222", "556r6", "2=2W2}2", "9C3J3W", "iso-ir-199", "#!O}p", "HasDST", "CategoryButtons", ">,?L?T?", "TDragOverEvent", "NTDictionary.TKeyEnumerator", "0:18293", "FBufPtr", "Uh@]k", "4#414?4S4d4q4y4", "*TList.arrayofT", ";!;/;C;R;l;z;", ":(:,:0:8:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "748{8", "?B?N?U?m?", "userpf32", "TSeActiveBitmap", "WTDictionary.TKeyCollection;", "fsNormal", "UNREGISTERTYPELIBRARY", "Uhy%i", ">0>I>Z>k>~>", "7 7$7(7,7074787<7@7D7H7L7Y7", "uPSR_controls", "T$,#D$8#T$<3", "VSmallInt", " TList", "SETINISTRING", "4(4@4", "TGrantPermissionEntry", "XLCSQR", ">:>q>", "1+1/1K1n1v1", "AsInstance", "Uhs5l", "(Vcl.Menus", "Uh6BA", "UnlockDrawing", "TSeActiveObject", "TCustomFilet", "uVersion", "ServerAuthRequired", "IDesignerNotify`'@", "FPrevScrollPos", "$TEnumerable", "DTDictionary.TValueEnumerator", "= =4=J=[=f=n=", "FDisabledStateBeforeMinimize", "ttbButtonOtherSideHot", "Invalid Opcode Parameter", ">$>@>\\>x>", "i2;;k", "r1A50L", "MarginRight", "machebrew", "TGraphicsObject/", "RtlCompareUnicodeString", "TMessageManager.TListenerList", "IdentRes", "total_out", "6]6l7Q8q8", "Invalid ImageList", ";\";5;C;S;e;t;", "Dimensions", "SetRectEmpty", "?&?:?O?g?o?w?", "FinishedLabel,8^", "InitCommonControlsEx", "Invalid scale, valid values are 1,2,4,8.", "FInactiveBackgroundColor", "UhgO\\", "EObjectDisposed|", "dmStepInto", "CanvasOrientation", "%s: The existing file appears to be in use (%d). Will replace on restart.", "FOwnership", "dotnet40", "TMenuItemStack8", "GetSelectedComponents", ">(>3>K>V>i>s>", "7'767>7L7\\7d7r7", "8U8b8m8~8", "tmpbRecordPressed", "EnumResourceNamesW", "Invalid mod mode: ", " true", "FOnSourceLine", "TSysToolbarButtonStyleItem", "FullHash", "1S1h1", "f;P.tY", "464p4{4", "8,8:8P8`8h8v8", "0TCollectionNotifyEvent", "RawByteString", "FBaseUnitY", "9-:1:X:b:f:", "OnPaintP_Q", "FMarginBottom", "ItemHeight", "Seconds", "ShellExec", "4-4>4Q4_4s4", "GraphicsObject", "RectVisible", "\" /REG", "7.7?7X7`7n7{7", "claMediumseagreen", "StyleHookClass", "EnableThemeDialogTexture", "FInBufferedPrintClient", "tgDropDownButtonPressed", "function GetSHA256OfFile(const Filename: String): String;", "DisabledColor", "procedure SetDownloadCredentials(const User, Pass: String);", "WriteComponent", "csPaintCopy", "VarRec", "TCustomLabel", "TSendDataCallback`'@", "ColorPrevalence", "erInterfaceNotSupported", "tkMethod", "TTaskDialogButtonItem:", "2Y2d2l2|2", "TInputCloseQueryFunc`'@", "UhQ#k", "GetCurrentObject", "0%1V1t1", "clInactiveCaptionText", "(TList.TEnumerator5", "8N9R9V9Z9^9b9f9j9n9r9v9", "AllocBy", "HH:nn:ss", "TFormStateItem", "ID2D1BitmapX", "FOldLeft", "? ?K?a?r?", "Uh/EG", ">3>8>Y>e>q>y>", "2s3!4", "Uh4>d", "kgdsNormal", "ImageCountD9O", "TLocalTimeZone.TYearlyChanges", "94:I:W:o:", "TSetupCompressMethod", "2Y3:5", "9\"929B9R9b9r9", "TCustomMemoryStreamC", "StretchDraw", "?fffffff", "4+5d5", "System.Generics.Collections8", "Uhi4t", "ExceptionAddress", "TCustomHint6", "ShortString", "2F3J3q3{3", "<)K", "QueryPerformanceCounter", "5,5t5|5", "UhNCo", ";Fdu;", "ttbSizingBarTop", "Winapi.CommCtrl", "StringBuilder", "pByteArraydV^", "cyVal", "UnhookSynchronizeWakeup", "8B8g8", "TextOut", "?ScriptFuncLibraryRegister_R.RegisterSysUtilsScriptFuncs$17$Intf`'@", "OnCanResize\\oG", "TMemSize", "ItemFontStyle", "ErInternalError", "\\TEnumerable>", ";*<77B7F7J7N7R7V7Z7^7", "TSeEditButtonClass", "Text exceeds memo capacity/Menu '%s' is already being used by another form", "MoveFileEx failed (%d).", "7!7,747E7Y7j7w7", "hCertStore", "ktcComboBoxDisabled", "toFlickFallbackKeys", ":E;I;p;z;~;", "ttbSplitButtonDisabled", "FLeftPressed", "6F7J9j9", "Close", "?(?B?\\?t?", "claIvory", ":):9:O:]:j:|:", "MinItemHeight", ">>?I?S?[?e?m?|?", ":\":):0:7:>:E:L:S:Z:a:h:o:v:}:", ">,><>D>L>T>X>\\>`>d>h>l>p>t>x>|>", ":\":8:F:U:h:y:}:", "csAlignmentNeeded", "OnCloseUpDgQ", "System@cX", "697`7Z8o8", "NTDictionary.TKeyCollection;", "trackbar", "TChangeLink&", "pCertInfo", "(>;>Q>b>{>", "+'>yE", "claTomato", "=TDictionary&", "FComponent", "GetTextExtentPoint32W", "?2?L?Z?i?", "EASTEUROPE_CHARSET", "ItemID", "ClearSelection", ">1>B>V>g>r>z>", "UninstallSilent", "Deviation", "; ;$;(;,;0;8;@;H;", ")080D0g0", "grfStateBits", "GetTabControlList", "function CreateInputDirPage(const AfterID: Integer; const ACaption, ADescription, ASubCaption: String; AAppendDir: Boolean; ANewFolderName: String): TInputDirWizardPage;", "DstRect", "claDarkblue", "ttTopTabItemSelected", "kdscDock", ",]_^[", "ktcHintGradientEnd", "@ScriptFuncLibraryRegister_R.RegisterScriptDlgScriptFuncs$12$Intf`'@", "<5w>w", "MessageBoxW", "D$,PW", ":R:/", "TransparencyMode", "333A3T3d3s3", "|iBH?", "ktfEditBoxTextHot", "TSeTabItemInfo", "VerifyChecksum", "TabTop", "4$4,444<4D4L4T4\\4d4l4t4|4", "BCryptFinalizeKeyPair", "EqualSid", "function FileExists(const Name: String): Boolean;", "HorzScrollBar", "PushEBP_55", "=0>?>", "TRadioButtonStyleHook(OT", ": :0:4:8:@:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "?#?;?", "= =$=(=H=c=g=", ";0;w;", "9)999Q9a9", "FMenuHook", "0H1L1x1", "O7pi_", "TLBGetDataEvent", "soOwned", "Control", "7(7<7N7g7~7", "\\TEnumerator>", "(TCustomHintShowHideThread.Execute$ActRec", "bhsStandard", ")TList.TEnumerator5", "WinHttpGetProxyForUrl", "tmMenuBarItemDisabled", "tttWrenchPressed", "OverridePaintNC", "utf-7", "<-=B=M=f=l=", "FRightToLeft", "AScriptFuncLibraryRegister_R.RegisterVerInfoFuncScriptFuncs$ActRec", "><>L>T>\\>d>h>l>p>t>x>|>", "Uh77V", "CMD_Err3", "2(202>2M2[2q2", "TCollectionNotification", "090g0", "bmBitsPixel", "DoISSigVerify$ActRecT", "IzD:6", "/REGU", "RetinaDisplay", "4(4,40484<4@4D4L4T4X4\\4`4d4h4l4p4t4x4|4", "tkMRecord", "3a3v3", "Windows Server 2008 R2", ">0>>>J>Y>s>", ";3;U;v;", "TWizardPage6", "IsEmptyD&J", "psiFolder", "sphpCenter", "DirEdit", "LoadBitmapW", "CheckBoxTextDisabled", "WinVersion", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "IComparer`'@", "2+282I2S2[2i2{2", "3TList.TEnumerator5", "4J4e4", "GetDesignerStyleName", "9TList.TEnumerator5", "TryIsObserving", "FFragment", "TChunkIDATd{^", "tspSoftwareExplorerHot", "LineSeparator", "2'2;2E2O2", "EEncodingError", "clOlivedrab", "4D4T4\\4d4l4p4t4x4|4", "SubjectUniqueId", "claLightgrey", "Skipping updating the .INI file, only updating uninstall log.", ":':C:", ">P>`>d>h>p>x>|>", "kebcDropDown", "?,?C?K?S?[?c?k?s?{?", "cp850", "", "616?6R6i6w6", "6 7b7", "NonBiDiKeyboardHKL", "cp1258", "FState", "ResName", "VTEnumerable>'", "ktisBottomMiddle", "'TList.TEnumerator", "TChunk;", "Control-C hit", "7%8Q8" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "selfextract": { "overlay": { "extracted_files": [ { "name": "18c463410332dc1276cd31e59b3c05656d01a2471adebc51e9102b094d92dbd4", "path": "/opt/CAPEv2/storage/analyses/109/selfextracted/18c463410332dc1276cd31e59b3c05656d01a2471adebc51e9102b094d92dbd4", "guest_paths": [ "overlay" ], "size": 20376, "crc32": "C511DA5F", "md5": "d993f64eaf79bf65d06450d5e1b542ac", "sha1": "1ba37bb116aefca97018172f50b26421dcda4c18", "sha256": "18c463410332dc1276cd31e59b3c05656d01a2471adebc51e9102b094d92dbd4", "sha512": "766399c07be25f4e3c9070eb4a63bab88121b0d7ea37c8073aca4c01c1847c1239fbd20ec7faca31bd737f4b7fb360ba835aca077f45d770692eb9e3855c4472", "rh_hash": null, "ssdeep": "384:r2Wuswvdelx7bLMvhsPAsw6Qeldei2WSx7bLePhkYz:PTwwnbLeywPAmbL+z", "type": "OpenPGP Public Key", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1A6924B833E2434425ECA89EDB1C89F77ACF072B62EA018CA54348A94DD55BE77B1505F", "sha3_384": "42a185b7ec81982a3fd4535072146cda55db93a9393cc090be110f278218cde619783fc9fe6dc1726335de016b6ddcc5", "data": null } ], "extracted_files_time": 0.0027803229986602673, "password": "" } }, "cape_type_code": 0, "cape_type": "", "pid": 4848 } ], "CAPE": { "payloads": [ { "name": "71d33a2237fe7615d02ab8ecd76eaf7172d02546453519811e1f1e90d12a2503", "path": "/opt/CAPEv2/storage/analyses/109/CAPE/71d33a2237fe7615d02ab8ecd76eaf7172d02546453519811e1f1e90d12a2503", "guest_paths": "9;?C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp;?C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp;?0x04820000;?", "size": 4092, "crc32": "131C8ACD", "md5": "2c44130af8bd3568c715c5f5c2ff0f16", "sha1": "1327cda0be5c788eae0549a84251c32dc086e0b5", "sha256": "71d33a2237fe7615d02ab8ecd76eaf7172d02546453519811e1f1e90d12a2503", "sha512": "bd20b5d9421e587479a3daa28b30fd9f174c5706bf0865b6f525a17866afe4c887db41daab90d327b198afb4548ca8fa10e58f39a5dc091d051a7d29d0a2473b", "rh_hash": null, "ssdeep": "96:DG4s4F1kFQELKmZEmewgXAELkTvgmZ2JL:Du4F18/Kee/pLvmZIL", "type": "data", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T19381C9B4D11B8832C85D6F74CCAD910A65F521DC633013671EA49D7EFF27698C0610A7", "sha3_384": "71ac82b6fcd1c95c4bde841f38d29b031a77751795c709b9f28015fb5c649ffdd68d674592587f425c43d062f3d6517f", "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce", "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e", "data": null, "strings": [], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 9, "cape_type": "Unpacked Shellcode", "process_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp", "process_name": "uninstalltool_setup.tmp", "module_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp", "pid": 1404, "virtual_address": "0x04820000" }, { "name": "e7947b0be16fcddb6c01896691ad29e2ecea48b2fafad36e9d6f46339f03fc29", "path": "/opt/CAPEv2/storage/analyses/109/CAPE/e7947b0be16fcddb6c01896691ad29e2ecea48b2fafad36e9d6f46339f03fc29", "guest_paths": "8;?C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe;?C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe;?0x00570000;?", "size": 925696, "crc32": "86E1D6A8", "md5": "10c7d767c1257da418d2c38b6d41e7de", "sha1": "51e4db84b2666541f231e77445cb1b81640d674d", "sha256": "e7947b0be16fcddb6c01896691ad29e2ecea48b2fafad36e9d6f46339f03fc29", "sha512": "36ce6c3b4dcf7523224980678ae87e5f27136e7e588afef9c6532d9db13fe694f2566f41b36b5c4877bba2f8aecfd1b3d5d6fcf3bf346da765cae3aaa31d5135", "rh_hash": null, "ssdeep": "12288:h3C5iae7h6BN/cP3w0PbDG38+SLyBEZ4RnsboNKXS6dW:h3C5iae7h6vaG38+SwEssMNKi6dW", "type": "PE32 executable (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T149154D27A34A633FF85E1A3B86A69A105F3A6791B553CC66DBF44C8CCF251801A3D347", "sha3_384": "3f29e0a64bb3966b537bdcf59404d5803348cec72cc3b72cc734fbf28b96fb5270b049f56c81de1def8316c201cd3519", "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce", "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "File not found: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\109\\uninstalltool_setup.exe", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00570000", "entrypoint": "0x000afe60", "ep_bytes": "558bec83c49053565733c08945b08945", "peid_signatures": null, "reported_checksum": "0x006b373e", "actual_checksum": "0x000e6f52", "osversion": "6.1", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "kernel32": { "dll": "kernel32.dll", "imports": [ { "address": "0x62d2dc", "name": "GetACP" }, { "address": "0x62d2e0", "name": "GetExitCodeProcess" }, { "address": "0x62d2e4", "name": "CloseHandle" }, { "address": "0x62d2e8", "name": "LocalFree" }, { "address": "0x62d2ec", "name": "SizeofResource" }, { "address": "0x62d2f0", "name": "VirtualProtect" }, { "address": "0x62d2f4", "name": "QueryPerformanceFrequency" }, { "address": "0x62d2f8", "name": "VirtualFree" }, { "address": "0x62d2fc", "name": "GetFullPathNameW" }, { "address": "0x62d300", "name": "GetProcessHeap" }, { "address": "0x62d304", "name": "ExitProcess" }, { "address": "0x62d308", "name": "HeapAlloc" }, { "address": "0x62d30c", "name": "GetCPInfoExW" }, { "address": "0x62d310", "name": "RtlUnwind" }, { "address": "0x62d314", "name": "SetFilePointerEx" }, { "address": "0x62d318", "name": "GetCPInfo" }, { "address": "0x62d31c", "name": "GetStdHandle" }, { "address": "0x62d320", "name": "GetModuleHandleW" }, { "address": "0x62d324", "name": "FreeLibrary" }, { "address": "0x62d328", "name": "HeapDestroy" }, { "address": "0x62d32c", "name": "ReadFile" }, { "address": "0x62d330", "name": "CreateProcessW" }, { "address": "0x62d334", "name": "GetLastError" }, { "address": "0x62d338", "name": "GetModuleFileNameW" }, { "address": "0x62d33c", "name": "SetLastError" }, { "address": "0x62d340", "name": "FindResourceW" }, { "address": "0x62d344", "name": "CreateThread" }, { "address": "0x62d348", "name": "CompareStringW" }, { "address": "0x62d34c", "name": "GetFileSizeEx" }, { "address": "0x62d350", "name": "LoadLibraryA" }, { "address": "0x62d354", "name": "ResetEvent" }, { "address": "0x62d358", "name": "GetVolumeInformationW" }, { "address": "0x62d35c", "name": "GetVersion" }, { "address": "0x62d360", "name": "GetDriveTypeW" }, { "address": "0x62d364", "name": "RaiseException" }, { "address": "0x62d368", "name": "FormatMessageW" }, { "address": "0x62d36c", "name": "SwitchToThread" }, { "address": "0x62d370", "name": "GetExitCodeThread" }, { "address": "0x62d374", "name": "GetCurrentThread" }, { "address": "0x62d378", "name": "LoadLibraryExW" }, { "address": "0x62d37c", "name": "LockResource" }, { "address": "0x62d380", "name": "GetCurrentThreadId" }, { "address": "0x62d384", "name": "UnhandledExceptionFilter" }, { "address": "0x62d388", "name": "VirtualQuery" }, { "address": "0x62d38c", "name": "VirtualQueryEx" }, { "address": "0x62d390", "name": "Sleep" }, { "address": "0x62d394", "name": "EnterCriticalSection" }, { "address": "0x62d398", "name": "LoadResource" }, { "address": "0x62d39c", "name": "SuspendThread" }, { "address": "0x62d3a0", "name": "GetTickCount" }, { "address": "0x62d3a4", "name": "GetStartupInfoW" }, { "address": "0x62d3a8", "name": "GetFileAttributesW" }, { "address": "0x62d3ac", "name": "InitializeCriticalSection" }, { "address": "0x62d3b0", "name": "GetSystemWindowsDirectoryW" }, { "address": "0x62d3b4", "name": "GetThreadPriority" }, { "address": "0x62d3b8", "name": "SetThreadPriority" }, { "address": "0x62d3bc", "name": "GetCurrentProcess" }, { "address": "0x62d3c0", "name": "VirtualAlloc" }, { "address": "0x62d3c4", "name": "GetCommandLineW" }, { "address": "0x62d3c8", "name": "GetSystemInfo" }, { "address": "0x62d3cc", "name": "GetTempPathW" }, { "address": "0x62d3d0", "name": "LeaveCriticalSection" }, { "address": "0x62d3d4", "name": "GetProcAddress" }, { "address": "0x62d3d8", "name": "ResumeThread" }, { "address": "0x62d3dc", "name": "GetVersionExW" }, { "address": "0x62d3e0", "name": "VerifyVersionInfoW" }, { "address": "0x62d3e4", "name": "HeapCreate" }, { "address": "0x62d3e8", "name": "LCMapStringW" }, { "address": "0x62d3ec", "name": "VerSetConditionMask" }, { "address": "0x62d3f0", "name": "GetDiskFreeSpaceW" }, { "address": "0x62d3f4", "name": "FindFirstFileW" }, { "address": "0x62d3f8", "name": "GetUserDefaultUILanguage" }, { "address": "0x62d3fc", "name": "lstrlenW" }, { "address": "0x62d400", "name": "SetEndOfFile" }, { "address": "0x62d404", "name": "QueryPerformanceCounter" }, { "address": "0x62d408", "name": "HeapFree" }, { "address": "0x62d40c", "name": "WideCharToMultiByte" }, { "address": "0x62d410", "name": "FindClose" }, { "address": "0x62d414", "name": "MultiByteToWideChar" }, { "address": "0x62d418", "name": "LoadLibraryW" }, { "address": "0x62d41c", "name": "SetEvent" }, { "address": "0x62d420", "name": "CreateFileW" }, { "address": "0x62d424", "name": "GetLocaleInfoW" }, { "address": "0x62d428", "name": "GetSystemDirectoryW" }, { "address": "0x62d42c", "name": "DeleteFileW" }, { "address": "0x62d430", "name": "GetLocalTime" }, { "address": "0x62d434", "name": "WaitForSingleObject" }, { "address": "0x62d438", "name": "WriteFile" }, { "address": "0x62d43c", "name": "ExitThread" }, { "address": "0x62d440", "name": "DeleteCriticalSection" }, { "address": "0x62d444", "name": "TlsGetValue" }, { "address": "0x62d448", "name": "GetDateFormatW" }, { "address": "0x62d44c", "name": "IsValidLocale" }, { "address": "0x62d450", "name": "TlsSetValue" }, { "address": "0x62d454", "name": "CreateDirectoryW" }, { "address": "0x62d458", "name": "GetSystemDefaultUILanguage" }, { "address": "0x62d45c", "name": "EnumCalendarInfoW" }, { "address": "0x62d460", "name": "LocalAlloc" }, { "address": "0x62d464", "name": "GetUserDefaultLangID" }, { "address": "0x62d468", "name": "RemoveDirectoryW" }, { "address": "0x62d46c", "name": "CreateEventW" }, { "address": "0x62d470", "name": "SetThreadLocale" }, { "address": "0x62d474", "name": "GetThreadLocale" } ] }, "comctl32": { "dll": "comctl32.dll", "imports": [ { "address": "0x62d47c", "name": "InitCommonControls" } ] }, "user32": { "dll": "user32.dll", "imports": [ { "address": "0x62d484", "name": "CreateWindowExW" }, { "address": "0x62d488", "name": "TranslateMessage" }, { "address": "0x62d48c", "name": "CharLowerBuffW" }, { "address": "0x62d490", "name": "CallWindowProcW" }, { "address": "0x62d494", "name": "CharUpperW" }, { "address": "0x62d498", "name": "PeekMessageW" }, { "address": "0x62d49c", "name": "GetSystemMetrics" }, { "address": "0x62d4a0", "name": "SetWindowLongW" }, { "address": "0x62d4a4", "name": "MessageBoxW" }, { "address": "0x62d4a8", "name": "DestroyWindow" }, { "address": "0x62d4ac", "name": "CharUpperBuffW" }, { "address": "0x62d4b0", "name": "CharNextW" }, { "address": "0x62d4b4", "name": "MsgWaitForMultipleObjects" }, { "address": "0x62d4b8", "name": "LoadStringW" }, { "address": "0x62d4bc", "name": "ExitWindowsEx" }, { "address": "0x62d4c0", "name": "DispatchMessageW" } ] }, "oleaut32": { "dll": "oleaut32.dll", "imports": [ { "address": "0x62d4c8", "name": "SafeArrayPutElement" }, { "address": "0x62d4cc", "name": "VariantInit" }, { "address": "0x62d4d0", "name": "VariantClear" }, { "address": "0x62d4d4", "name": "SysFreeString" }, { "address": "0x62d4d8", "name": "SafeArrayAccessData" }, { "address": "0x62d4dc", "name": "SysReAllocStringLen" }, { "address": "0x62d4e0", "name": "SafeArrayCreate" }, { "address": "0x62d4e4", "name": "SafeArrayGetElement" }, { "address": "0x62d4e8", "name": "SysAllocStringLen" }, { "address": "0x62d4ec", "name": "SafeArrayUnaccessData" }, { "address": "0x62d4f0", "name": "SafeArrayPtrOfIndex" }, { "address": "0x62d4f4", "name": "VariantCopy" }, { "address": "0x62d4f8", "name": "SafeArrayGetUBound" }, { "address": "0x62d4fc", "name": "SafeArrayGetLBound" }, { "address": "0x62d500", "name": "VariantChangeType" } ] }, "advapi32": { "dll": "advapi32.dll", "imports": [ { "address": "0x62d508", "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW" }, { "address": "0x62d50c", "name": "OpenThreadToken" }, { "address": "0x62d510", "name": "AdjustTokenPrivileges" }, { "address": "0x62d514", "name": "LookupPrivilegeValueW" }, { "address": "0x62d518", "name": "RegOpenKeyExW" }, { "address": "0x62d51c", "name": "OpenProcessToken" }, { "address": "0x62d520", "name": "FreeSid" }, { "address": "0x62d524", "name": "AllocateAndInitializeSid" }, { "address": "0x62d528", "name": "EqualSid" }, { "address": "0x62d52c", "name": "RegQueryValueExW" }, { "address": "0x62d530", "name": "GetTokenInformation" }, { "address": "0x62d534", "name": "ConvertSidToStringSidW" }, { "address": "0x62d538", "name": "RegCloseKey" } ] } }, "exported_dll_name": "SetupLdr.e32", "exports": [ { "address": "0x57e578", "name": "__dbk_fcall_wrapper", "ordinal": 2 }, { "address": "0x62863c", "name": "dbkFCallWrapperAddr", "ordinal": 1 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x000c0000", "size": "0x00000071" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x000bd000", "size": "0x00001028" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x000d5000", "size": "0x00014710" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x006a4930", "size": "0x00004f98" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x000c3000", "size": "0x00011440" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x000c2000", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x000bf000", "size": "0x000001a4" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000600", "virtual_address": "0x00001000", "virtual_size": "0x000ae000", "size_of_data": "0x000ad800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.41" }, { "name": ".itext", "raw_address": "0x000ade00", "virtual_address": "0x000af000", "virtual_size": "0x00002000", "size_of_data": "0x00001800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.22" }, { "name": ".data", "raw_address": "0x000af600", "virtual_address": "0x000b1000", "virtual_size": "0x00004000", "size_of_data": "0x00004000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "5.61" }, { "name": ".bss", "raw_address": "0x000b3600", "virtual_address": "0x000b5000", "virtual_size": "0x00008000", "size_of_data": "0x00007200", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "2.57" }, { "name": ".idata", "raw_address": "0x000ba800", "virtual_address": "0x000bd000", "virtual_size": "0x00002000", "size_of_data": "0x00001200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "5.13" }, { "name": ".didata", "raw_address": "0x000bba00", "virtual_address": "0x000bf000", "virtual_size": "0x00001000", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "2.88" }, { "name": ".edata", "raw_address": "0x000bbc00", "virtual_address": "0x000c0000", "virtual_size": "0x00001000", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.25" }, { "name": ".tls", "raw_address": "0x000bbe00", "virtual_address": "0x000c1000", "virtual_size": "0x00001000", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "0.00" }, { "name": ".rdata", "raw_address": "0x000bbe00", "virtual_address": "0x000c2000", "virtual_size": "0x00001000", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.36" }, { "name": ".reloc", "raw_address": "0x000bc000", "virtual_address": "0x000c3000", "virtual_size": "0x00012000", "size_of_data": "0x00011600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.71" }, { "name": ".rsrc", "raw_address": "0x000cd600", "virtual_address": "0x000d5000", "virtual_size": "0x00015000", "size_of_data": "0x00014a00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "7.30" } ], "overlay": null, "resources": [ { "name": "RT_ICON", "offset": "0x000d54f8", "size": "0x0000d3c4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.99" }, { "name": "RT_ICON", "offset": "0x000e28bc", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.06" }, { "name": "RT_ICON", "offset": "0x000e4e64", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.32" }, { "name": "RT_ICON", "offset": "0x000e5f0c", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.10" }, { "name": "RT_STRING", "offset": "0x000e6374", "size": "0x0000024c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.11" }, { "name": "RT_STRING", "offset": "0x000e65c0", "size": "0x000002e4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x000e68a4", "size": "0x00000400", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.51" }, { "name": "RT_STRING", "offset": "0x000e6ca4", "size": "0x000003d0", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.24" }, { "name": "RT_STRING", "offset": "0x000e7074", "size": "0x000003fc", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.35" }, { "name": "RT_STRING", "offset": "0x000e7470", "size": "0x000002d4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.37" }, { "name": "RT_STRING", "offset": "0x000e7744", "size": "0x000000b8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.34" }, { "name": "RT_STRING", "offset": "0x000e77fc", "size": "0x0000009c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.15" }, { "name": "RT_STRING", "offset": "0x000e7898", "size": "0x0000038c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x000e7c24", "size": "0x00000398", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x000e7fbc", "size": "0x00000368", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x000e8324", "size": "0x000002a4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.29" }, { "name": "RT_RCDATA", "offset": "0x000e85c8", "size": "0x00000010", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "4.00" }, { "name": "RT_RCDATA", "offset": "0x000e85d8", "size": "0x0000038c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.15" }, { "name": "RT_RCDATA", "offset": "0x000e8964", "size": "0x00000040", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.77" }, { "name": "RT_GROUP_ICON", "offset": "0x000e89a4", "size": "0x0000003e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.55" }, { "name": "RT_VERSION", "offset": "0x000e89e4", "size": "0x00000584", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.83" }, { "name": "RT_MANIFEST", "offset": "0x000e8f68", "size": "0x000007a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.89" } ], "versioninfo": [ { "name": "Comments", "value": "This installation was built with Inno Setup." }, { "name": "CompanyName", "value": "CrystalIDEA Software " }, { "name": "FileDescription", "value": "Uninstall Tool Setup " }, { "name": "FileVersion", "value": "Uninstall Tool " }, { "name": "LegalCopyright", "value": "Copyright © CrystalIDEA Software " }, { "name": "OriginalFileName", "value": "uninstalltool_setup.exe " }, { "name": "ProductName", "value": "Uninstall Tool " }, { "name": "ProductVersion", "value": "3.8.1 " }, { "name": "Translation", "value": "0x0000 0x04b0" } ], "imphash": "ac4ded70f85ef621e5f8917b250855be", "timestamp": "2025-11-10 17:25:51", "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAQ30lEQVR4nL2ZeXTV5ZnHP7/t7jf3Zg9rAgQpiwurKCIi1dZBra1YdabtiLa14wxWLKet1s6MU85pHXu0nY7OUJVi1SlSsFVRCFAQIZZUIWwhCVlIyH7vzc3dl986f9AbkhAwduw85+Tkd97z5rnf7/P9vs/z/nIFxhhFj+/5qV2NfmfO3yxNFRUVuDJZsyWVNTYamvbGruV5DWPN82mHMNaNJY9VpVxWwjnz3i/h0gzcoonTMrEMk6wlxvqj2f9RVfXFXbcWH/5rAh4ZYyJQ8IOqSTZDP1tY4mLSjTeghgewOdw4AJdlkS+b5IkWhm6QzJp0xvRfqbr+6o4vle39K+NHHssm05RvEM0M7nHjqCTFdLWRPcc7adWc5I2fQrhoHE7ZjgcolAXmFSurNU1cPX1XiFDE+n0ilXzxrfsq3vlrEBiTAkWP7d5s0+J3T115Y/YnV/rsS/LPrWuGzrYPm9h9rIW6sIqcPxFv4ThcDg9u0cQvQ5EdDM0kmTHpjxlV8UTm5W0PTt2MIFj/bwRKflCVdOhJV8WqO3jnKgHPRXR7v76dqtpW/tQaJm0rxFNYhsflxylZ5EkWhU4B0RSJJ0yS6dDhe2+uPeOV81ephko023m0KXlw7ZrLt773qRLwrKsqcUlGX0GRh8tvWsKWK8UxJT7TG+bNmib+dLqXswkFn388dmchxd4eFk4/bV03rUKwyz50I0FT7CDH+n9LVO3hqWs7x9xYYAxnQJFtNwlmEmdpMXM9Y088payAR75wNQCaBq/XVBEQfs/c8klMybteiAltnInv548dm8hYcdJhBYfvE2EfGwFJsG7DMnGWleiLfOKYDv3QqA+9z+G+d1GKBT474bOYcoK6gd+w/8wGTMEg1isSaDGY7J2VynhPuT51ApZo3YYAtrw8aW7e2JJm9BTHA1XUhfbhcNmonDIHm+Smvns7NZ2vgCAT6xIJtJosqFzO+m/+hCJHuWv1bm/oUyXgWVdVgqm7XAX55NsEocB26WT96Q6O9u2kLXqEwoIiZs6Yg66aHGvbQUP4D1imTLhdIdolsHT2rTz33f/ALjkASCYzxAXN/FQJKLLjJqw0zpJCFnkvvq89epzavncY0LooKypj7uRFDESC7Kv7FX3JFgxDor9ZJtvv5JZFf8fXv7r+ghxSJpx8pL6s5Y2ap+OEWxtp2nW38PDelv8TAVPgNsGw8JQUWlf7peEnzLI4HtrDib7dYNMZXzqByd4F9IXOsq3mKZL6AGpaItgCYjyPL9/wEHcu+vbIjzDY+4sj7Pm53aGrV1w//wvXMGMxySPG/N7W0ub2td/YWv7sC3f9xQQEwfo8WLiL8rlqiP+P9v2Bs/HDWPYkUyrLscsu2nvreOv4s5iCRiYq0Ndk4hcn8q0b17Fizr3DEx/d3sK76/sJtc1j6sKFLP0aGcNPoLqW0MavYsRVvE4Hntmz8i+F79IE1hzKs6ykz+H3kS+LQv4Q/z9dvY5SbxH/eO2/cSK0nT3N/40kyyRCIoHTBpP8s/iXO55kbsXy83/UeSLMW//aRMP+mVRcNY05K6YZvgqCHxwj8OIh0r1xPHYFv6jQYap0RVJ6ZUqYessta+w7dvwi+4kJePPMFZZhkVdSwFXe4VO/K9JFXyJEZ/Bsalfbc65UwE6w2WLmhHk8fv9PmFZ8+bmN8aDOuz+uo+a1IoqnTmD64qu56qf0154m+EY98aaD2GUJl6JgSAr1kaTmvm6pPP/Bbwq90ZTc/NQ/T7lxQVWosvya43Vd163Z+/bTRz6WwJo1a+xOUX3yd5GT3+v1VJJXWsiCEQNGFCRkU2Zf81tqX5PsuqLoZp599OfkOwrObdj3fAO7fiZgt81gxtIr+fJTxFu7Ce4/SfjEJkRDxG2z47M5aeofQL1sul75pTvkVX+7SgHACqPvWc3l//42Qj4eHG3Xtn0UP/y4dM0p2Tv7+VdeefG5HJYLRt+SJUus5rqjJB/4LZZsZ8HKxWxZ5KLEfn7PDS9MQkwrfKZwGl9f/h3mjf88/ft/Q8+2HzPLEUWcvRwqryEdMwi9X0t/bRtGXMdls6Mg0R1P0CvLVtmttwgL/+HrOAv95xJrQdT6tZB4DTkPxKJSssml9B5uJn76KFUBmU375zLrM1NObdmyZfaoCjTU16OLDoxUAk+hiM1mxzXi+qOnJIS4QtZtMWn85SRffgxvRw2Fa/4TLZsltP1tgm++Tbo7idPmwCs7SJgqdYEY7uuu5sqv3cv1SxadL56WQG38J4i9jOQFaVIxmrGMjuo2Qie2ItuAIojGbmfVnfNoOl0/66IWsjscOEyNUM1vLGPWAsHt+Rx3Hga/pTPPZ7C42A5ZET0pYmkSrc1nGdixl+KeBq68x8ap7/8MYSCFw2bHZvPQ1B9BmzSBKV/9CqtW3z2iEkm0xkewYpuQPDrSxDxUczldtSECR7Yi2UAugaqua61QYqUQjXURaT9OIpEYTHEBAcuysASZwu5qgY79HNj9i6x39jX24vkrCM68mg8qFyDpCtmkAKZCW2s7dsMkEoe2d/fhjlj0JA1Op1OU3LKC67/193gmjbsQePOjWJGNSG4dabwDXfgiXaeCdNa8iSKDrRTe61tEZ+cdVqS/Uwj3H0GSJCRJQhDOi3fRLmQJEsgSdrCnTxygsWZnxtBUh9tZwNyn8ol2JYjEY1iChaqq9KsaBZ3d1GcSXP/Mkyy98doLk44EPs6BLt9B54kAnTW/RZLBVQIHQ/No7VhlRfo7hf7gh4IoioiiOAz4xxIYJAKIsoLHl+8wTZNUIq0d2XhG+faaR1hz6w853dXG8UQCNINIOM6q997G5nEMT2Kk0JrWngdeJmMoK+mqz3D2g61IEjiK4Gh8DifP3mtFw91Cf/AjASwkSQIYFfxFCciyjGEYWNb5/m9ZFoIgoBmq8srj25g3bx6pTJJQsB81ncHSDf7U2cP+Z5+mpLCQB77xEHYFtKZHsfqfR3JnEUsEcK6kq1Gk/f23EUVwFcKxxGUca/8KiViA3p4aQRCEPwO/EPRIIqMSyLE2TRPTPH9BTKfTPPPMM8yeM4tUOomYFXnise8zPZBlmWXRmlL50UMPUX3gAG++8EXuWrQT0ZZBLAYcN9PXqtC6/9y7vTMfGrJTOdK5mthAgL7eI1iWiWVZGIaBJEkJwHOp6n8sAUEQEEURXdexLIvCwkJuv/12gsEgfr+fzZs309p4mna7Q3+915Tff/4HnGlp4dZb7+B793+RL99pQ7JuorfFTvN7O8AycHihzZhETff9JGJRujs/xDAMBEFAVVWmTZsWveeee3xr1671TJs2bdAFY7aQZVnI8vll0zSRJIlsNsvKlSuJxWJIksTAwAC//vWvURQFXc3KV1x5FaWVFcSiURQZuhqBM9P44weH0FJxXF7oEsaxv/M+tIzG2faj6LqGKIpomsbEiRMH7rrrrvwJEyb4BEGwSktLBcMwEEVxEFfueUwKCIKAIAiD1cmt5Szl8/lYvHgx27Zt4+677+aBBx5AU1X8fj/hcJgth+0sfqaea+ZDSCjiUM83SKUNzp45hWFog13F6XTGH3zwQW9FRUW+qqoANDU1GYqiyDngn0gBAJvNhqqqSJI0aCFZlqmvr0eSJCzrXOtct24dTz75JKZpkkqlEASBkpIS1q9fT4HPww+rvFrNjw4r+zf8F20tpwYrnqukpmmsWbPG6/V6MU2TeDyeeumll1wnTpyQ8/PzKSgouMAdYyIgyzKWda6FaZqGoigIgsDhw4dJJpMoioKmaUiSRDQaxTAMXC4Xfr+fo0ePsn37dhRFxuVSlM2vvkBbyymG2mEooLKyMgKBQOa1115zVFdXu5xOJ+Xl5YiiOKz6uS44ksSoZ8Butw92g9xvWZax2Ww0NDQwY8aMQYKKouD1enE6ndTW1rJx40bOnj2L1+vNdZNBO44MRVF46aWX2Llzp0MURSZPnoyiKJimeVHwuedLKpBLomnaYBJN05g1axaXXXYZmqYxc+ZMPvzwQ44dO0YsFqOjo4P29nYOHTqE1+sdJvlo0gOIokhtbS1lZWU4HOeG39C2PbKwOfBD94yqgM1mG9yUOwPZbJb777+fVCrFjBkz8Pl8HDx4kJ07d9LV1UVnZyd+vx+fzzdYLdM0MQxjVEC5GAo8V9mhFTZNc9BOOfCjKjBx4kSnpmlllmXhcDgG25amaZimybx585gyZQoApaWl7N69m2g0ykcffYQsy/h8Ptxu9zD5cwAupsBI4KOtDwU91D4ej2em3+9vG9lYSwVBIJPJ4HK5sNvt2Gw2RFHktttuI5PJUFlZSTqd5sCBA+zevRu73Y4kSbjd7sGuNVTNS4EfGbn9OdK555ySgiCQTqfJZrPIslxqmqYwzEJ/7j67amtrby4tLR2s+PTp05kwYQJ2u53i4mI2b95MJBLhzJkzKIqCZVk4nc4LbJcDMBbgl1rP5YvFYqRSKdLp9F6Hw5GCIRbq7OxMV1RUNGSz2cclSdoTDAYfDYVCZRUVFSxcuBBVVZk9eza9vb3U1dVx6NChQf8qijLYWnOgcy34UgRGAz604+S8H4lESKVSZLPZvnA4/FQymdxbWlra2tjYmBqmQFtbWwQ4PH78+IBlWcez2ew95eXl91VUVOD1eikoKGDDhg2Ew2F6enqw2WwYhoHX60UUxcF5MbTnj3YGRt5yRyNjmiaJRIJkMomu61oikdgYi8VeE0WxMRKJBCKRCMMUGBrd3d0dQGD+/PmRBQsW3GeaJpWVlTQ3N9PT00NzczOCIKAoCqIo4vF4sCxrcLgNbXU5K40cQiOBD92TyWRIJBLouk46nd4VCoWeE0WxLhgMtgHD2tqlXmiyy5Yt+2llZSV+vx+3282mTZtoaGigo6MDp9M5eLAcDge5e0zOOhdTYOjBHgleVVUSiQSZTAZd1xsDgcDTgiB8JAhCSyAQSDBKXJTAE088Md0wjOvsdjtTp07lxIkTRKNRq7q6+t1YLLbS5XLh8/nw+XzIsjwIIDe9cwrkhuGlgJumSTKZJJPJoGnaQCQSeS6dTu8RRbEhEAj0XaLIFyfQ39//zrJlyygqKkKWZXbs2EFfX9+m7u7uVrfbPaCq6ore3t5xdrsdv9+PqqqDJHKVH6nAaHZJJpOkUikMwzASicSWRCLxummadaFQ6Awj7DJmAg8//PByh8Mx3ePxUF5eTk1NDdlsVv/lL3+5DVBUVe3Xdb3H7XZPCYVCnxsYGPCWl5djt5/775coioMEhr6aDr0OZDIZ4vE4hmGQSqUODQwMbACOAs3BYHBUu4yZQCqVevWKK67A4/FgGAbV1dW0tLT8HEgATk3TjpeUlLyhKMo4XderDMO4p7m5eYXf76esrAxJkobNgaHAdV0f6vOOSCTynGmaNYIg1H+cXcZMQFXV8U6nE6fTyb59+9B1Pfb666+/CriAU0AwEAgA9E2cODFomuZZ4EAsFrsvFotVlJWV4ff7AYadiSE+T0Sj0Zez2ewfLMs6GQwGWxmDXcZMwGazIUkSra2t1NfX09TU9F2g988/w6Kzs7MLCE2aNKnbsqwW0zRv7OnpuTMSieTlJmgymSSZTGIYhpFMJt+Nx+O/B2qBpk9ilzETsNvt9508efJpVVWtVCq1fuvWrRs+Jk+2o6PjpMfj6fN6ve2yLO/LZrNLBEFYrWmaLRaLoev6G/39/b8TRbEDaAwGgxcU4y+JT/7F7MeHWFBQ4CktLZ2sKEop4DIMI2lZVl9vb29HOBxOAJ/4y7yLxf8Cqcce7B/KtMAAAAAASUVORK5CYII=", "icon_hash": "4740e8214f71a7b8bfa204b086a75d41", "icon_fuzzy": "1a1010aa6a1d01679c6b3c7d467dd16a", "icon_dhash": "7cfccce0d88ce672", "imported_dll_count": 5 }, "data": null, "strings": [ "JTDictionary.TValueEnumerator", "+TArray", "8/878H8Z8b8p8~8", "3TDictionary&", "(A;OICI;", "&op_UnaryPlus", "FAsUByte", "|Winapi.Windows.PkgHelper", "ClassInfo", ":6:::>:B:F:J:f:}:", "$]_^[", "7,7;7]7|7", "505b5f5t5", "<(<0<8", "Invalid destination array\"Character index out of bounds (%d)", "2$242:2J2]2k2z2", "ShortInt", "9*989N9c9q9", "FBufPos", "Range check error", "System.UITypes", "7/7:7\\7", "!TMethodImplementation.TInvokeInfo\\", "< <0<8.TValueCollection;", "Comparer8w[", "stdddddddddudddddddddddddddv'wxyz{|}~", "<0<>.TPairEnumerator<", ">1>D>W>l>", "TLZMA1SmallDecompressor'", "BHl~q", "iso_8859-6", "8H8s8", "ReturnTypeInfo", "FromOrdinal", "}c+F@nA", "Ancestor", "aaaaa", "VOleStr", "\"IComparer", "819G9[9", "ExceptionRecord", "Message", "", "$TMultiReadExclusiveWriteSynchronizer", "878M8^8r8", ";\";7;O;W;_;g;o;w;", "AIdentToInt", ":$:(:P:w:", "787<7e7s7", "TReader", "838H8^8u8", "626=6B6R6]6b6r6}6", "ATicks", "SetEvent", "t=HthH", "tkWString", "FOffsets", "PIntfMethodEntryTailx$Z", "PTypeData", "022A2", "IsClear", ":+:A:R:_:g:u:", "Property '%s' is read-only", "iso-ir-148", "=;=E=I=h=", "elType2", "ReturnType", "2\"2)2@2D2H2c2g2k2", "3\"383I3^3l3", "AMPM ", "Ancestor for '%s' not found", "TCustomDecompressorClass", "CurrentBuild", "Boolean", "FAsSingle", "CriticalSection", "]TEnumerable>", "DictionarySize", "TProcedureParam", ":$:(:,:0:8:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "FClients", "VLongWord", "WaitForAny", "TPropSetK", "$TEnumerablel", "ADelay", "=/>=>K>Y>g>t>", "MovEBP_ESP_1_89", "UninstallDisplayName", "Invalid property path", "iso-8859-8", "GetDriveTypeW", " ", "WizardSmallImageBackColor", "TMultiWaitEvent", "WizardSizePercentX", "PropInfo", "sms-FI,sms,se", "FreeEncodings", "DebugInfo", "1TList.TEmptyFunc", "EVariantArrayCreateError8", "UnsafeAttribute@!W", "Variant overflow", "_RTL_CRITICAL_SECTION", "7TArray>", "GetArgLoc", "2,2?2M2c2v2", "TFileSharing", "TGlobalContext", "AsVarRec", "crGreaterThan", "UnitScope", "hij@klmn-opqArstuBwxyz{|}~", "TComponentStyleItem", "AObject", "TBasicActionLink", "LookupRoot", "0-0[0", "Saturday", "EVariantError(", "PProcedureParaml\"Z", "TPropSet", "January", "%s[%d]", "6>6L6", "?#?'?+?/?k?", "+IEnumerable", "WriteBufferData", "HTDictionary.TKeyCollection;", "1K2O2|2", "6#606D6Q6f6|6", "PInstItem", "", "@TDictionary.TItem", "7b7o7", "user32.dll", "iso_8859-9", ";+;B;W;e;t;", ":@:y:", "4(40484@4H4P4X4`4h4p4x4", "TRttiMethodType|", "5h5z5", "?,?8?", "`>g>", "UnaryOp", "9 9$9(9,9094989<9@9D9H9L9P9]9n9", "TDuplicates", "iso-2022-jp", "3!3/373E3W3g3o3}3", ";(;6;J;W;_;m;", "Uh9e]", "vaInt8", "7 7$7(7,7074787F7N7`7r7", "SetArg", "Extended", "EAccessViolation", "4I6h6", "TRttiMethodTypeQ", "(basic) procedure ", "0#090L0T0b0p0", "This program must be run under Win32", "AElCount", "$TList(", "ATypeInfos", ":$:,:4:I:W:_:p:", "*TEnumerator(", "FInBufferAvail", "STATIC", "DeleteFileW", "GetValue", "ReadResHeader", "AQualifiedName", "Windows 2000", "mkProcedure", "SetProc", "4!444E4X4f4z4", "2t3{3", "TChaCha20Ctx@", "", "LongBool", "6@6{6", "/DIR=\"x:\\dirname\"", "ftDouble", "9Y:]:a:e:i:m:q:u:y:}:", "UhRxW", "tpTimeCritical", "Variant", "TRttiPointerType8", "AClient", " !\"#$%&'(!)*+,-./0'", "TPoolToken<#\\", "SVWUQ", "DropContext", "UInt64", "GetBytes", "StringKind", "Invalid destination index (%d)", "ibm863", "AItems", "NumPermissionEntries", "8 8p8", "EArgumentOutOfRangeException$qX", "OnNotify,", "Shared.SetupEntFunc\"Compression.LZMA1SmallDecompressor", ";+;=;V;g;u;};", "?!?/?C?P?X?f?x?", "cspc8codepage437", ";*;.;2;6;:;>;B;F;J;N;R;V;Z;x;|;", ">C>c>", "TArray", "csReading", "DesignInfo", "8 8$8(8,8084888<8@8D8H8P8X8z8", "FLoaded", "TEnumerable", "TRttiObject", "GetPreamble", "? ?$?(?,?0?4?8?.ParrayofT", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;a;v;", "011Qm", "EVariantArrayLockedErrorx", "091&2G2X4g4n4", "? ?$?(?,?4?8?'", "iso-ir-149", "TPoolToken&", "<(<>4F4N4V4^4f4n4", "435C5M5f5", "Exponent", "525C5Z5h5y5", "FAttributeGetter", "0!0'0,02070=0D0J0V0^0g0s0y0", "ACapacity", ";K;u;", "7#747A7I7Z7i7q7", "t]gdt", "TRttiInstanceProperty", "7&8>8G8R;Y;", "2%262I2Q2_2v2", "=$=,=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=p=", "count64", ";TDictionary.TValueCollection", "DTDictionary.TValueEnumerator ", "System.Math", "AsOrdinal", "/Lang=", "3 3$3(3,3034383<3@3D3H3L3P3d3p3t3", "FFinished%", "TWriter(", "ClassName", "em92a;", "/NOSTYLE", "3N3v3", "TObservers.TCanObserveEvent", "(TList.TEmptyFunc", "/TEnumerator", "TPrivateHeap&", "CompiledCodeText", "Specifies the internal name of the language to use.", "EVariantDispatchError0", "EnterCriticalSection", "t$>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>x>", "iso-8859-2", "EVariantBadIndexError", "Event", "Extract", "TRttiManagedField", "$IComparer", "csDesignInstance", "Construct", "TCriticalSection&", "ResetEvent", "Invalid pointer operation", "HandleU", "dupAccept", "FIndexedProps", "GetPackages", "pnU`Y", "@u*1`Iu", "TotalElementCount", "MH)Xe", "ReadVar", "=D=Y=j=", "TPropSetV", "TRttiInstanceFieldClassictj\\", "]TEnumerator>0", "hz-gb-2312", "3 3(3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3z3", ">*>=>P>^>p>", "AsBoolean", "StartGroup", "aTEnumerator>(", "0,0;0C0Q0c0q0y0", "fsNZero", "BeforeDestruction", "cp775", "9);0;Q;X;", "7&7x7", "? ?$?(?,?D?V?Z?x?", "Item1", "cp1250", "Out of memory", "FBuckets", "c6?Bwk", "ITDictionary.TItemArray", "%LazyLoadAttributes.MakeClosure$ActRec", "5$5,545<5n5", "!TArray", "%TEnumerable", "303c3n3t3", "3<3U3x3", "vaWString", "Thursday", "TBasicAction", "csLoading", ";E&", "2H2t2", "7TCollectionNotifyEvent", "StringFileInfo", "7F7^7n7x7", "FActiveClass", "pfConst", ">+>A>T>b>u>", "cnDeleting", "TList&", "cspc862latinhebrew", "InnerException", "opaque_BufferLim", "QualifiedClassName", "TFilelCa", "3-3;3Q3f3t3", "HeapCreate", "4(4L4P4w4~4", "$IComparer", "FOnChange", "FromMilliseconds", " ", "doOwnsKeys", "SVWUj", "5&5.5?5P5X5i5z5", "eucjp", "2V3m3", "_od#:.", "InitObservers$1$Intf", "OnlyBelowVersion", "8*8<8_8c8", "232@2H2V2h2y2", " index ", "&op_GreaterThan", "aTEnumerable>'", "6$6,6:6G6Y6k6s6", "{}xMw", "TRttiDataMemberE", "VDouble", "OnFindComponentInstance", " TList.TEnumerator", "PTypeInfo", "PProcedureSignature", "ParentInfo", "MethodKind", "&TEnumerator(", ",TEnumerator,", "Collection", "iso-8859-11", "? ?$?(?,?0?4?8?.arrayofT", "cp869", ".ParrayofT", "csibm861", "2,2A2Z2k2", "FEvent", "JTDictionary.TValueCollection;", "6 6$6,64686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "TMBCSEncoding&", "MaxClassesInCache", "Setup", "ibm860", "3L4b4y4", "0 1+141D1L1T1\\1`1d1h1l1p1t1x1|1", "ListP", "CompType", "IntfUnit", "=F>Q>\\>", "SafeArrayAccessData", "VariantClear", "CharCount", "", "9.959U9l9", "FFieldType", "FBlockedCount", "IEnumerable", "iso8859-13", "TVarData", "7.767G7U7]7k7x7", "Overrides the default directory name.", "DynArrAttrData", "=#=G=K=n=", "TListSortCompare", "euctw", "wdsDynamic", "IsType", "2J2r2", ";C$tI", "FInnerException", "9aBcPaH.TPairEnumerator", "AIndex", "^>", "GetLastError", "List$([", "TValue", "ReadInt64", "AppPublisherURL", "?F?}?", "FAsObject", "6 6$6(6,60646T6o6s6", "(TRttiPool.GetPackageList.DoUpdate$ActRec`", "wdsDark", "505@5H5P5X5\\5`5d5h5l5p5t5x5|5", "Params", "878;8b8l8", " AMPM", "5-5;5Q5f5t5", "1%2G2", "TRttiPackage", "S0_^[YY]", "]TEnumerable>'", "FValueCollection", "pfVar", "System.Hash", "DialogFontBaseScaleWidth", "#TThreadList", "Type_18", "1(2=2K2]2l2t2", "UhR[Y", "FStackSize", "FSize", "EVariantUnexpectedError", "csibm869", "0%0-0;0J0`0n0v0", "= =$=(=,=0=4=8=<=@=H=P=X=", "Comparert'[", "/RESTARTAPPLICATIONS, /NORESTARTAPPLICATIONS", "EntryCount", "TEnumerator(", "ListA", "9\":R:i:", "-IComparer", "iso8859-16", "xXZZ\"", "6,777", "TThread.TSystemTimes ", "/HELP, /?", "ibm865", "686C6r6y6", "?2?L?e?}?", ",IEnumerable", "Default", "iso-celtic", "7a-eF", ":&:5:=:L:", "IsValidLocale", "4 4$4(4,404L4c4g4", "6'6/676?6G6O6q6", "5$656]6n6", "=5=>=", "&TEnumerable'", ";4", "IInterfaceComponentReference", "ProductName", "Collisions", "4#4'4+4/43474;4?4y4", "'TArray", "AIntf", "|@vp/?3?Z?d?", "/TList.TEmptyFunc", "MakeWithoutCopy", "UhG^Y", "TListTh`", "NumIniEntries", "RemoveComponent", "2@2a2", "\\P=FP*", "vaTrue", "VUInt32", "#,,.Q", "TlsSetValue", "AHelpContext", ">", "EMathError4{X", "646w6U7c7q7", "9 979;9?9Z9b9z9~9", "TStream ", "CTCollectionNotifyEvent", "\"IComparer", "2TList.TEnumerator5", "ReadCurrency", "RttiDataSize", "Invalid argument to time encode", "Rni($", "/FORCECLOSEAPPLICATIONS, /FORCENOCLOSEAPPLICATIONS", "UhcG`", "TRttiPool&", "windows-1252", ">>>e>v>", "_RTL_CRITICAL_SECTION_DEBUG ", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "Entry", "=2=@=X=g=o=", "Invalid access$Error creating variant or safe array)Variant or safe array index out of bounds", "<$<@ >$>(>,>0>4><>", "CheckTokenMembership", "sr-Latn-RS", "8X9_9", "TypeKind", "TRttiManagedField\\", ")TList.ParrayofT", "LicenseText", "SaveToFile", "=8=H=P=X=`=d=h=l=p=t=x=|=", "System, [", "iso_8859-14:1998", "5.6C6T6i6w6", "TInterfaceEntry", "csisolatinarabic", "3 3$3(3,3034383<3X3o3s3", "PVmtMethodExEntry", ":TDictionaryH", "LockCount", "TIntfMethodEntryTail", "[KCpJ", "AParameters", "iso8859-3", "FTypeToName", "ReadData", "Equals", "4,4=4O4e4}4", "%LazyLoadAttributes.MakeClosure$0$Intf", "PM^w`8/w", "GetString", "GetDiskFreeSpaceW", "6,646<6D6H6L6P6T6X6\\6`6d6h6l6p6x6", ">D?\\?", "849m9", ":*:A:j:", "vaBinary", "EVariantBadVarTypeError", "3,3B3P3`3r3", "7\\8a8", "^^bVIb", "1o1w1", ";*;A;U;a;", "Argument out of range", ")TList&", "TRegGroups&", "889X9`9", "878V8", "ToString", "?3?K?S?[?c?k?s?{?", "immett", "laDestUnique", "Address", "PList|_^", "opInsert", "ABuffer", "AElType", "7$7(7,70787@7D7H7L7P7T7X7\\7`7d7h7l7z7", "=3=I=^=l=", "FBufSize", "2~2`3u3", "7#898J8^8f8w8", "%TEnumerable'", "TMethodImplementationp", "Windows Server 2008", "8)888", "property ", "Thread", "macthai", "<#<5<=", "<,<<.TPairEnumerator", "VTEnumerator>hT[", ">wp0>wP4>wp", "TSynchroObject", "9.9?9]9k9", "AOwnsObjects", "AAccess", "", "__dbk_fcall_wrapper", "Uh6 \\", "UnhandledExceptionFilter", "LongTimeFormat", "tis620.2533-1", "smn-FI,smn,se", "RootName", "QK#=u", "=\"=1=H=`=d=", "ccCdecl", "prLowest", ":TFormatSettings.:3", "TRttiPackage'", "utf-16le", "procedure ", "TRttiIntfMethParameter6", "PAnsiChar0", "25292W2[2v2z2", "TThreadLocalCounter'", "FStatus", "vaNull", "<'", "EStackOverflow", "TRttiInterfaceType=", "PVariant", "=+=@=L=T=e=p=x=", "csunicode", ":%:::H:^:t:", "2#282X2f2w2", "Unlock", "=\\>l>t>|>", "BeginInvoke", "VarR4FromStr", "AComponent", ":\":*:8:F:]:p:x:", "GNo single cast observer with ID %d was added to the observer collectionFNo multi cast observer with ID %d was added to the observer collection$SHA2: Cannot update a finalized hash", "RawData", "GetReferenceToRawData", "tkVariant", "/LOG=\"filename\"", "IEnumerable", "CappedSize", "SleepConditionVariableCS", "FGHIJKLMN&OPQRS", "greek8", "AIntegerType", "ALeft", "GetCurrentThreadId", "?\"?4?G?Z?n?", "DTDictionary.TValueCollection;", "ReadMethod", "OnChange", "BTDictionary.TKeyCollection;", "0!020G0U0k0", "DTDictionary.TValueEnumerator", "0'0~0", "WU|UEm", "FromDays", "TMultiWaitEventImpl&", "InstanceRoot", "<\"<1<9.TPairEnumerator", "Finished", "HeapFree", "=(=8=@=P=X=i=q=", "AppSupportURL", "rDlPtS", "= =$=(=,=0=4=8=<=@=D=H=U=i=q=y=", "iso_8859-1:1987", "ITDictionary.TKeyCollection;", ",TEnumerator(", "2 2(2,2024282<2@2D2H2L2P2T2X2\\2`2m2~2", "=,=@=D=d=t=|=", "L6Mel", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "iso8859-9", "4(484@4H4P4T4X4\\4`4d4h4l4p4t4x4|4", "l>}>", "<(<0<>", "TArray", "???N?V?h?", "csiso2022jp", "IDispatch", "5O6S6z6", ".rdata", "FReadPropData", "< <@<[<_,>:>M>c>t>", "1TList.TEnumerator", "File not found", "UpdateAction", "VWord", "LockSemaphore", "Uninstallable", "<,>N6", ":!:0:C:I:W:[:j:}:", "UhtbY", "TTimeSpan", "ftSingle", "OnNotify4s^", "zh-HK,zh-Hant,zh", "&((((", "=/=C=K=\\=j=r=", "94:C:", "TCustomComparer", "TRttiType3", "9(9<9T9o9", "KTDictionary.TValueEnumerator", "QualifiedName", "VarNot", "VarType", "Currency", "TThread", "3'3/3L3\\3d3l3t3x3|3", "8-8=8", "8'9c9r9", "CloseApplicationsFilterExcludes", "SizeOfMem", "Uh#sY", "AParent", "TStrongRandom: Failed to get address of BCryptGenRandom", "707@7D7H7P7X7\\7`7d7h7l7p7t7x7|7", "GetDataSize", "iso-8859-3", "cnAdded", "2TList", "WriteDate", "ExtractAt", "IOp6TL,j}", ">2>B>J>[>w>", "1!1<1W1p1", ";0;G;Z;s;", " ", "TSeekOrigin", "4#4-4;4E4T4X4`4d4l4p4x4|4", ";0DGG", "iso_8859-14", "<&=;=I=[=j=r=", "-Winapi.ImageHlp", "vaIdent", "Destroying", ";+;3;D;b;f;", "2 232B2X2g2o2}2", ">!>/>A>S>[>i>x>", "IDATK_cS|", "FNameToType", "ItemClass", "FFile", "GetCPInfoExW", "=*=8=L=Y=a=o=", "DeleteCriticalSection", "BTDictionary.TKeyCollection`", ">0>A>O>W>e>{>", "PRecord", "EMonitor", "bs-Latn-BA", ":!:6:D:W:l:z:", "0 0$0(0,0004080@0D0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "8(8,8084888<8r8", "+TList.TEmptyFunc", "515B5T5b5o5", "FTail", "!TArray", "AOpenArray", "3TPair", "FHandle", "UnsafeAttribute", "001P1_1o1", "macromania", "UhqI_", "%TEnumerable", "?\"?0?>?J?X?", "RecInfo", "404K4\\4p4t4", ")TList.TEnumerator5", "DWWWe?", "ccReg", "P]_^[", "9TDictionary4", "FSentinel", "System.VarUtils", "7)7T7c7g7", "DialogFontName", "NameIndex", "IntfGuid", "8*979o9", "Uh^e]", "9 9$9(9,9D9`9l9p9t9x9", "SafeArrayGetUBound", "csCheckPropAvail", "FHandleToObject", "4 4,4?4R4`4h4}4", "?+?z?", "8-8P8d8w8", "'", "iso8859-11", "", "TDateTime", ">3>?>M>", "TProcParam6", "3%3-353=3[3w3", "Translation", "AppPublisher", "?!?I?z?", "Bounds", "FileName", "FOnExecute", "4-454:4F4K4R4]4f4r4", "0TArray>", "Uh`]a", "=$>4><>D>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "ENonPublicType", "FMMaped", "QTArray>", "/HELP", "fsZero", ";c'", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>", "<,.TEmptyFunc", "Observer is not supportedLCannot have multiple single cast observers added to the observers collection4The object does not implement the observer interface5Insufficient RTTI available to support this operation", "FatalException", ",TList.TEnumerator", "Stream read error", "?%?3?C?U?r?", "", "TRttiIntfMethParameter", "TOrphanPackage&", "FPosition", "8D8d8", "// NOP", "4!4%434A4L4", "=!=7=;=E=M=U=", "3!4.4?4V4d4t4", "=TList.TEmptyFunc", "Abstract ErrorKAccess violation at address %p in module '%s' (offset %x). %s of address %p", "P8^[]", "tkProcedure", "2 2G2Q2U2t2", "TRttiInvokableType'", "9%939B9U9h9v9", "pfOut", "313<3D3l3w3", "Pointer", "&TThreadList", "9(9G9k9", "TComponentStyle", ":;;Q.", "2/272E2T2n2|2", "6/6K6Y6l6", "System.Variants", "0)1g1", ")AkBpm", "0O1S1", "WizardImageBackColor", "0.060H0", ">$>6>K>Y>a>p>x>", "DefaultHandler", "`.itext", "TEnumerator`", "56789", "FDecrypt", "OTDictionary.TValueEnumerator|", "PVmtMethodEntryTail8 Z", "BuildUp", "747B7Y7n7|7", "EndWrite", "MIMEName", "SetSpinCount", "TEnumerator(", "tkFloat", "/TASKS=\"comma separated list of task names\"", "FCanObserve", "VDate", "ExecuteTarget", "ecma-114", "EInvalidCast", ";TDictionary.TValueCollection;", "ibm437", "ElCount", "IsOpenArray", "@.reloc", "7*727@7P7d7l7z7", "?'?9?G?U?d?l?z?", "RemoveItem", ">#>.>", "TRttiStringTypep", "ProcessLocksList", "#IEnumerable", "Priority", "?\"?*?8?J?Y?a?o?", ":+;J;G=p=", "E*};_", "InfoBeforeText", "&TListl", "7\"717B7U7a7n7}7", "868D8S8c8u8", "FStackInfo", "3 3$3(3,3D3W3[3|3", ";!;);1;9;A;I;Q;Y;a;i;q;y;", "RootAncestorH", ":G:K:O:S:W:[:_:c:g:k:o:s:w:{:", "040B0Q0a0s0", "BkU'9", "EAbortLsX", "8'8/8M8m8~8", "6 6>6a6", "FIndex", "FCapacity", "jjjjjjj", "TSetupVersionData", "?/?E?X?`?n?|?", "opaque_RemainLen", "3 3$3(3,3034383<3`3~3", "FExecuteAfterTimestamp", "TCollectionItem\\", "TRegGroups,", "GetCurrentThread", "253\\3", "asmo-708", "0 0$0(0,0004080@0r0", "6$696G6Z6o6}6", "ReadBoolean", "/COMPONENTS=\"comma separated list of component names\"", "212c2h2", "TRttiInterfaceTyped", "FResultFP", "windows-1254", "TFindMethodEvent", "Buffer", ".edata", "1 1$1(1,10141A1T1e1{1", "=,=:=P=e=s=", "AsRecord", "TList&", "TIdentToInt", "(TList.ParrayofT", "dkVtable", "%IEnumerable", "CIDAT", "ConvertStringSecurityDescriptorToSecurityDescriptorW", "= =$=(=,=0=D=S=W=x=", ";%;-;5;=;E;M;U;];e;m;u;};", "#IEnumerable", "VarBstrFromBool", "NameThreadForDebugging", "EVariantInvalidArgError", "ifUnused3", "/ALLUSERS", "FResultLoc", "t f;J", "IsStatic", "0 0$0(0,0004080<0@0D0H0L0T0\\0d0", "ExceptionCode", "VarDateFromStr", "DVCLAL", "D$hPuz", ";#;:;A;K;O;l;p;", "laXor", "~]x[[)", "300@KK", "'u);7~%", "%System.Classes", ":!:8:M:[:r:", "TRttiIntfMethod", "Delete", "TRttiArrayType", "InitInstance", "Alias", "090C0h0x0", "lmOverwrite", "/NOICONS", "cmBzip", "GetTickCount", "2&242G2^2l2", ".TList.ParrayofT", "5%6)6P6Z6^6|6", "iso-ir-101", "+5fM\\", "EReadError", "HTDictionary.TKeyEnumerator;", "8g8t8", "363W3r3", "AItem", "InitDecryption", "Q4_^[]", "ZE6?D", "TSetNameEvent", "|||%yyy", "<9<>l>", "CurrencyString", "9.:2:Y:c:", "DisposeOf", "ASharing", "6,646<6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6", ":(:1:", "opaque_Probs", "ExceptionFlags", "7n048", "(TArray", "CreateFmt", "WriteInteger", "EIntOverflow", "TDictionaryOwnership", "ccSafeCall", "7&9;9F:", "cp936", "BaseType ", "30343;3N3b3w3", "TVmtFieldEntry", "UnitName", "EraStart", "skAnsiString", "<-<;3Q3b3u3", "CurrentH5_", "Compressed block is corrupted", "Windows 7", "lstrlenW", ";1;>;O;Y;a;o;", "5!535I5Z5m5~5", "Wednesday", "FMethods", "Invalid code pageNNo mapping for the Unicode character exists in the target multi-byte code page", "TRttiProperty", "~v8E]A=48R", "5K6`6n6", "4l5}5", ">w0u=w", "ImplGetter", "5#5:5O5]5q5", "6&616B6W6m6w6", "ftComp", "/TList.ParrayofT", "#IComparer", ":4:D:L:T:\\:`:d:h:l:p:t:x:|:", "4)4;4I4Z4n4", "<,<;+>8>H>", ";$;3;;;I;\\;k;s;", "0)010B0P0X0f0t0", "FObservers", "<\\=e=", "TEnumerator(", "8T8r8", "ACollection", "Read64", "NumTaskEntries", "&TEnumerator(", "WizardImageBackColorDynamicDark", "IsRegistered", "SystemTimes", "3TList.ParrayofTdv[", "TRegGroup", "TLightweightEvent&", "Winapi.SHFolder", "AAncestor", "Origin", "6,6@6S6g6{6", ";&;=;R;`;w;", "FClass", "#TEnumerator(", "TWriterProc", "/MERGETASKS=\"comma separated list of task names\"", "PCurrency", "4#494Q4V4", "Instructs Setup to create extra logging when closing applications for debugging purposes.", "List count out of bounds (%d)", ":1:J:`:~:", "4&484J4\\4q4", "1 1$111H1]1e1", "BTDictionary.TKeyEnumerator;", "5+5?5P5h5", "0$040<0D0L0P0T0X0\\0`0d0h0l0p0t0x0|0", ",TList.TEnumerator5", "TArray", "TRttiRecordMethodl", "iu-Latn-CA", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", ">0>A>M>~>", "gb2312", ": :$:(:,:0:8:S:b:j:x:", "2(282@2H2P2T2X2\\2`2d2h2l2p2t2x2|2", "Reset", "TInstItem", "0:1?1X1h1y1", "=\">6>q>d?", "0 0(00080@0H0P0X0\\1`1d1h1l1p1t1x1|1", "BufSize", "0%1_2", "2 2$2(2,2024282<2J2\\2n2", "CrystalIDEA Software ", "SafeCallException", "1*1H1\\1d1", ";j;q;", "*TEnumerablet", ";E~?", ">D>Y>b>", "34934", "FAsComp", ":%:4:D:H:L:T:\\:`:d:h:l:p:t:x:|:", ";+;E;M;^;};", ":%:3:B:U:o:}:", "SetupLdr", "?9?s?", ":%:,:6:M:v:", "3*3G3U3b3t3", "t,HtYH", "262b2n2y2", "opaque_Properties", "<@t!QS<$t", "RegisterClass", "WaitForAll", "WriteSignature", "SignatureU", "ONNR.", "AThreadID", "Listh3\\", "System(", "1#191P1e1y1", "EObserverException", "7%7:7N7d7", "Right", "TBasicActionLink7", "<'<<:H:l:", "9#:<:z:", "OnNotifyU", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "lmAppend", "070B0H0z0", "SpecialCryptContextType", "TDictionaryOwnerships", "CreateRes", "TUTF8Encoding", "PVmtFieldClassTabD", "<61E1L1S1Z1a1x1|1", "3\\3`3d3h3l3p3", "big-five", "0C0|0", "515R5y5", "frbbbG", "FAction", "2'3+3/333A3O3[3h3", "6#646}6", "EraEnd", "/LANG=language", "Writer", "IsObserving", "VRecord", "GetOpenArrayArg", "?'?5?G?^?l?", "TDirection", "System.Generics.Collections|", "CastToOle", "T*177gi", "D:\\Coding\\Is\\issrc-build\\Components\\ChaCha20.pas", "6-6?6M6Z6l6", "prNone", "IEnumerable", "TPropSet", "QQQQSV", "Uh5X]", "7$777M7^7", "TList'", "es-ES_tradnl", "az-Latn-AZ", "IComparer", "FTerminated'", "?@?]?u?", "VAnsiString", "tkString", "ContainsValue", ">-?:?N?]?t?", "BestGroup", "BeginReferences", "9TDictionary&", "euckr", "?\"?9?A?a?v?", "UhkR`", "9!:h:l:p:t:x:|:", "EraName", "TList.arrayofT", "SVWRPj", "LibModule", "1^1s1", "FOnFindMethod", "9!9%9)9D9d9h9", "Index", "WelcomeFontSize", "TypeSize", "dkInterface", "$TEnumerable", "IInterfaceList", ")IComparer", "1+1<1^1k1|1", "TListEnumerator5", "+TList.TEmptyFunc", "6 6C6G6n6u6|6", "FActionComponent", ". %s range is 0..%d", "AppName", "TPropSetK", "TArray", "4\"444K4Y4i4{4", "FPropName", "TEnumerator", "ExceptObject", "Uhy|]", "GetEnumerator", "&IEnumerable", "iso-8859-10", "6O7[7n7|7", "GetLocalTime", "TypeRef", "Instructs Setup to install in non administrative install mode.", "9TObjectDictionaryM", "Uh6+a", "3#343>3F3T3e3y3", "WriteIdent", "Instructs Setup to load the settings from the specified file after having checked the command line, or to save them to it.", ":0;S;^;", "4 4(464D4", "*TList.TEmptyFunc", "%TEnumerator4P_", "MaxLength", "G0]_^[", "EInvalidOp", "WriteVariant", "FStateAndSpin", "6 6(6,6064686<6@6D6H6L6P6T6b6j6|6", "FList", "Chars", "`.data", "IsObjectInstance", "WriteFile", "Int64AttrData", "=-=A=I=W=i=w=", "pfArray", "A1_d`p", "WaitAll", "TVarArrayBoundArray", "ComponentClass", "TAsyncConstArrayFunctionEvent", "CTDictionary.TPairEnumerator;", "L]_^[", "The password you specified is not correct. Please try again.", "?!?2?M?h?p?x?", "/CURRENTUSER", "253B3", "0 0:0H0W0j0", "EArgumentOutOfRangeException", "ntdll.dll", " TArray", "9\"9&9*9E9M9e9i9", "6`7m7", "UninstallLogMode", "FAsDouble", "%TEnumerator(", "TEnumerableD", "FOwnerships", "?Y>G?h?", "FWriteSignal", "TArrayTypeData", "==DBAV", "EncryptionBaseNonce", "Component", "<*=9=", "8@TList`1.Pack[1]$ActRec\\(a", "7B8m8", ">%>3>@>V>Z>q>{>", " IEqualityComparer", "prPowerUser", "TRttiParameter", "TThreadPriority", "csbig5", "IsImplementorOf", "9&9.9<9J9m9u9", "2TList.arrayofT", "OpenProcessToken", "3%3;3?3I3Q3Y3", "TMethodImplementation.TFloatReg", "3TDictionary", "AppReadmeFile", " ", " hD:a", "TwoDigitYearCenturyWindow", "*TEnumerator", "7:8I9[9", "3.8.1 ", "Duplicates", "TFieldExEntry", "FClassList", "1/161M1", "TimePMString", ";2;\\;v;", ">TDictionary&", "4(464F4\\4r4", "5TList.TEnumeratorpy[", "DTObjectDictionaryh", "}]]x<", "1)1H1T1X1\\1`1h1p1t1x1|1", "EncodingName", "DirExistsWarning", "iso_8859-1", "_Reserved1", "Queue", "=9=c=", "Keys8", "TOrdinalIStringComparer", "LocalAlloc", "TListSortCompareFunc", "AFilename", "407n7", "en-US,en,", "FRefCount", "PFieldExEntry", "UhRYZ", "5 595A5O5]5q5y5", "/RESTARTEXITCODE=exit code", "EHeapException", "9TDictionary.TKeyCollection;", "Comparer`", "KTDictionary.TValueCollection;", ":%:3:;:I:X:", "TMemoryStream", "TRttiIndexedProperty", ";*w@1>w", "1$121:1H1Z1l1t1", "FDecompressor", "vaUTF8String", "*TDictionary&", "?$?5?W?d?u?", "8;9N9", "SafeArrayPtrOfIndex", "PRTLCriticalSectionDebug", "=<>f>", "FVarType", "232Q2_2z2", "<<%?:?H?`?t?|?", "Contains", "4Z!S= ", "4+4B4U4f4y4", "?&?P?", "0,090A0N0T0d0q0w0", "UhaH`", "Winapi.PsAPI", "Truncate", "FKeyCollection", "ibm855", "PPTypeInfo", "TryGetValue", "PPropDatal*Z", "989Z9", "Inno Setup Messages (6.5.0) (u)", "QueryPerformanceFrequency", "TRttiRecordType@", "NTDLL.DLL", "4E5o5", "FindResourceW", "TProcSig", ": ;0;4;8;@;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "DefineBinaryProperty", "ReadPrefix", "0 0$0(0,040P0e0t0", "r`+l%", "TSymbolName", "Field", "CreateResFmtHelp", "8&8.868>8F8N8V8^8f8n8v8~8", "TElementAlias", ":.:2:P:T:o:s:", "1 20282@2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "TArray", "=4=R=", "TInternalEraInfoRecord", "3TDictionary&", "5$5(50545<5@5H5L5T5X5`5d5l5p5x5|5", "BufferSize", ":*;1;@;", "4a4l4%5", "5,545<5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5", "IsSet$", "$IEnumerable", "$TEnumerator", "Integer overflow", "FBufEnd", "6\"7W7", "Start", "0#050C0K0Y0k0}0", "8$868O8]8o8", "7\"787I7W7_7m7", ",TList.TEnumerator5", "NewIndex", "1%131B1Y1l1}1", "HashCode", "0Q0W0", "Uhd`Y", "8K9X9", "; ;2;D;Y;l;p;w;", "CompressMethod", "MakeGlobalReference", "FormatMessageW", "CanObserve", "3TDictionary,", ">TDictionary.TItemArray", "TMultiWaitEvent<", ":;;;;;;;;<<<<<<<<<<<<<<<<<<<<<<<<<", "TCallConv", "-TPair", "=P=h=", "AddClass", ":$:,:4:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:", "FOnFindComponentInstance", "EOutOfMemory", "TList.ParrayofT", "uninstalltool_setup.exe ", "2 2.2E2X2`2n2|2", "7%8.8V<]<", "1)1=1E1V1d1l1z1", "TMonitor.TSpinLock", "cp1254", "VarBstrFromCy", "DynUnitName", "Position", "2*222@2N2b2x2", "?*?2?@?\\?k?o?", "Suspended", "TrimExcess", "0 040<0M0[0c0q0", "AGroupClass", "csUpdating", "csiso2022kr", "TList&", "TList", "PThreadInfo", "TPropFixup", "HIJKLMNOPQRSTUVWXYZ[\\]^_`", "SystemX", "2(2N2R2y2", "&TEnumerator", "OnObserverAddedtE^", "BTDictionary.TKeyCollection", "Shared.Struct", ";$;0;?;U;[;g;v;", ":l:q:", "5'5/575?5G5O5W5_5g5o5w5", "ReadStr", "FQueueLock", "FAsMethod", ">(?8?@?H?P?T?X?\\?`?d?h?l?p?t?x?|?", ":0:=:N:p:}:", "GetTempPathW", "PeekMessageW", "VExtended", "Property %s does not exist", "vaLString", "0(080", "WriteVar", "$0M0s0", "Z0_^[", "TRttiArrayType;", "9TDictionary.TItem", "Convert", "3F3N3V3^3f3n3v3~3", "NameList", "abcddddddddde", "FHelpContext", "VShortInt", "FldOffset", "AResult", "ClassType", "73777S7v7~7", "020@0W0l0z0", "cnExtracting", "DefaultUserInfoName", "ucs-2", "iso-ir-109", "TMethodImplementationCallback", "kWinapi.PsAPI", "VTEnumerable>", "3L3S3|3", "cp1255", "=$>P>q>", "=+=@=T=g=z=", "1 1$111H1d1}1", "TCustomDecompressor", "~array~of~", "mn-MN,mn-Cyrl,mn", "&IEnumerable", "TThreadList4s^", "GetModuleHandleW", "Q(_^[", "IntfUnitFld", "5&5>5M5U5d5", "XZZbee", "6#6+6<6m6q6", "SetSubComponent", "> >6>H>P>^>p>", "TDecompressorReadProc", "=,=4=B=R=d=l=}=", "9&959G9a9o9~9", "DTDictionary.TItem", "ManagedFldCount", "IdleTime", "=->I> ?_?~?", "euc-tw", "opaque_GlobalPos", "Software\\Borland\\Locales", "1#2-2P2`2h2p2x2|2", " ", "<$ar0f", "ProcOrMeth", "otUByte", "=\"=6=>=L=Z=i=q=", "sccCompressedBlocks2", "414f4w4~4", "TArray", ")TList.TEmptyFunc", "7TCollectionNotifyEvent", "5 6/7;7R7B8T8", "FTicks", "5!585N5_5u5", "0$0,040<0D0L0T0\\0d0l0t0|0", "=E>N>j>s>", "Uhiu]", "UhGv\\", " ", "5 595H5\\5n5", "0(0B0F0]0d0k0r0y0", "4*4>4F4W4e4m4{4", ">)???Y?", "csiso58gb231280", "8\"808S8b8", "=,>6>@>R>l>", "CleanupInstance", "ComponentIndexD>^", "System", "RaiseError", "0TList.TEmptyFunc", "Operation", "$TEnumerator(", "151=1N1`1h1v1", "63777^7h7l7", "8\"8*888J8\\8j8y8", "7 7$7(7,7074787<7@7H7P7X7`7h7p7x7", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "<4<;.TValueEnumerator;", ";&;<;M;`;u;", "GetDateFormatW", ">->?>\\>j>}>", ";0]0|0", ">'>+>H>X>\\>`>h>p>t>x>|>", "tOf;J", "2b2f2", "TValueType", "ReadListBegin", "4F5N5V5^5f5s5x5", "ArrayTypeInfo", "GetTickCount64", "MTDictionary.TKeyEnumerator", "ReadString", "Uh)EY", "FHashTable", ";2>9>t>", "Owner", "HasExtendedInfo", "cp-gr", "External exception %x", "VCLComObject", "0C1c1", "6.6=6E6S6f6u6}6", "InitializeCriticalSection", "7'7+757=7E7", "Uh8VW", "MTDictionary.TKeyEnumerator;", "5[5h5|5", "CurrentVersion", "8\"8*828:8B8J8R8Z8b8j8r8z8", "9$929:9B9J9R9Z9", "'TList.arrayofT", "onv,OUU", "AByRef", "ElementCount", "+A'CCtuw;rjq", "GetCPInfo", "fdTruncateExisting", "sr-Latn-ME", "TryParse", "8%868K8Y8j8", "FDecoderState", "0!0%0D0", "ComponentStyle", "? ?(?0?8?@?H?P?X?`?h?p?x?", "AHandle", "@UUUUUU", "DupsAllowed", "565Y5a5", "The sizes of unexpected leaked medium and large blocks are: ", "Application Error1Format '%s' invalid or incompatible with argument", "Shows this information.", "iso8859-2", ";\";1;D;^;l;{;", "9f9w9", "TChaCha20Context", ">+>3>A>P>", "hd\"rI_", "AIncludeActiveGroups", "LoadFromStream", "dSystem.Hash", "282S2m2", "TLibModule", "InitObservers$0$Intf", "iso-ir-58", ": :$:(:,:0:4:8:<:@:D:L:g:z:", "Uh\\L\\", ";+;:;I;", "'", "macintosh", "7-7D7Y7g7z7", "ITDictionary.TKeyCollection", "Compare", ">*><>O>W>e>w>", "7 8)8", "HasAttribute", "ReadSignature", "Handle", "6)6<6J6]6l6~6", "S-1-5-18", "?/?>?E?M?W?", "TMemberVisibility", "TFieldsCache&", "FAncestorList", "TReaderProc", "GetArg", ".didata", "040;0B0L0o0", "RegCurr", "NameListFld", ">[?n?", "opaque_Reps", "csisolatin4", "Initialize", "3(4H4P4w4", "FClassTab", "BeginWrite", "?%?E?I?g?", "2\"2V2", "Uhs1`", "MessageBoxA", "+TList.TEnumerator", "059G[~", "StaticQueue", "Yield", "VirtualProtect", ";G$tF", "JTDictionary.TPairEnumeratorH", "ListX", "7T7h7|7", "/TCollectionNotifyEvent", "2TList.TEnumerator", "VirtualQuery", ".arrayofT", "5*5;5F5N5l5~5", "FAsUWord", "UserTime", "?7?B?", "CurIndex", " TArray", "6<7@7D7H7V7d7p7", "TEnumerable'", "0&0=0c0", "7$7,7074787<7@7D7H7L7P7T7X7|7", "FReachedEnd", " !\"#$", "WWY[[gmi", "TAsyncFunctionEvent", "DataType", "Invalid property value", "3~4\\5", "FromHours", "8*8G8U8g8", "Uninstall Tool Setup ", "ReadWideString", "2W3^3", ";T.TEmptyFunc", ">6>C>R>e>i>x>", "5h6u6", "TRttiOrdinalType", "System.Generics.Collections4", "FInBuffer", "Please specify the password using the /PASSWORD= command line parameter.", "WriteDescendent", "=(=7=Y=x=", "UnregisterModuleClasses", "TList.ParrayofT", "$WizardSmallImageBackColorDynamicDark", "IFinalizer", "0:0j0w0,1?1", "FOnTerminate", "? ?$?(?,?0?4?8?", "(TList.arrayofT", "0/1d1", "9/9C9K9\\9j9r9", "ibm862", "PTypeTable", "=6=R=f=", "zh-SG,zh-Hans,zh", "VUString", "SystemT", "CreateWithExistingHandle", "tkLString", "505>5o5", "ParOff", "PListPd`", " TArray", "PList\\", "oShared.SetupEntFunc", "Uh:E]", "euc-cn", "BigEndian", "Timeout", "SeN_\\", ":R:l:", "HdGhM", "FConstant", "111?1O1_1q1", "<0<>.TEmptyFunc", "mkClassConstructor", "UhIgW", "TUnicodeEncodingH", "IntfFlags", "JTDictionary.TValueEnumerator;", "ksc_5601", "#TEnumerable'", "TFilex", "ReadValue", "%TEnumerabletQ_", "WriteMethod", ":(:6:J:W:_:m:", "RelTarget", "3(3d3o3x3", ">->5>C>U>k>|>", "CompareStringOrdinal", "Z_^[XX", "9i9x9", "0@0J0N0l0|0", "Resume", "535A5S5b5j5|5", ":':6:M:g:u:", "tkUnknown", "PExceptionRecordt6W", "=/>\\>", "1$1.181B1L1^1t1|1", "1=2%3)3-3135393=3", "keystream", "ifDispInterface", "7%7;7P7^7u7", "TranslateMessage", "RegECX", "TRegGroup6", " hd@]", "soBeginning", "0,050", "CharNextW", "PPackageTypeInfoX2W", "A call to an OS function failed", "6&7-7S7r7", "&op_UnaryNegation", "#TEnumerator(", ";$<4<8<<", "Count", "DELPHICLASS TRttiMethod; DELPHICLASS TRawVirtualClass", "B.rsrc", "PrevSystemTimes", "TExternalThread ``", "7,7;7C7Q7d7s7{7", "iso8859-10", "NameFld", "%&'()*+,", "PInterfaceTable", "oaEiC9>", "VariantInit", "Z]_^[", "OnCanObserve0@^", "1@5r5+6l6", "0i1{1", "LookupPrivilegeValueW", "&TEnumeratord", ".TEnumeratorL)[", "3Z3g3z3", "}l`aa", "EEncodingErrorx", ">TList.TEnumerator5", "TUE{{{", "0TList.TEnumeratorh", ":;:?:f:p:t:", "NTServicePack", " ", "TPropData", "&TList.arrayofT", "finalizer", "DefaultUserInfoOrg", "CTDictionary.TPairEnumerator;", "mkClassProcedure", "=$=@=P=e=s={=", "CallWindowProcW", "Specifies a list of tasks that should be initially selected.", "SetupLdrAndSetup.InstFunc", "4 5G5K5O5S5W5[5_5c5g5k5o5s5w5{5t6", "GetDeclaredProperties", "ListB", "'TMethodImplementation.TRuntimeTypeInfosL", "ftCurr", "TFinalizer@", "iso-ir-110", "111?1U1j1x1", "6-6C6T6e6m6~6", "FreeNotification", "6)63676X6h6l6p6x6", ")TCollectionNotifyEvent", "<,<0<4<<>", "> >D>H>V>d>", "DataInstance", "4x6|6", "ifHasGuid", "<8=?=;>B>", "=#>->P>`>h>p>x>|>", "5!6V6O7v7", "Locale", "", "7!7)71797k7", "8$8,8084888<8@8D8H8L8P8T8X8e8", "6J7_7m7", "ExceptAddr", "7,7A7T7u7", "939D9S9[9l9", "> >(>0>8>@>H>P>X>`>h>p>x>", "FValueData", "%TCollectionNotifyEvent", "3%3>3O3]3e3s3", "Invalid count (%d)", "./szy", "ChangesAssociations", "$TArray", "@sggg", "fsDenormal", "Operator", "FreeMem", ":8;h;", "mkOperatorOverload", "FWaiter", " TSetupPrivilegesRequiredOverride", "='=5=C=W=_=p=~=", "$TEnumerator(", "iso_8859-6:1987", "RequestedVarType", "EMonitorLockExceptionT", "Friday", "iso_8859-9:1989", "&IEnumerable", "=+=B=P=g=|=", "TCustomMemoryStream", "EFilerError", "1$2O2", "Windows 11", ":TListHelper.:4", "7$7?7G7U7c7s7{7", "5 525:5H5W5m5", "Uho-Z", "3$3,3@3K3S3q3", "4&4.4<4L4\\4n4y4", " type=\"win32\"/>", "iso_8859-16:2001", "Ph8P8i8q8", "EVariantInvalidOpError", "TReaderError", "InitObservers$ActRec", "5!@hW", "?>?e?", "$IEnumerable", "EInvalidPointer", "EUnderflow", "31484X4", "0C0J0N0T0X0^0i0o0s0", "3 3.3<3]3p3v3", "FMaxClassesInCache", "7>7I7P7`7h7p7x7|7", "/PASSWORD=password", "2+25292X2d2h2l2p2x2", "4\"4&4*4.42464:4>4B4F4J4", "646B6R6e6w6", "UhZ^a", "8 8(8,84888@8D8L8P8X8\\8d8h8w8", "808E8V8l8|8", "GetVolumeInformationW", "4&444B4V4l4", "TRttiNamedObject6", "WriteWideString", "SafeArrayPutElement", "FParams", "MTEnumerable>'", "Acquire", "K0O0v0", "S.UI$", "WriteChar", "}W#ANK", "cp866", "./335", "Smallint", ";';.;9;I;~;", "l~7fV", "<#\">0>B>S>[>i>x>", "FFlags", "8!8+838A8S8j8x8", "sr-Latn-CS", "^0C1c1", "QQQQ3", "UhxO`", ">b?q?", "FVirtCount", "7,7A7[7s7", "0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0l0t0|0", "GetReferenceToRawArrayElement", "Windows", "tpLowest", ";';D;|;", "7'7?7N7V7h7", "?/?3?T?X?s?w?", "0$020D0Y0e0m0~0", "Sunday", "FBuffer", "TList,", "YZ_^[", "mvProtected", "5&5?5P5t5x5", "FOnSetName", "WriteStr", ";(;;;X;f;v;", "kernel32.dll", "%TThreadList", "PResStringRech4W", "VInterface", ")TList.TEmptyFunc", "FParamType", "696@6", "LoadResource", "QSVWf", "TRttiInstanceMethodEx6", "ReservedStackSize", "FTypeInfos", "IsHFA8", "9-9;9J9\\9v9", ":\\:g:", "1%2E2L2t2", "EThread", "FComponentState", "1$121F1z1", "Write", "macturkish", "EObserverExceptiontE^", "?1?U?", "/Silent", "GetCharCount", "TRttiInt64Type", "MethodName", "415c5", "1TList.TEmptyFunc", "TRttiRecordField", "1.1C1Z1p1", "&!a5kYk", "FItemClass", "CreateThread", "7L7l7t7", "ReadBuffer", "6%616@6]6c6o6~6", "ACallConv", "[ExceptObject=nil]", "koi8-u", "FDesignInfo", "90X0h0u0", "_LIST_ENTRY", "EMathError", "EraCount", "fdOpenAlways", "System.Generics.Collections\\", "TFormatSettings", "DTDictionary.TValueCollection", "TArray", "1TCollectionNotifyEvent", "cmLZMA", "9'909j9r9}9", "iso_8859-10:1992", ":TDictionary&", ";.;B;S;q;", "0040[0e0i0", "VmtSize", "6L6\\6`6d6l6t6x6|6", "Observers", "9*9?9G9", "TCollectionEnumerator;", "WelcomeFontName", "ParamCount", "wrIOCompletion", "System|[^", "8ZZDKD", "-TDelegatedComparer8", "TCustomFileT@a", "CharLowerBuffW", "QQQQQQ3", ">0>8>F>U>e>w>", ";3;C;T;Z;j;y;", ";\\.ParrayofT _^", "&TEnumerator(", "pfAddress", "TBasicActionLinkXV^", "TFindComponentInstanceEvent", ":4:H:P:q:", "3$3,3034383<3@3D3H3L3P3T3X3f3x3", "]jIk7", "dSystem.SysConst", "csibm864", "?l-\\Y(", "2.2<2J2", "; ;$;(;,;0;4;B;T;i;z;", "858C8P8`8", "Collisions8", "2%232G2^2o2", "?b?s?", "2Y2^2f2", "ascii", "2)262C2O2V2`2h2s2", "&", "Windows Server 2003 R2", "5$51595J5Y5a5o5", "TProcedureSignature", "464:4X4h4p4x4", "Location", "windows-1256", "4+4a4", "989L9P9g9q9u9", "8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8n8v8", "FLockEvent", "cp949", "m/d/yy", "iso-8859-13", "TPropSetK", "GenuntelineI", "Empty", "TComponent6", "FoundIndex", "FInBufferNext", ";T&", "ASourceFile", "2$2,272@2q2|2", "0$080N0a0i0w0", "<#<+<3<;6Q6f6|6", "Parameter count mismatch&", ";vV", "Y\\\\duu", "Error", "GetParentComponent", "DialogFontBaseScaleHeight", "pqdddddddddddddddddddddddddddddddddr", "4U5~5", "U=%v\\;", "#TThreadList&", "SetDefaultDllDirectories", "FromSeconds", "000L0d0", "=,=P=T={=", "FWriterID", "ITDictionary.TPairEnumerator;", "uK|+#", "858G8O8]8o8", "8.82868:8>8B8F8", "TPropSet", "VTEnumerator>(", ":#:(:", "4`5i5", "Shared.SetupMessageIDs", "000>0W0]1", "AValue", "NumFileLocationEntries", "818e8s8", "PInterfaceEntry", "csFixups", ">+>B>m>", ":/:V:y:", "TUnitHashEntry", "FindType", "W)UkL", "Iww7]]]", "7\"747A7I7W7e7w7", "AOwner", "2(2I2", "AnsiChar", " TList", "1+1T1d1", "?5?H?V?i?x?", "ByRef ", "8E8L8", "VirtualIndex", "6/6[6", "6(60686@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "IsMoved", ":!:8:R:`:o:", "?2?:?H?`?", "TRttiParameter3", "FProcSig", "TRttiMethod", "Uhm>`", "OTDictionary.TValueCollection;", "ActiveClass", "FByRefParam", "FLookupRoot", "TListH5_", "8y9~?", "9 9'9.959<9C9J9Q9X9b9", "iso8859-14", "FAcquireInnerException", "3 313D3R3h3{3", "859A9P9", "March", "; ;(;0;4;8;<;@;D;H;L;P;T;X;\\;", "MTDictionary.TKeyCollection;", "l6799", "0?1a1", "<+++$", "jjjjjj", "StringBaseIndex", ">-?T?", "0T1v1", "NTVersion", "T*%Ys", "OwnsObjects", "Group1", "csSubComponent", "utf-8", "FCallerPopsStack", "232?2U2", "RegOpenKeyExW", "J%FGG1M", "RemoveQueuedEvents", ":.:A:Z:m:", "stcOSErrorInfo", "8\"818C8\\8m8{8", "iso_8859-2", "8!8.868E8K8W8f8n8}8", "GetNamePath", "ibm869", ":#:7:K:x:", "GetMethods", "IComparer", "FThreadID", "9T9X9\\9t9", " h(9a", ",i???O", "$TList.TEnumerator", "AClassName", "LanguageID", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "dupError", "TRttiContext", "TSpecialCryptContextType", "CodeInstance", "1$141G1Z1h1z1", "5TList.TEnumerator5", "~y#}y", "maciceland", "848@8D8H8L8P8T8\\8`8d8h8l8p8t8x8|8", "t?Htb", "Uh;J_", "TRttiMember", "Activate", "e&@gld", "$TEnumerator,", "TInstHashMapX", "898A8I8Q8Y8a8i8q8", "iso-8859-15", "fsNInf", "sr-Cyrl-BA", "DynArrElType", "TEnumerator", "Invalid NULL variant operation%Invalid variant operation (%s%.8x)", "PExtendedd", "FOnError", "AppModifyPath", "?\"?5?C?U?j?v?~?", "cp861", "5'6G6|6", "VarSub", "ldUILanguage", "Invalid argument to date encode", "iso-ir-138", "ResStringRec", "SafeDLLPath", "VTEnumerator>", "TEnumerator(", "2c2k2", "IntfParent", ":9:C:G:h:t:x:|:", "50575d5k5", "GetDeclaredMethods", "080g0", "<6=Q=`=w=", "FVirtualIndex", "SetValue", "AnsiString", "838:8M8", "9,:0:W:^:e:l:s:z:", "%TArray", "iso-8859-9", "elType", ";4<=<", "SpinCount", ">H>[>k>", "9@:U:c:{:", "TEnumerator(", "VUnicodeString", "<'<>", "088H2", "*TMethodImplementation.TFirstStageIntercept", ")TList.TEnumerator", "ReadComponent", ":(:,:0:8:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:", "AAAAA", "Too many open files", "GetExitCodeProcess", ">!>C>P>a>", "uz-Cyrl-UZ", "VType", "csInline", "WTArray>", "FPackageVer", "Unexpected variant error", "System.Classes", "&TArray", "nb-NO,nb,no", "FromMinutes", "Uh0(`", "TComponentClass", "0'0K0Q0`0o0u0", ".ParrayofT", "iso-2022-cn", "HasName", "5'5/5@5H5T5\\5b5h5r5~5", "EIntfCastError", "2&2H2U2f2", "iso_8859-5", "FContextToken", "=I>[>o>", "= =$=(=,=0=4=8=<=J=\\=z=", ">#>Q>y>", "='=/=7=?=G=O=W=_=g=o=w=", "9TDictionary.TItem", "4+5J5S5f5|5", "6!6%6D6T6X6\\6d6l6p6t6x6|6", "1TCollectionNotifyEvent", "?$?H?X?`?h?p?t?x?|?", "9 9$9(9,9094989<9@9D9H9L9P9^9p9", "tpIdle", "6#616A6T6o6}6", "ccStdCall", "/TEnumerable$u[", "= =(=0=8=@=H=P=X=`=h=p=x=", "2V2\\2w2", "0#040I0W0j0v0~0", "ForceQueue", "8%868@8H8V8h8", "090X0", "'TList.ParrayofT", "HPPGENAttribute5", "vaFalse", "Capabilities", "9 9$9B9d9x9", "Offset", "FInstanceRoot", "%LazyLoadAttributes.MakeClosure$ActRecXF\\", ">+>M>a>", "FFree", "FTypeInfo", ":$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "gYY_g`", "Uh&w]", "7 7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "UTF8Length", "GetArrayLength", "EAccessViolation|", ">L?R?o?", "0 0$0(0,0004080<0@0d0", "OrdType", "&TEnumerable", "Fdsx1", "tpNormal", "=!>%>L>S>Z>a>h>o>v>}>", "GetUserDefaultUILanguage", "DynUnitNameFld", "aTEnumerator>", "HC{z-U", "&TComparison", "FAsSByte", "&TCollectionNotifyEvent", "6>6t6z7", "TWriter'", "5'565L5^5f5t5", "8.8h8x8|8", "FHeaderProcessed", "xPBKDF2", "FSVWU", "TModuleInfo", "VObject", "@1T4m4", "NormalizedLocaleName", "Property '%s' is write-only=RTTI objects cannot be manually destroyed by application code\"%s (Version %d.%d, Build %d, %5:s):%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)", "#TArray", "9s:|:", "<.&", "?2?:?K?Y?a?o?|?", "0.060G0U0]0k0x0", "^/}}}", "AComparer", "tis620-0", "#TEnumerable", "=(=,=L=X=\\=`=d=l=t=x=|=", "3?3G3g3p3", ":0;9;r;", "Comments", "CurrentMinorVersionNumber", "ComparerT", "koi8-r", "0#0F0N0V0^0f0n0v0~0", ":-:;:C:Q:`:", "VarCyFromStr", "InfoAfterText", "5,5A5^5f5n5v5~5", "FGroupClasses", "> ???h?", "TStrongRandom: Failed to load bcrypt.dll", "InitialState", ">,>;>N>h>v>", "windows-874", "384H>", "< ", "9&9r9", "5TDictionary.TItemArray", "0TList.TEnumerator5", "8$8,84888<8@8D8H8L8P8T8X8\\8`8d8h8p8", "4-474;4`4p4x4", ">2>^>t>", "PropList", "0S1u1", "&op_Equality", "ASpinCount", "VarOr", "FieldOffset", "EArgumentException", "*TEnumerator(", "EInvalidCast(", "7/7>7F7T7c7v7", "41454\\4f4", "2TList&", "EN]XA)", "VirtualAlloc", "'TMethodImplementation.TRuntimeTypeInfos&", "DTDictionary.TValueEnumerator;", "VChar", "Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread", "CreateProcessW", "667M7", "2(2>2F2m2{2", "SetTypeOrSize", "7'7l7p7t7", "iso-ir-144", "2 272P2g2", "GrowThreshold", "ITDictionary.TKeyEnumerator;", "191W1b1", "#TEnumerable'", "cyrillic", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2", "vaNil", "ClearAndResetID", "CTDictionary.TPairEnumerator", ";7|8U", "TList&", "csibm855", "StaticSynchronize", "7a869E9", "CallingConvention", "9\"9*9A9", ";);1;?;L;|;", "CheckValue", "FMemory", "FReadMethod", "8TPair", "0123456789ABCDEF", "ACompare", "8V8n8w8", "RecursionCount", "!TList.arrayofT", "$TEnumerator", "&op_Subtraction", "<)", "edddS", "CryptKey", "MinVersion", "FCryptContext", "1'1+1L1\\1d1l1t1x1|1", "csTransient", "FRttiDataSize", "fsWrite", "TTypeInfo", "&TEnumerable'", "5$535F5\\5k5s5", "TClassFinderT", "TCustomFile=", "List index out of bounds (%d)", "TSetupLanguageEntry3", ".42N2h2", "OnValueNotify", "BTDictionary.TKeyEnumeratorp", "GetComponent", "> ?K?S?s?|?", "TApplication", "?!?)?1?9?A?I?Q?Y?a?i?q?y?", "1Z2,3D3", "GetCPUUsage", "CurrencyDecimals", "2\"2&2*2.22262:2>2B2F2J2N2R2V2Z2^2b2f2j2n2r2v2", "ENotImplemented", ">#>+>9>H>", "8*898A8O8b8q8y8", "FUseBOM", "!TSetupPrivilegesRequiredOverrides", "TEnumerable", "9,9;9", ":TLZMAInternalDecoderState.:1", "AfterConstruction", ":4;`;", "The unexpected small block leaks are:", "*TEnumerable'", "3E3V3e3o3", "2'3=3N3b3j3{3", "TMultiWaitEventImpl", "FInstItems", "greek", "FFatalException", "3 35393P3^3d3", ":q:v:", "2 2$2(2,2024282<2@2D2`2t2x2", "ResultType", "Unknown", "4'4/4@4u4y4", "6#606A6Y6g6}6", "OnError", "X-21_", "R\\gma", "BTDictionary.TKeyEnumerator;", "TCustomVariantType&", "ResInstance", "class ", "ThrowOuterException", "0K1m1", "*TDictionary", "=&=<=N=`=n=", "GetUserDefaultLangID", "8@9I9", "GetProcessHeap", "volatile bool FTerminated", "8P9b9", "FVCLComObject", "0 0.0?0T0f0n0", "Instance", "GetDeclaredFields", "HandlesTarget", "8$8+82898@8G8^8b8f8", "Uhz&Y", " $(,048<@DHLLPPTTXX\\\\``ddhhllppttttxxxx||||", "AllocateAndInitializeSid", "ASelf", "ExtractRawData", "9 9$9(9,949k9z9", "8TEnumerable'", "TArrayPropInfo", "AppId", ":!;);4;<;L;T;\\;d;h;l;p;t;x;|;", "CodePage", "Shared.VerInfoFunc", "8TEnumerator(", "RegQueryValueExW", "fsPositive", "5lho;", "FOnReferenceName", "4$494G4Z4o4}4", "q=,@H", "AsClass", "VarAnd", "FFreeInstItems", "4A4`4w4", "IDATx", "az-Cyrl-AZ", "TClassd", "Uh\\0a", "?(?0?>?P?^?f?t?", "5 5<5", "pGWj+1+", "2J2t2", "TFilerG", "585F5\\5n5", "VWideChar", "mkClassFunction", "> >D>d>", "6$6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6v6~6", "FRevisionLevel", "TryAsOrdinal", "8>9#:C:x:", "2%2B2T2e2{2", "EFileError", "Validated", "575h5", "PMonitorT$W", "ERangeError", "VVariant", "FReturnTypeInfo", "FAsULong", "KTDictionary.TValueCollection", "<;=B=", "Bww7/", "", "BCryptGenRandom", "tttT7", "T$4#D$8#T$<3", "?/?5???I?N?j?", "/SuppressMsgBoxes", "2$272P2e2l2", "2+2:2B2P2\\2l2p2", "J%Z[[", "otSByte", "4B4Q4", "<$<4<<.TValueCollectionx", ":%;);K;O;t;", ":,:A:O:c:y:", " ", "Instructs Setup to attempt closing applications using files that need to be updated, or prevents it from doing so.", "iso_8859-10", "Version", "WriteDouble", "ibm775", "3TArray", "GetDeclaredIndexedProperties", "WriteString", "2%2,2C2G2K2f2n2", "8.9F9O9", "?'?1?V?^?", "GetParameters", "TRttiIndexedProperty6", "VByte", "2G3c3q3'4.4", "!TList.TEnumerator5", "919Q9t9", "5'5A5`5z5", "IsSingleByte", "65696d6", "7.7]7g7", "9&989N9_9r9", "FStarted", "3/33373;3?3C3G3T3", "080D0H0L0P0X0`0d0h0l0p0t0x0|0", "GetTempPath2W", "7=7S7r7z7", "7 7(7,74787@7D7L7P7X7\\7d7h7t7x7", "", "6I6f6j6n6r6v6", "TRttiInstancePropertyClassic4h\\", "6$636D6O6W6h6{6", "6%6:6Z6}6", "?:?I?U?{?", "ASetDefault", "Control-C hit", "SizelCa", "cmLZMA2", "/CLOSEAPPLICATIONS, /NOCLOSEAPPLICATIONS", "WizardSizePercentY", "TSetupPrivilegesRequired", "181E1[1k1", "RetAddr", "lzma1smalldecompressor: %s", "cp1253", "SetupLdrAndSetup.Messages", ";!;%;?;F;M;T;[;e;i;m;", "AReadProc", "GetArrayElement", ";';?;N;V;h;", "AChildPos", "VSingle", "TEnumerable'", "3,303P3`3h3p3x3|3", "WaitForSingleObject", ">*>9>A>O>a>o>w>", "3(343E3M3S3^3l3|3", "WordBool", "RegSingle", ":\":*:@:U:c:s:", "FOffset", "ProductVersion", ";A;_;j;", "8+8;8O8W8e8w8", "5,5<5N5V5d5q5", "EndUpdate", ":.:::B:S:a:w:", "TAttrData", "UninstallDisplayIcon", "TIntfFlagsBase", "TPropSet", "macukraine", "Specifies a custom exit code that Setup is to return when the system needs to be restarted.", "afPremultiplied", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", " >(>0>4>8><>@>D>H>L>P>T>X>\\>`>d>l>", "TObservers.TObserverAddedEvent", "tzm-Latn-DZ", "1>6Fss3", "5*54585X5h5l5p5x5", ";#;-;7;?;E;S;n;", "4\"4C4J4Q4X4_4f4m4t4{4", "AFunc", "9pGt'+", "TReader'", "TlyUU)", "CreateWindowExW", "iso-8859-14", "VarBoolFromStr", "UnregisterClass", "iso_8859-8", "GetReturnType", "%TEnumerable'", "Mantissa", "vaInt32", ">w`5>w0", "2)272?2M2_2q2y2", "FixupResourceHeader", "macgreek", "vaExtended", "3#3>3B3^3", "tg-Cyrl-TJ", "2>3c3", "\\TEnumerator>(", ";.;F;T;b;u;", "tkInteger", "4'5P5", ";_", "TObject&", "6,6>6T6e6x6", "8?9|9", ";.;I;W;f;w;", "6-666o6", "#TEnumerable", "%IEnumerable", "? ?$?(?,?0?4?8?(", "HFAElementCount", ":4;C;J;", "p8BS$DWw", "ComponentState", "8@TList`1.Pack[1]$ActRec", ",TList.TEnumerator", "859J9X9j9y9", "2+2h2", "3+3:3J3\\3v3", ">)>1>@>H>]>e>{>", "UnderlyingType", "TStreamProc", ". %s is empty+Out of memory while expanding memory stream)%s has not been registered as a COM class", "TRttiInstanceFieldEx", "DefaultDirName", "0-0A0T0c0u0", "TMemoryStream'", "5 5.5>5P5g5u5", "NumRunEntries", "EInsufficientRttiP", "546D6H6L6T6\\6`6d6h6l6p6t6x6|6", "LockList", "cp932", "TIntfMethodTable", "ffInherited", "CloseApplicationsFilter", "1 111G1X1g1o1", "UUimm", "System.SysUtilsL", "MinValue", "8 8$8(858H8c8k8s8{8", " ", "VolatileAttribute", "mn-Mong-CN", "Uh[Y\\", "3.32363:3>3B3F3", "Stack overflow", "GetMaxByteCount", "LoadLibraryW", " ", "8 8@8P8X8`8h8l8p8t8x8|8", "<%<9#>1>@>[>_>v>", "3*3;3O3W3h3v3~3", "jkdlmn", "OnFindMethodx", "TSynchroObject'", "TPrivateHeap4q[", "3-3d3", "OnSetName", "FCodePage", "&op_Addition", "dnnn=#", "Windows Server 2016", "AsUInt64", "%fgg-", "?#?+?3?;?C?K?S?[?c?k?s?{?", "4.4?4M4U4c4x4", "$ZXs?", "TPackageTypeInfo", "ha-Latn-NG", "csWriting", "TRttiMethod'", "t-Rf;", "fdOpenExisting", "TFiler", ">k?r?", "8'858H8_8m8", "Qh(wY", "TList", "GetAttribute", "S(_^[", "ibm866", "sr-Cyrl-ME", "TArray", "D:PAI", "3/3=3M3_3v3", "1+131A1Q1`1w1", "2$2,242<2D2L2T2\\2d2l2t2|2", "vaList", "CreateAnonymousThread", "YYYq\\", "I[|;Bld", ".DEFAULT\\Control Panel\\International", "N>_`~~", "iso_8859-15", "tpHighest", "TRttiClassRefType", "SetWindowLongW", "%TEnumerator(", "CreatorBackTraceIndex", ".Owner", "iso8859-4", "1%2Q2f2", "$TEnumerable'", "WriteResourceHeader", "RemoveObserver", "Uninstall Tool ", "WriteUTF8Str", "SetThreadLocale", "SetSearchPathMode", "TCompressedBlockReader", "RegEAX", "TFilerFlags", "525`5z5", "GetNativeSystemInfo", "EAbort", "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<", "8Compression.Base", "Release", "%&'()*+,-. ", "ComparerL", ":%;4;<;L;", "hddddddddddddddddddddddddddidddddd", "CreateReturn", "0TList.ParrayofT", "UnitHashArray", "2\"2*222r2", "WizardImageAlphaFormat", "8TEnumerable<<[", "PathFunc", "<2<:.arrayofT", "=wp3>w", "dpAuto", "?1?A?I?W?j?z?", "3$3,3:3E3X3k3z3", "", "GroupedWith", "4'4A4I4Q4Y4a4i4q4y4", ":$:,:4:<:D:L:T:\\:d:l:t:|:", "Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists$''%s'' is not a valid component name", "FOrphanPackage", "1X2\\2b2f2p2", "TArray", "Handle,s[", ";!;B;X;i;x;", "9;:?:C:G:K:O:S:W:[:_:c:g:k:o:s:w:{:", "TLZMA1SmallDecompressor", "TMultiWaitEvent.TWaitInfo", "AddInstItem", "6 7)7", "):TMethodImplementation.TInterceptFrame.:1", "ClassRefAttrData", "8)8/8>8Q8W8f8y8", "1/1I1c1", "FOwner", "FindClose", " name=\"JR.Inno.Setup\"", "6)6-6T6d6l6t6|6", "t!Ht:", "cp855", "FloatType", " CrystalIDEA Software ", "AUserData", "? ?4?F?_?v?", "8IEnumerable", "CloseHandle", "YZ]_^[", "6+656P6", "DispatchMessageW", "ToShortUTF8String", "PPropInfoEx", "2 2$2(2,2@2D2H2L2X2\\2h2l2p2t2x2|2", "(TRttiPool.GetPackageList.DoUpdate$ActRec", "TArray", "Dg!K&", "BFGGY]]", "9 9$9(9,9094989<9@9D9H9P9X9~9", "EPrivilege,", "Embarcadero Delphi for Win32 compiler version 36.0 (29.0.55362.2017)", "%TEnumerator(", "6 6(6", "4%4<4O4W4e4s4", "0;1J1l1", "061=1p1", "TThreadInfo", "10181F1T1l1p1", "FReturnType", "7l7p7", "*IComparer", "EventCount", "Z#3]k", "2^2s2", "\"PrivilegesRequiredOverridesAllowed", "advapi32.dll", "OnTerminate", "TFloatSpecial", "t=HtN", "5#5+535;5C5K5S5[5c5k5s5{5", "function ", "FUpdateCount", "AdjustTokenPrivileges", "DimensionCount", "VClass", "ReadComponentRes", "Uh/Q]", "<(<8.TEnumerator", "494O4r4", "\"Variant method calls not supported", "Waiting", "crLessThan", "Uh#r\\", "UhXh]", "Started", "5D6m6", "zh-CN,zh-Hans,zh", "windows-1251", "8+838D8S8[8i8{8", "nnnAvvv", "akhrrr", "Parse", "VUnknown", "3/4S4m4", "Overrides the default component settings.", "Write64", " = procedure", ":>:b:", "=<=J=`=n=", "IsEmpty", "iso_8859-8:1988", "TPropSet", ":,:4:<:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "EComponentError", "HasInfo", ">,>>>F>T>c>y>", "4)4>4W4_4g4o4w4", "iso-2022-kr", ">w@3>w0", "CheckTerminated", "", "GetProc", "RttiCount", ".TArray", "AIntToIdent", "3)3-3L3X3\\3`3d3l3t3x3|3", "PropCount", "TArray", ";,;C;R;i;x;", "DeclaringUnitName", "2>w 2>w`", "GetLocaleInfoW", "@[utc", "TRttiInvokableTypex", "$TList&", "'TCollectionNotifyEvent", "cp437", "111C1Z1l1q1", "< <$<(<,<0<4<8<<<@@>t>", "Uh%!\\", "iso_8859-11", "Index1", "", "PAttrData", "9'9=9R9`9w9", "232H2V2h2", "EInOutError", "+++C\"", "4 4(40484<4@4D4H4L4P4T4X4\\4`4d4h4l4t4", "7$8H8y8", "TIntfMethodEntry", "TList", "AllowFree", "&TCollectionNotifyEvent", "4D4K4~4", "GetImplementedInterfaces", "1!101U1\\1}1", "SetLastError", "cp864", "4&4.4?4N4V4d4v4", "InitializeConditionVariable", "5$5,5_5u5", ">wp1>w`", "Shared.FileClass", "GetInterfaceTable", "1)1`1p1t1x1", "tkInt64", "System.RTLConsts", "UhjyW", "WriteDescendentRes", "FIgnoreChildren", "=5===Q=X=u=}=", "9,959n9", "&TList", "OUnsignedFunc", "5$565:5Q5X5b5f5", "1)171I1^1j1r1", "CompareOp", "?%?/?W?}?", "VerifyVersionInfoW", "XINFNAN", "TRttiObject'", "cp950", "$Z]_^[", "TypeInfos", "System.SysUtils", "FAliasList", "csibm866", "=9=U=\\=k=z=", "iso_8859-4:1988", "LanguageDetectionMethod", "TCustomDecompressor9", "EndOfList", "SizeofResource", "QQQQQQQ", "TComponentStateItem", "WriteComponentRes", "; ;$;(;,;0;4;8;P;`;d;", ":!?%?)?-?1?5?9?=?A?E?I?M?Q?U?Y?]?a?e?i?", "FMeths", "AProcedure", "fsNone", "ADecompressorClass", "EInvalidOpException", "OTDictionary.TValueCollection", "Indirect", "EHashException", "TMultiWaitEvent.TWaiterFlag", "Instructs Setup to attempt restarting applications, or prevents it from doing so.", "InnoSetupLdrWindow", "8'8/878?8G8O8W8_8g8o8w8", "GetSystemDefaultUILanguage", "UseQualifiedNames", ">$>(>/>B>V>k>", "FFinder", "OnKeyNotifyps_", "^)wU[", "FMaxCharSize", "7\"7&7*7.72767:7>7B7F7d7h7l7p7t7x7|7", "@GetPackageInfoTable", "PList,", "> >$>", "FromVarRec", "r!t3Hta", "RegExtended", "Uh ~\\", ";(;8;K;];e;s;", "TRttiInstanceProperty3", "628`8", ">)>:>P>a>u>", "string", "0$060A0H0O0Y0a0y0", "1*2]2d2{2", "TComponentEnumerator:", "EVariantErrorH", "Values<", "_Default", "5\"5I5R5", "OnReferenceNameL", "6'6/676?6G6O6W6_6g6o6w6", "aZ[[)", "FWriteMethod", "CharUpperW", ">3>W>", "GetParams", "?4?E?X?i?|?", ">/>?>G>U>h>x>", "Active,", "CopyFrom", "fsNaN", "StackInfo", "=D>Z>d>", "TMultiWaitEvent.TMultiWaiter&", "FTotalMethodCount", "VarXor", "2;2j2", "FOnFindComponentClass", "0F0a0", "fsInf", "windows-1253", "0B0F0p0", "&TArray", ",//[Qyn", "Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread", "414B4W4e4{4", "QQQQS3", ">*>:>M>_>g>u>", "GetFields", "8*8?8M8d8y8", "%&'()*+", "destructor ", "0 0$0(0,0004080E0W0k0s0{0", "FromTicks", "IsDestructor", "Invalid argument", ":-:F:[:p:", "TEnumerable'", "7 7$7(767>7P7b7t7", ":6:\\:", "AppMutex", "Unexpected Memory Leak", "FiredEvent", "wrTimeout", "$YZ_^[", ":5:O:W:_:x:", ":,;E;d;", "Uh8Q\\", ":(:>:O:_:g:x:", " version=\"1.0.0.0\"", "b?????", "GD_^[", "Reserved1", "NumIconEntries", "8 8(80888@8H8P8d8y8", "KeysD", "CurrentL=^", "AList", "526L6g6", "4*484O4d4r4", "6<7K7", "=*=8=J=]=r=", "TProc", "I/O error %d", "Ordinal", "TGetStreamProc", "ACallback", "6TCollectionNotifyEvent", "5/7W7^7v7", ":':.:F:M:w:", "=wp]?w", "windows-1257", "IsSet", "6!6'626E6K6X6n6t6", "System.Generics.CollectionsT", "+TList.TEmptyFunc", "{?U}wOw", "Uh#.`", "8 8$8(8,80888q8", "Destroy", "1 161M1j1r1z1", "1 1.1=1P1c1q1", "WeakAttribute", "Unused1", "RevisionLevel", "AppContact", "6 6L6P6w6", "ibm852", ">5?J?X?p?", ":$:C:G:O;_;+<7<>6???H?z?", "=0=F=j=n=r=v=z=~=", "Minutes", "mkDestructor", "hij@klmn-opqArstu", "tGf;J", "!TArray", "TRttiIntfMethod6", "PListL2\\", "ReadCollection", "TEnumerable", "TVarCompareResult", "IComparer", "TPropSetV", "6$6(6,6064686<6@6D6H6L6P6T6X6e6{6", "3!3%3D3T3\\3d3l3p3t3x3|3", "4,5M5i5x5", ":%:@:N:`:z:", ":TInstHashMap.:1<", "TClassFinder", ":\";W;", "PVmtMethodEntry", "=2=I=", "ccPascal", "UhiK\\", "ACreateDisposition", "tXf;J", ":9;U;", "9.9A9G9V9i9o9~9", "DefaultUserInfoSerial", "=*=5=", ":$:6:<:P:h:", "D$hPW", "CreateImplementation", "6(7,70747B7P7f7x7", "tww?x", "TVarArrayBound", "cp874", "Uh<}`", "TInterfaceListEnumerator<", "3$3T3X3", "/TCollectionNotifyEvent", "big-5", "0'0=0", ":%;q;", "TPropSettFZ", ":E;r;", "PLibModule", "8#8+838;8C8K8S8[8c8k8s8{8", "System0", "TEnumerable", "aTEnumerable><", "< <(<0<4<8<<<@", "TArray", "=w@\\?wp", "TListAssignOp", "TArray", "4 4$4(404M4[4c4q4", "5F5[5l5", "1D1o1", "WriteWideChar", "TValueDataImpl8", "Winapi.ActiveX", "iso-8859-6", "AInstance", "FInstanceMethod", "1*171b1", "ReadIdent", " ]_^[", "EInOutErrorA", "8L9.:h:w:", "TRttiPropertyE", "TArray", "UhHPZ", "System.Generics.Collectionsd", "?-?=?P?c?q?", "FSynchronizeException", "ProcSig", "9\":P:g:", "RegComp", "FInitLock", "7'7/777?7G7O7W7_7g7o7w7", "cp858", "PByte", "<$<,<4<8<<<@", "8$848F8c8q8", "ByteOffset", "ContentionCount", "TStream", "TSetupEncryptionKey ", "2.2C2T2i2w2", "HPPGENAttribute", "1&181M1g1", "TCollectionEnumerator", "=P>n>", "sma-SE,sma,se", "5*5>5O5^5f5w5", "Uh{f\\", "=r>y>", "0\"040S0a0x0", "5/5B5P5d5q5y5", "%4w?u", "%TEnumerator`._", "6s6w6{6", "TLZMAInternalDecoderStateP", " of object", "TCustomAttributeClass", "Milliseconds", "TSetupEncryptionNonce", "OnFindAncestor4", ">7>E>T>k>", "Options", "Causes Setup to create a log file in the user's TEMP directory.", "TArray", "TRttiInstanceType", "IsReadable", "stcPreallocateOptimization", "EStreamError", "IEnumerable", "csDesigning", "PList`y^", "maccentraleurope", "2D3p3", "EInsufficientRtti,", "IsInstanceOf", "WizardDarkStyle", "CastTo", "#IComparer", "EPrivilege", "Uh@<]", "Prevents Setup from restarting the system following a successful installation, or after a Preparing to Install failure that requests a restart.", ";\";&;@;P;X;`;h;l;p;t;x;|;", "Inno Setup", "0TDictionary.TItem", "Windows XP", "iso_8859-3", "<#<1<^?>J>", "/SL5=\"$%x,%d,%d,", "TEnumerator(", "LOO355E", "BaseFilename", "0TCollectionNotifyEvent", "MsgWaitForMultipleObjects", "GetSystemWindowsDirectoryW", "iso-ir-203", "929I9W9n9", "FPageSize", "BinarySearch", "969@9y9", "6\"666T6", "&TEnumerable'", "@w+AUUUUUU", "November", ";.;<;D;U;b;j;|;", "213F3W3l3z3", "GetExitCodeThread", ";0.TEnumerator5", "September", "VarDiv", "1#2L2w2", "3>3O3]3s3", "5.686<6D6H6P6T6\\6`6h6l6t6x6", ":mm:ss", "4E4d4u4", "Uhc1a", "7#767\\7j7|7", "dsb-DE,dsb,hsb", "TUTF7Encoding", "SetReturnValue", "Like the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been selected by default.", ":,:<:@:D:L:T:X:\\:`:d:h:l:p:t:x:|:", "TList&", "opaque_DictionaryPos", "ShortDateFormat", "<0<@.ParrayofT", ":9;O;`;t;|;", "", "EndRead", "Q8FKu", "RegisterWeakRef", "TCollectionItem:", "727@7P7b7{7", "TObject", "4)4;4K4S4a4t4", "PLIST_ENTRY", " TList.TEnumerator5", "_Construct", "PIntfMethodTable", "W!IY#", "A0p0}0", "ExitProcess", "%TEnumerable'", "VarMul", "Uh4~]", "TAsyncProcedureEvent", "TVmtFieldClassTab", "7.7<7N7h7v7", "FGrowThreshold", "3<3L3P3T3\\3d3h3l3p3t3x3|3", "Duplicates not allowed", ">Dkk+}}}", " TArray", "GetTokenInformation", "7PathFunc", "BTDictionary.TKeyCollection;", "IsClassMethod", "FListObj", "5!5)5y5", "AName", "VWUUh", ";:;>;_;c;~;", "0 0.0=0N0Y0a0o0}0", "5)595L5c5q5", "FGlobalContextCounter", "B!}pp", "WriteProperties", ".TCollectionNotifyEvent", "UnitNames", "AStartIndex", "FIsSingleByte", "fsReadWrite", "cp853", "2,3U3", "=%=K=k=", "MethodAddress", ":2:A:S:l:}:", "EnumCalendarInfoW", "TRttiInstanceFieldEx6", "2S3u3", "CreateDuplicate", "=\"=4=F=X=h=", "CreateUninstallRegKey", "windows-1258", "vaDouble", "TRttiManagedField8", "6.6<6O6e6v6", "E7`p[", "TGetDeltaStreamsEvent", "Uhe\"`", "707D7U7b7j7{7", "5 5$5(5,50545P5f5j5", "ResolveReference", "D7q/;M", "GetCurrent", ",TEnumerable", "CreateHelp", "Uhr'`", "AVarType", "0!0*0[0c0", ": :C:Q:Y:g:x:", "969I9T9i9t9", "TCollectionItem", "VTEnumerable>'", "6Q6~6", "=i7I!", "TRttiNamedObject", "iso-8859-4", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", "FAsSInt64", "TMethodKind", "=$=7=L=d=r=", "Uh\":Y", "9*9;9]9j9{9", "const ", ">TDictionary.TItemArray", "WriteSingle", "/TList.arrayofT", "Uh8oW", ":,:C:V:g:z:", "qps-ploc,en", "313F3h3v3", "UseBOM", "TResStringRec", "DefineOpenArray", "Uh7N_", "FComponentStyle", "NumComponentEntries", "'?IWw%", ">!>8>M>[>n>", "474?4M4[4", "ClassNameIs", "TRttiSetType", "TRttiClassRefTypeX", "FInBytesLeft", "4\"444`4d4", "RegEDX", "EConvertError", "*TList.TEnumeratorP", "-TPair", "#D$`#T$d3", "122o3", "Array ", "VCurrency", "+TEnumerator(", "FWaitRecycle", "RtlUnwind", "ECompressDataError", ";-;D;o;~;", "SkipValue", "3H3P3", "8!S3S,/.", "constructor ", "VBytes", "FCount", "1*101Y1", ";+<4<%=|=", "SeekToEnd", ";!;3;I;W;f;x;", "DefineProperty", "686H6P6X6`6d6h6l6p6t6x6|6", "; ;$;(;,;0;4;8;<;@;D;R;Z;l;~;", "csibm857", "/NOCANCEL", "FAsSWord", "FOpenArray", "DialogFontSize", "SetItem", "Parent, [", "EraInfo", "System.Generics.Collections", "6B7r7", "1!191A1I1Q1Y1a1i1q1y1", "GetProcAddress", "PropertyType", "TVmtMethodEntryTail", "9?9_9h9", "TPersistent'", "SwitchToThread", "skShortString", "csisolatinhebrew", "GetDimension", "OnUpdate", "ks_c_5601-1987", "Assertion failed", " TListX", "$TMultiReadExclusiveWriteSynchronizer&", "ReadFile", "FileVersion", "7 717C7K7Y7f7x7", "iso-8859-1", "ir]sfY", "TTypeKind", "MoveNext", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "ReadWideChar", "Shared.EncryptionFunc", "6 6H6^6o6", "FCanHandleExcepts", "BaseAddress", "EndFunctionInvoke", "3!3/3=3Q3g3z3", "LzmaDecode failed (%d)", "909l9{9", "&op_Implicit", "0 0$0(0,0004080<0I0`0u0}0", "ITDictionary.TPairEnumerator8", "'TArray", "Uhds]", "2,2<2D2L2T2X2\\2`2d2h2l2p2t2x2|2", "=>?X?", "TValueDataImplZ", ":*:B:P:`:x:", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4", "TRealPackage'", "wQ\\/s", "cPZXn", "System(#[", "TList&", "/TEnumerable'", "0#0+030;0C0K0S0[0c0k0s0{0", "0)0;0U0c0r0", "AFlag", "TThreadMethod", "DTDictionary.TValueCollection;", "AFrame", "_^[Y]", "0$0,040<0@0D0H0L0P0T0X0\\0`0d0h0l0p0", "Exception in safecall method", "GetBufferEncoding", "FPropInfo", "?,?4?", "<,`", "<0<4.TValueEnumerator;", "6\"6&6*6.62666:6>6B6F6", "Current", "TRttiAnsiStringType", ";);7;E;`;h;v;", "7(707>7L7c7v7~7", "?(?=?E?", "dkDynamic", "LoadStringW", "$IComparer", "Uh4*`", "TRealPackage", "ddddddddd", "505J5X5h5{5", "Floating point underflow", ">,>H>L>l>|>", "ASelfTypeHandle", ":M:Z:i:|:", ">1>9>G>V>l>z>", "TRttiInt64Type(", "&TArray", "TPrivateHeap.THeapItem", "GetThreadPreferredUILanguages", "System.VariantsH}Y", "StartIndex", "CreateFileW", "GetVersion", "EStreamErrorl", "7\"7&7*7.72767:7>7B7F7J7N7R7V7Z7^7b7", "FixupReferences", "0#040G0X0k0y0", "t@G;}", "TPersistent", "243`3", "2>2s2", "UnlockList", "/SILENT, /VERYSILENT", ";TList.arrayofT", "FMessage", "TThreadProcedure", "Iterations", ".TItem", "><>G>", "maccyrillic", "GetByteCount", "= =1=E=V=c=k=|=", "LOOS/", "ByteCount", "Overrides the default folder name.", "TPropSet", "Suspend", "VariantChangeType", ";3;P;", "GetClass", "1#161L1]1", "IsArray", "1200 (Unicode)", "%TMethodImplementation.TInterceptFrame(", "IsClass", "ToArray", "OleVariant", ";4;K;Y;p;", "GetStartupInfoW", "$TComparer", "1Y1|1", "TNoRefCountObject", "1,1=1P1^1t1", "TVarArray", "0(0,0L0\\0d0l0t0x0|0", "TRttiInstancePropertyEx", "8 8(8084888<8@8D8H8L8P8T8X8\\8`8d8q8", "Unused2", "IndexOfItem", "GetEncoding", "RemainingRandom", "Read beyond end of file", "ParamType", "DTObjectDictionaryM", "AMethod", ";TCollectionNotifyEvent", "525h5", "Y,//c}}", ";d#>4>H>P>a>o>w>", "Must wait on at least one eventECannot call BeginInvoke on a TComponent in the process of destruction", "Insert", "JTDictionary.TPairEnumerator;", " TList", "J%ZZZhmmEUU4M[", "1 2'2i3", "File access denied", ":TSetupHeader.:3", "Uh]#`", "=!=0=B=P=b=j=x=", "5 5$5(5,5054585<5@5D5H5L5P5T5b5j5|5", "$TEnumerableD_[", "uz-Latn-UZ", "tis620.2533-0", "tis620", "mkSafeProcedure", "<%<<'", "List T_", "IdentToInt", "1%131A1S1f1z1", "KeysH", "11151O1Y1]1|1", "IInterfaceListExd", "?$?:?O?h?w?{?", "o0J|t+", "WriteFloat", "tis620.2529-1", "J%fgg", "TList", "ToByteArray", "8.8G8c8", "FSVWQ", "OleAutoVarType", "FTagCounter", "cp860", ";*;;;C;Q;d;};", "2#222:2H2Z2h2p2~2", "&TEnumerator", "AddOrSetValue", "Target", "TUTF8Encoding&", "cseuctw", "For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline", "GetThreadLocale", "Listde`", "-TPair", "FParameters", "ShortMonthNames", "TryAdd", ":2;Q;w;", "Instructs Setup to be silent or very silent.", "SmallInt", "VLongs", "+TList.TEnumerator5", "5<5H5L5P5T5\\5d5h5l5p5t5x5|5", " bytes: ", "TArray", "TReadComponentsProc", "9,9:9F9T9d9h9l9t9|9", "8+888", "4&424@4[4c4q4}4", "FRecursionCount", "5K5w5", "HelpContext", "030<0f0", ":TFormatSettings.:20", "232Q2d2u2y2", "475N5p5w5I6m6", "laAnd", "TResStringHashItem", "ExecuteAction", "vqbi3", "HTDictionary.TKeyEnumerator", "WriteListBegin", "1 1$1(1,1014181<1I1_1u1}1", "FRoot", ")TList.ParrayofT", ":$;R;b;1.TEnumerator", "TTypeTable", "0#050Y0h0z0", "='>H>T>b>q>", ",TEnumeratorh", "rYf;5", "\"TArray", "4'474?4S4a4o4w4", "3$363F3N3\\3n3", "EOSErrorx", "ErrorCode", "LoadLibraryA", "<6", "Overrides the default setup type.", "TList", ">&>:>O>g>o>w>", "SetArrayElement", "TFieldsCache.TFields&", "Windows Server 2025", ">0>O>", "2!2)232;2J2_2p2", "TParamFlags", "(TRttiPool.GetPackageList.DoUpdate$0$Intf", "cp865", "CreateResHelp", "G0K0O0S0a0o0{0", "GetInterfaceEntry", "4=4R4[4", "SetEndOfFile", "LongDateFormat", "IntegerType", "FSpinCount", ":<:\\:`:", "IsTimeout", "MBToWCharFlags", "PreviousFrame", "n00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0123456789ABCDEF", "$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)", "Subtract", "7/7B7S7f7t7", "GetDiskFreeSpaceExW", "$TEnumerable'", "><00p", "faWrite", "6!6%6)676E6Q6`6", "Source", "0\"080H0j0n0", "TEnumAliasEntry", "Comparert>[", "GetField", "UhI@]", "$ZXsB", "=2=@=O=f=", ">$>9>G>^>s>", "DisableProgramGroupPage", "Winapi.Messages", "5*585L5]5v5", "171I1R1n1", "IsObject", "cp1256", "X,2<<", "\"3)3I5Y5b5h5x5", "===A=\\=`=|=", "4;4M4_4p4", "?\"?0?G?^?l?", "Mvm})", "Invalid property value List capacity out of bounds (%d)", " IEqualityComparer", "}t7N,", "ARight", "TParamFlag", "euc-kr", "WaitFor", "3'3/3=3K3d3l3z3", "EVariantUnexpectedErrorp", "7+737A7R7n7", "AddObserver", "7H8q8", "", "ReadListEnd", "RegCloseKey", "SortList", "1 1$1(1,1014181@1]1k1s1", " ", "LocaleName", "SetData", "7'797L7k7o7", "8*8;8O8W8h8v8~8", "iso8859-6", "EListError", "\"Compression.LZMA1SmallDecompressor", "636P6T6p6", "7)8R8", "TThread.TSynchronizeRecord ", "InitCommonControls", "TIntConstf", "EControlC", "<6=y=", ".idata", ";!;%;D;T;X;\\;d;l;p;t;x;|;", "3)3;3U3c3r3", "FHits", ">-?>lo_", "9%949F9Y9a9o9}9", "VirtualFree", ";Z]_^[", "FOnFindMethodInstance", "CreateDirectoryW", "ReadVariant", " ", "?&?i?", "Aifaa!", ">5?U?\\?", "TMethod", "%TArray", "=,=0=4=8=<=@=I=b=y=", "4&474T4b4y4", "8 8-8s8z8", "!IEqualityComparer", "Specifies the password to use.", ">(>9>N>a>s>", "/LOGCLOSEAPPLICATIONS", ",tdBHu", "FUserData", "TPointerList", "WCharToMBFlags", "8G8V8", "<#=h=q=", "RightToLeft", "mkConstructor", "AppVersion", "&PL@^hD", "1*121P1b1{1", "/TList.arrayofT", "FParent", "TListp", "ByteIndex", "?J?{?", "TWaitResult", "ENoMonitorSupportException", "252S2e2y2", "SafeArrayUnaccessData", "f; >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "TCollection", "|:Fo[vsB", "VerSetConditionMask", "=&=*=H=a=", "4Y+p:w", "PShortString", "smj-SE,smj,se", "8\"8^8", "wdsLight", ";4;I;W;n;", "8 868H8]8", "February", "TExternalThread&", ";(;8;I;Q;[;h;y;", "?#?1?@?j?n?", ";%;,;<;D;L;T;X;\\;`;d;h;l;p;t;x;|;", "SysInit", "*1#J$", "GetThreadPriority", "HeapDestroy", "RootAncestor", "?&?=?K?^?u?", "Populate", "GetItem", "FOwnsObjects", "GetInterface", "> >$>(>,>0><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "X0\\0`0d0h0l0p0t0x0\\7`7d7h7l7p7", "iso-ir-166", "ibm864", "1\"141J1X1g1x1", "UninstallDisplaySize", "4!4;4B4I4S4W4[4v4~4", "opaque_Buffer", "5 575;5R5Y5`5g5q5u5", ">w 4>w`", "<0V0~0", "System.SyncObjs", "90949O9S9o9", "=%=-=u=", "CTDictionary.TPairEnumerator;", "3K.TKeyEnumerator;", "cp862", "SetProcessDEPPolicy", "NumUninstallRunEntries", "TIntfFlag", ";A;x;", "< <$<(<0<8<<<@1X1f1u1", "'?ISS", "521C!", "<5e1_", "QTArray>", "TRttiRecordType<", "tis-620", "ComObject", "141T1d1x1", "KernelTime", "AsObject", "System.Diagnostics", ">+><>\\>m>", "NewInstance", "9\"979E9Y9o9", "ComparerdS_", ":TDictionary.TPairEnumerator;", "Windows Server 2012 R2", "cp1252", "Error reading %s%s%s: %s", "AFile", "cp863", "3-3;3M3\\3d3t3", "ReadFloat", "ComponentCount", "SuspendThread", "FSortedComponents", "FreeSid", "1#141H1P1a1o1w1", "5 5$5(5,5054585<5@5D5H5L5Y5l5}5", "%TMethodImplementation.PInterceptFrame", "8-8A8u8", ":G;h;", "SystemL", "VPointer", "6 6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6", "tkClass", "PropType", "= =/=7=E=X=g=o=}=", "Invoke", "6T6f6o6", "ExternalThreadd", "abc?defg", "PropData", "FFreeOnTerminate", "PListh", "csibm860", "jjjjjjjj", "oM\"%8", "4E4L4c4", "TStreamCapabilities", "VArray", "UhdpW", "GetChars", "< =q=", "Comparison", "Update", "$YZ^[", "CurrentBuildNumber", "afDefined", "828I8W8n8", "WriteListEnd", "]TEnumerator>(", "*IEnumerable", ";$;h;", "GetName", "8 8$8L8\\8d8l8t8x8|8", "CreateWithoutCopy", ")TList.arrayofT", "iso8859-5", "6$6/656:6E6K6P6[6a6f6q6w6|6", ";2;@;R;l;z;", "dbkFCallWrapperAddr", "TVarRec", "wrError", "FSuspended", "TArray", "iso-8859-7", "Invalid StringBaseIndex", "TPropSetLIZ", "6%6;6P6^6u6", "?.ParrayofT", "IValueData", "FAsPointer", "FReadMethData", "IReadWriteSync", "? ?$?(?,?0?4?8?", "gb_2312-80", "NumCustomMessageEntries", "VarIdiv", "opaque_Dictionary", ">f?}?", "VariantCopy", "CreateEmpty", "1'1=1S1", "TInterfacedObject", "364:4a4k4o4", "dkStatic", "%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)", "2<2L2T2\\2d2h2l2p2t2x2|2", "?,?>?U?]?e?", "NumDirEntries", "Windows 8", "TRttiPool@", "4 4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4r4z4", "windows-936", "\\TEnumerable>'", "Uh)L`", "5+5=5M5U5c5v5", "4$474?4M4_4r4z4", "3'393I3Q3_3r3", "Start index out of bounds (%d)", "Capacity", "Windows 10", "ReadRootComponent", ":%:B:P:`:r:", "TSetupLanguageDetectionMethod", "2L3S3e3l3~3", "6Shared.VerInfoFunc", "FProcedure", "BTDictionary.TKeyCollection;", "5^6&8g8", "VUInt64", "Uhur]", "4#4.464G4[4l4y4", "ArrayData", "ExtractPair", "92969M9T9[9e9i9", "ALock", "ECompressError", "VarAdd", "SeShutdownPrivilege", "3-3@3V3k3y3", "GetSystemDirectoryW", "UpdateTarget", "IAsyncResult", "", "Execution", "?$?;?D?h?", "csisolatin5", "<\\=z=", "3 3$3(3,303=3N3_3y3", "1 1$1(1,10151<1C1J1Q1-23292?2E2e2k2q2w2}2L3i3", "fvvv[$~OO", "TRttiInstanceMethodClassic", "Hours", "7W*.;", "TRttiInstanceType@", "NewSize", "ClassRef", "323@3P3c3v3", "456789", ": :=:S:d:r:z:", "ItemClassH", "5<6@6D6H6L6P6T6X6\\6`6d6h6l6", "EVariantOverflowError", "IsManaged", "VTEnumerator>", "8 8$8(8,8084888<8@8D8H8L8P8T8a8z8", "608g8o8z8", "TRttiEnumerationType3", "FStream", ">TDictionary", "6*656;6J6W6h6z6", "StoredProc", "8*80858E8K8O8%9U9", "ValuesPzZ", "MinInt64Value", "TDate", "AType", "ReadComponents", "TFileCreateDisposition", "NextValue", "proDialog", "6;6L6W6[6w6", "6]6y6", "c,J^$x^q", "TRttiInstancePropertyClassic", "G(LCC", "0<1C1Y1]1a1e1i1m1q1~1", "TPersistentClass", "TVariantBoundArray", "CurrentD", "1$1,141<1D1L1T1\\1d1l1t1|1", "fsNegative", "1 161G1Z1k1~1", "1 101B1X1f1v1", "TComponentEnumerator", "PIntfMethodEntry", "TStringComparer'", "FAsExtended", "[ OZ+", "=#=+=3=;=C=e=z=", "CodeAddress", "ReadInteger", "Exchange", "ibm819", "6:6A6m6t6", "0#0.080^0q0", "Invalid numeric input", "7c8p9w9", "UhkF`", "ThreadID", "PList<", "NumUninstallDeleteEntries", "Result", "DestroyWindow", "X?g?", "0,0>0B0Y0`0j0n0", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:", "TRttiStringType", "9(909@9H9P9X9\\9`9d9h9l9p9t9x9|9", "2$2L2[2c2t2", "<*T", "IsRecord", "EArgumentExceptionlpX", "tkUString", "/SPAWNWND=", "cp857", ">TDictionary.TItemArray", "BTDictionary.TKeyEnumerator", "", "&op_Explicit", "Active", " 0@P`p", ";-;S;|;", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<", "2TList.TEnumerator", "6/676E6W6n6|6", ",TList.TEnumerator5", "DTDictionary.TValueEnumerator;", "FData", "TThread&", "849X9d9h9l9p9x9", ";/;=;U;d;l;|;", "PInt64", ":*:D:_:o:", ":TInternalEraInfoRecord.:1", ",TEnumerator(", "TClass", "=1=?=N=`=q=u=", "EPropWriteOnly", "RegDouble", "ifUnused2", "!TMethodImplementation.TInvokeInfoK", "2!2/2>2T2i2w2", "csAncestor", "iso8859-1", "TIntfFlags", "AsCurrency", "TUVW'XYZ[\\]^_`(", "/TEnumerator(", "<\"<*<", "ReadIndex", "slAuto", "4 444L4_4h4", "MTEnumerator>(", "LoadLibraryExW", "tkClassRef", "Uh.rY", "Copyright ", "CompanyName", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "10171N1R1V1Z1^1b1", "FindFirstFileW", "varType", "csibm863", ">(>0>A>P>X>f>t>", "?*?P?W?n?", "Uh:tY", "TRttiEnumerationType@", "1 1$1(1,101H1X1\\1|1", "AInterfaceList", "Privileged instruction", "vaInt64", "ReferenceInterface", "$Z_^[", "mkFunction", "<-<1", "2&2=2K2b2y2", "5!6)6", "Values", "PVarArray", "9$929I9^9l9", "6#7h7", "8 8$8(8,8084888<8@8D8H8L8P8T8X8e8", "Package", "SetupLdr.e32", ":mEZ;iy[-c3", "skWideString", "FReadSignal", ">&><>R>Z>h>~>", "TCriticalSectionD", "&TList.arrayofT", ">(>0>>>L>", "=)=G=Q=[=`=q=", "6 757J7d7|7", "DecimalSeparator", "4+434D4O4W4h4|4", "TComponentState", ":TPropData.:1", "FHandleCreated", "VPWideChar", ">K?n?", "OnNotify", "2:2B2J2R2Z2b2j2r2z2", "ElType", "iso-ir-127", "FMethodBuckets", ";0;A;E;d;t;|;", ";-;L;W;", "1Z[Z@", "8%8)8@8J8N8p8", "5,6f6", "TRttiRecordField6", "Windows Vista", "csisolatincyrillic", "VTEnumerator>(", ":TFormatSettings.:4", ":TFormatSettings.:5", "QQQQSVW", ">A>P>X>h>", "=#=1=I=]=e=v=", "4$4(4/4B4V4k4", "maccroatian", "3R3g3u3", "Uh7\"a", "+TList.TEnumerator5", "?)?y?", "macroman", "The setup files are corrupted. Please obtain a new copy of the program.", "Winapi.Windows", "> >$>(>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>", "iso-8859-5", "IComparer", "ThreadProc", "ASyncResult", "? ?(?S?a?w?", "ibm861", "9&9@9c9", "Push_68", "TList&", ">@[{;", "FromArray", "TypeInfo", "4+4?4T4o4", "TSetupHeader-", "1%161{1", "\";wogt", "8=Gy%\"-", "faReadWrite", "sr-Cyrl-CS", "ibm850", "GetSystemMetrics", "2!212C2Z2h2x2", "IAsyncResult(", "windows-1255", "InsertRange", "EAssertionFailed", "TLightweightEventX", "Memory", "FReturnValue", "TRttiStructuredType ", "TRttiStructuredType", "B!ZZZx", ">+>j>", "TRttiProcedureType@", "=*=;=H=P=a=p=x=", "TInstItem.TBucketArray|", "OOO[u", "WideString", "bigfive", "-TArray>", "Operation not supported", "arxx8911", "position", "1rN_.", "AStartTime", "3h3l3", "-TList.arrayofT", "FCallConv", "9&979N9\\9o9", "WriteCollection", "zh-MO,zh-Hant,zh", "System.Types", "Direction", "(TList.arrayofT", "#TList.TEmptyFunc", "EVariantOutOfMemoryError", "DTDictionary.TValueEnumerator;", ":?:e:", "TFinalizer'", "ffInline", "7*$,/", "6;7j7", ">)>1>9>A>I>Q>Y>a>i>q>y>", "opaque_State", "AAAaaa", "System\\", ";#;1;@;N;^;f;t;", "IsSubComponent", "proCommandLine", "\\TEnumerable>D", ";-;C;S;h;w;", "iso_8859-13", "MultiByteToWideChar", "9+999F9X9", ";,;<;L;m;", "0TEnumerator", "PUnitHashEntryP:Y", "5#545U5Y5", "TFindMethodInstanceEvent", "AsInterface", "d2IGg", "PBKDF2", "494g4", "7(7-7<7A7V7[7j7o7", "BeginUpdate", "0TCollectionNotifyEvent", "TRecordTypeField", "8'9P9{9", "FClasses", "UhBJ`", "VWords", "EZeroDivide", "4-414\\4l4p4t4|4", "elSize", "575?5G5O5W5_5g5o5w5", "1#111?1K1X1", "4 4$4(40484<4@4D4H4L4P4T4X4\\4`4d4h4l4y4", "PACKAGEINFO", "8:8K8", "3Q3y3", "IsEmpty@", "dupIgnore", "AAction", "7=7E7t7", "CompareStringW", "eS\\XY`N", "8.8;8L8n8{8", "AThreadProc", "=0=<=@=D=H=P=X=\\=`=d=h=l=p=t=x=|=", ": :$:(:,:0:4:8:<:@:\\:p:t:", "0'0C0R0Z0h0w0", "9TDictionary.TKeyEnumeratorxt_", "#TEnumerator", "TRttiInstanceMethodClassic6", "GetThreadUILanguage", "ShortTimeFormat", "q-IK\"G", "VDispatch", "7 7$7(7,7074787<7@7D7Q7t7", "Collisionsxw_", "^[YY]", "727G7^7q7", "Feature not implemented Method called on disposed object", "515?5Q5k5y5", ";2;M;", "DTDictionary.TItemArray", "Destination", "opaque_DistanceLimit", "1#151E1M1[1n1~1", "+TEnumeratortv^", "ShortDayNames", "Current,", "SetSize", "ElementType", "TComponentName", "TCollectionItemClass", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING", "TMultiWaitEvent.TWaiterFlags", "FRootAncestor", "Access violation", "TailHandle", "TOrdinalIStringComparerD", "TRttiInstMethParameter", "FFixups", "3TDictionary", "pfResult", "9U:a:o:", "72868]8g8k8", "FComparer", "TFloatType", "9G:V:i:m:|:", "4 4.4@4O4W4h4", "NegCurrFormat", "@.tls", "@^[YY]", "3TDictionary&", "?(?8?@?H?P?T?X?\\?`?d?h?l?p?t?x?|?", "='=:=L=T=b=q=", "9\"9(929>9K9P9l9}9$:i:", "1,1F1T1c1z1", "888G8j8y8", "soEnd", "TCustomAttribute", "String", "=+=3=>=D=^=", "6)616?6M6[6c6q6", "PPropInfo", "2Chkognf", "6(6,60686@6D6H6L6P6T6X6\\6`6d6h6l6p6t6", "TComponent.TValueEnumerator;", "4O4X4\\4d4x4", "TCompressedBlockReaderQ", "8$949<9D9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "Single", "JTDictionary.TValueCollection", "3 3$3(3,3034383<3@3D3H3P3X3`3", "GetEraYearOffset", "q`g'7n", "+TEnumerable'", "1N1k1w1", "0TEnumerable", ":$:i:t:|:", "WriteBuffer", "2 2$2(2,2024282<2@2N2V2^2p2", "<1<9&", "Enter", "QQQQQQQQS3", "= =$=(=,=0=4=8=<=J=\\=u=", "/GROUP=\"folder name\"", "MAINICON", "LoadFromFile", "TExtended80Rec", "= =$=(=,=0=4=8=<=I=g=o=w=", "2 2(2,2024282<2@2D2H2L2P2T2X2\\2i2z2", ";8;d;", "9\"9*989F9Z9b9s9", ">(?A?", "WriteBoolean", ">8>f>n>y>", "Reference", "?$?,?4?|", "csisolatin6", "FCompare", "9!9(9/999Y9{9", "?(?2?=?U?`?j?t?~?", "0 0$0(0,0004080<0@0D0H0L0Y0p0x0", "FPropertyType", "&TEnumerable", "%;~}XO", "TIntConst", "3.3<3O3c3q3", "LegalCopyright", ">,>J>X>r>", "TInterfaceTable", "6)6<6K6]6p6x6", "Disables the \"This will install... Do you wish to continue?\" message box at the beginning of Setup.", ">+>/>9>A>I>", "Systeml#[", "Aliases", "ReadChar", "6(7k7x7", "9 9(90989@9H9P9X9`9h9p9x9", "000004b0", "TimeSeparator", "5$5(5,5054585<5@5D5H5L5P5T5b5t5", "VarMod", "IInterface", "tOFOu", "708?8k8", "TUTF7Encoding&", "3S4b4", "IsBufferValid", ";);:;B;P;_;u;", "5TCollectionNotifyEvent", "0\"0*020:0B0J0R0Z0b0j0r0z0", "1 131L1_1c1j1|1", "System.Character", "8Alx3", "Windows Server 2022", "XL,--", "RefCount", "1TList.TEnumerator5", "IntfMethods", "5\\5`5", "7+7O7S7W7[7_7c7", "SysAllocStringLen", "BTDictionary.TKeyCollection`", "TFieldsCache.TFields", "<$=/=8=H=P=X=`=d=h=l=p=t=x=|=", "TRttiDynamicArrayType", "3!3;3P3t3", "GetLongPathNameW", "3O4d4r4", "=;>r>", "TVmtMethodExEntry", "AIsClas", "PVmtFieldEntry", "*TEnumerable'", "TEnumerator", "Winapi.ImageHlp", "4Y^^fbb", "Uh|-`", "vaSet", "cmStored", "6Q6}6", "OriginalFileName", "4,5B5S5g5o5", "7\"8)8", "TList.arrayofT", "", "212T2", "; ;$;(;,;0;4;A;R;i;q;", "System.Rtti", "Flink", "FSection", "Uho8Z", "AddRange", ";-;@;D;K;^;r;", "TFindComponentClassEvent", "*TMethodImplementation.PFirstStageIntercept", "L$$^][", " GetDeclaredImplementedInterfaces", "<'<5.TValueCollection", "ldNone", "TPropSetV", "9TObjectDictionaryL8]", "Reader", "Uhzx\\", "mvPrivate", "BinaryOp", "IndexOf", "iso_8859-7:1987", "L($\"SA", "LNN19y", "\\o{=D0O-", ": :B:O:`:j:r:", "BeginRead", "1 2L2m2", "OnFindComponentClass8", "0Q1[1f1n1", "283G3Z3^3m3", "*TList.ParrayofT@", "GetAttributes", "InsertComponent", "TFindMethodNameEvent", ";\";*;2;:;B;J;R;Z;b;j;r;z;", "<1.TEmptyFunc", "2\"2*222:2B2J2R2Z2b2j2r2z2", "GetTempDir: GetTempPath failed (%u, %u)", "0!010D0V0^0l0{0", "DecompressInto", "ConvertSidToStringSidW", "4*494]4g4s4}4", "Uh~I\\", "4&5M5", "ReadDouble", "iso_8859-7", "Countdx_", "g\"6`v", "3!3/373E3S3g3o3", "TDispatchKind", "faRead", "OnKeyNotify", "csInheritable", "FMethOfs", "\\TEnumerator>", "tkPointer", "=+=;=N=a=o=", "?,???G?U?c?z?", "QQQQQQQSV", "CopyValue", "&op_Inequality", "5E5%636@6\"7?7F7g7", "IsEmptydv[", "3%3/333P3T3u3", ".TList.arrayofT", "AsInteger", "%TObjectList&", "PRTLCriticalSection", "b2p2T3n3", "2/2=2M2`2r2z2", "9,9;9K9]9w9", "TList&", "333E3M3[3i3}3", "TList.arrayofT", "5>w`/>w`", ":&:5:=:K:^:m:u:", "This installation was built with Inno Setup.", "Handle4-^", "TTime", "iso-ir-179", "FOnAncestorNotFound", "TPropIntfFixup,", "HasData", "VY_/2>1N2", "9+:n:", "ExitWindowsEx", "SevenZipLibraryName", "3'353L3c3q3", "otUWord", "IsOrdinal", ">K>R>b>i>", "AsyncResult", "ddAuto", "ChaCha20", "FBaseAddress", "6IComparer", "UnregisterWeakRef", "QQQQQSV", "(A;OICI;FA;;;SY)", "cp852", "AM/PM", "BTDictionary.TKeyEnumeratorp", "System.Generics.Defaults", ".TItem", "<)<7(", "shift_jis", "RandomXorStartOffset", "2 2(2P2^2t2", "3)434?4J4W4\\4b4", "VS_VERSION_INFO", "GetProperty", "TEMP\\", "YZXtp", "CurrencyFormat", "9<9S9y9", "FreeLibrary", "tkArray", "d%J$E1", "!TList.TEnumerator5", " TList&", "Value", "-0B0S0h0v0", ":TSetupHeader.:4", "2 2$2(2,2024282<2@2N2V2h2z2", "%s (%s, line %d)", "FName", "Interface not supported", "iso_8859-2:1987", "(TList.TEmptyFunc", "CreateEventW", "UninstallFilesDir", "fdCreateAlways", "cp-is", ":P;&<*<.<2<6<:<>", "IsInstance", "=T=X=", "DateSeparator", "System|", "1 151F1Z1b1s1}1", "\\TArray>", "ZTUWVSPR", "2!2)21292A2I2]2r2", "SpinWait", "System.Internal.ExcUtils", "6-6;6Q6i6w6", "vhM%(", "RefType", "RemoveDirectoryW", "", "3&3-373X3", "0*0D0R0b0t0", "DisplayName", "arabic", "gb18030", "969L9]9q9y9", "Windows 8.1", "8r8/989K9Y9", "Disk full", "AData", "Division by zero", ">&>+>D>T>X>\\>d>l>p>t>x>|>", "csDestroying", "DeleteRange", "DisableDirPage", "him]{1", "9B;v;", "<\\=l=r=", "fsNDenormal", " TList.TEmptyFunc", "UnregisterWeakMethodRef", "3,3<3D3L3T3X3\\3`3d3h3l3p3t3x3|3", "*TList.TEnumerator", "AFormatSettings", "NumInstallDeleteEntries", "818?8L8^8k8s8", "BTDictionary.TKeyEnumerator;", "TAncestorNotFoundEvent", "False", "Same as /LOG, except it allows you to specify a fixed path/filename to use for the log file.", "303O3[3v3", "FAncestorPos", "4 4$4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "TRttiInstancePropertyExXi\\", "QQQQQQQS", "Inno Setup Setup Data (6.6.0)", "soCurrent", "IComparer", "FSetDefault", "TFieldsCache.TFields8k_", "AShared.EncryptionFunc", "UhCta", "nn-NO,nn,no", "FExternalThread", ">p?y?", "=>CDE", "UnitNameFld", ": :;:[:_:}:", "4%4?4M4\\4o4", ";9<=&?I?a?", ">)?W?", "545<5m5", "ACount", "hebrew", "LanguageName", "IntToIdent", "EraOffset", "TSetupDisablePage", "EVariantTypeCastError", "ATypeInfo", "Prevents Setup from activating custom styles (including the built-in custom dark style).", "FindItemID", "GetACP", "9.9E9_9q9y9", "InstanceType", "ISHA256", "FGroups", "9%989@9N9\\9s9", "404<4@4D4P4T4X4`4h4l4p4t4x4|4", ":TFormatSettings.:10", "ActionComponent", "4TPair", "FileDescription", "GetLogicalProcessorInformation", "TStreamC", "TPropSetK", "9I:M:Q:U:c:q:}:", "IsPublicTypeD/W", ">4>D>H>L>T>\\>`>d>h>l>p>t>x>|>", "O-20'", "IsWritable", "6$666M6[6k6~6", "PRecordTypeFieldt%Z", ":\":*:2:::B:J:R:Z:b:j:r:z:", "dpYes", "< <$<(<,<4;?O?^?t?", "ExtraDiskSpaceRequired", "RaiseException", "? ?0?I?j?|?", "iso_8859-3:1988", "FWCharToMBFlags", "iso-ir-157", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8", "9#9+939;9C9K9S9[9c9k9s9", "TFilerFlag", "8H8]8f8", "AThreadName", "TInterfaceList&", "?'?5?G?X?`?n?}?", "RD_^[Y]", "3 3(3X3c3l3", "Windows Server 2012", "1TCollectionNotifyEvent", "*TList.TEnumerator5", "FInterfaceList", "929[9", "TypeTable", "4$424E4a4r4", "AppVerName", "6%7Y7", "GetCommandLineW", "%TList", "fdCreateNew", ">", "SafeArrayCreate", "= >2>;>R>s>|>#?", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "", "vaInt16", "5!5<5@5\\5", "VarR8FromStr", "QTArray>", "VirtualQueryEx", "909H9[9s9{9", ":,:4:<:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:", "YFFFH&", "AReturnType", "3!343F3N3\\3k3~3", "MaxInt64Value", "FAllocated", "/TCollectionNotifyEvent", "=6=K=Y=h=z=", "Int64", "7oGHp", "b'us-ascii", ":!:8:F:]:r:", "RecSize", "8C8J8Q8X8_8f8m8t8{8", "NumTypeEntries", "bs-Cyrl-BA", "?'?/?7???G?O?W?_?g?o?w?", "ManagedFields", "UnitCount", "Listh", ";-;7;;;X;h;p;x;", ";sht'", "]_^[]", "TMonitor", "Components", "FGG9v", "UhFy\\", "3$444]4m4", "Compression.Base", "VTEnumerable>'", "LeaveCriticalSection", "BaseType", "otSWord", "TypeData", "Instructs Setup to force close when closing applications, or prevents it from doing so.", ">8>B>d>t>|>", ";1;?;L;^;s;", "=G>h>t>x>|>", "7#717C7T7g7k7", "TObjectD", "EmptyAsAnyType", "vxoo/", "&op_GreaterThanOrEqual", "NumFileEntries", "8&9*9K9O9j9n9", "Identifier", "9H9f<", "&TEnumerable", "%s.Seek not implemented", "ClassParent", ">G>]>n>", "TThreadList&", "FHeapBase", "December", "Ident", "---V'", "?+?.ParrayofT", "Stream write error", "1$1A1E1d1t1|1", "FHasSelf", "ContainsKey", "JmpRel_E9", "FLock", "AOperator", "Z!)%N*", "0TEnumerable'", "tkInterface", "AppCopyright", "?&?5?G?Z?b?p?~?", "? ?(?6?E?[?i?q?", "InGroup", "UhV#Y", "qps-plocm,ar", "rMn3=", "< <$<(<,<0<4<8<@8F8N8V8^8f8n8v8", ")TList8{[", "Uht2a", "1 1$1(1,1014181<1@1D1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "WideCharToMultiByte", "TPropInfoEx", "FLatestPackageList", "8>8i8", "4;4m4", "#TEnumerator", "4'454E4X4k4y4", "6%656H6S6[6i6y6", "7R7\\7m7}7", "*TArray", "TFindAncestorEvent", "=@=I=", "sr-Cyrl-RS", "323C3_3g3~3", "sccPasswordTest", "Invalid variant type conversion", "(IComparer", "FInstance", "Software\\Borland\\Delphi\\Locales", "EHashException", "SetupMutex", "prAdmin", ";L", "TList`c^", "FChildPos", "TOperation", "FOnGetDeltaStreams", "WriteRootComponent", "Reserved3", "Index2", "October", "\\6\\", "FreeOnTerminate", "RemoveFreeNotification", "TList.TEnumerator", "/IEnumerable", "Uh&$`", "5g5v5", "586H6P6X6`6d6h6l6p6t6x6|6", "2 2$2(2,2024282T2k2o2", "fSystem.Rtti", "System.TypInfo", "4,4>4P4e4x4|4", "otULong", "lzma1smalldecompressor: Compressed data is corrupted (%d)", "qps-ploca,ja", "NTDictionary.TPairEnumerator;", "5TCollectionNotifyEvent", "Windows Server 2019", "EWriteErrord", "FItems", "August", "Floating point overflow", "value", "OleStr", "laCopy", "TRttiDataMember$", "FCollection", "HandleXi\\", "7E8Z8", "Duration", "korean", "=+=7=?=P=[=c=t=", "EVariantInvalidArgError<", "Instructs Setup to initially check the Don't create a Start Menu folder check box.", "TRttiFloatType", "4)4-4I4l4t4", "<'.ParrayofT", "BaseException", "2#212=2L2{2", "7&787Q7b7p7x7", "VariantChangeTypeEx", ";';4;I;Z;n;", "Dispatch", "crEqual", "656F6X6`6n6{6", "4R8Y8", "d28]w", "TMultiWaitEvent.TMultiWaitert", "8 888<8\\8l8t8|8", "Invalid source array", "7+7E7M7U7w7", "TEnumerator(", "TArray", "OnFindMethodName", ";!;8;M;U;", "FOwningThread", "volatile bool FFinished", "TInterfaceListEnumerator>", "vaCurrency", "9#949I9W9m9", "5\"505:5g5", "FAsCurr", "WR!:K", "7.878I8U8`8*989f:q:", ">2>K>d>}>", "EIntError", "WriteAnsiString", "DefaultGroupName", "6@6H6d6t6x6|6", "ITDictionary.TKeyEnumerator", ";TDictionary.TValueEnumerator", "AEncoding", "FWaiters", ">^>l>", "VWideString", "HTArray>", "5-555=5]5r5", "H$hnn", "Systemh", "The Setup program accepts optional command line parameters.", "?1?L?\\?`?d?l?t?x?|?", "FActive", "6'7|7", "VarI4FromStr", "Uh{~`", "FParamList", "?333333", "?'?;?C?T?b?j?x?", "> >0>8>@>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "<(1D1n1", "<&<;>", "VTable", ":(:Q:z:", "cnRemoved", "TManagedField", "cp1257", "2'222", "EHeapException,", "<.<<>B>", "April", "$ZXw<", "_DGWeeeee", "PWideCharL", "Finalize", "CreateSuspended", "0$0,0K0", "Exception3", "kkk_|||", "AsSet", "opRemove", "MaxValue", "ddddd", "EPropReadOnly", "GetType", "HeapAlloc", "< <0<", "HTDictionary.TKeyCollection", "TMonitor.TWaitingThread", "2$2,2:2H2s2w2", "9,9:9J9\\9y9", "T$,#D$8#T$<3", ":-:c:n:", "VSmallInt", "List0", "VTEnumerator>(", "pfReference", "YZXtm1", "AsInstance", "iso8859-8", "AConstant", "FLockCount", " TList&", "8M9[9m9", "Invalid variant type", ">$>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>", "DimCount", "DTDictionary.TValueEnumerator", "4&444B4V4^4o4}4", ".TArray>", "First", "csshiftjis", "i2;;k", "TBoundArray", "0*0@0N0^0p0", ";%;-;;;J;`;u;", "opaque_Code", "MTDictionary.TKeyCollection", "3$393S3k3", "r1A50L", "606v6z6~6", "machebrew", "TListEnumerator<", "TIntToIdentK", "RtlCompareUnicodeString", "TTypeData", ":,:@:S:b:t:", "e|5JB", "UhG:Z", "SO122bI", "P+]VW", "; ;$;(;,;0;4;A&", "$TPair", "4$;t$", "RandomXorFirstSlice", "AppComments", ";!.TEnumerator5", "6-656F6V6^6o6", "2 2$2(2,2024282<2@2D2H2L2P2T2a2r2", "< <(<0<8<<<@'", "PArrayPropInfod!Z", ">\\?v?", "u#3x=\\64M", "VString", "3$3,3<3K3_3p3x3", "_^[YY]", "Expand", " true", ":Shared.CommonFunc", "ETDictionary.TItemArray", ":(:v:", "FullHash", "cp1361", "vaSingle", "7-7@7H7V7d7x7", "RawByteString", "EndReferences", "comctl32.dll", "7#7;7C7K7S7[7c7k7s7{7", "Seconds", "*TEnumerableH", "hEdv4", ";_^[]", "tkEnumeration", "Uh|]`", "T$$#D$(#T$,RP", "WriteComponent", "3.4D4", "VarRec", "EWriteError", "?)?5?=?K?Y?g?o?}?", "HRESULT", "4Y\\\\ddd", "UhTD`", "tkMethod", "Uh_\\`", "QSVW3", "1,2c2{2", ">,><>@>D>L>T>X>\\>`>d>h>l>p>t>x>|>", "5$595A5", "3)303B3F3J3N3R3V3", "2$242<2R2X2{2", "WakeConditionVariable", "cspc775baltic", "FindComponent", "Uhq9Z", "0=0O0X0o0", "csunicode11utf7", "TSetupCompressMethod", "StackTrace", "7@7P7X7`7h7l7p7t7x7|7", "X\\\\DUU", "TCustomMemoryStreamC", "Bytes", ">Q>U>|>", "wine_get_version", "!TList.TEnumeratorX", "System.Generics.Collections8", "ExceptionAddress", "EInvocationError", "ShortString", "FFreeNotifies", "SetFilePointerEx", "TPropSetK", "SafeArrayGetLBound", "939D9T9\\9m9}9", "TypeCount", "QueryPerformanceCounter", "7\"7*787F7Z7b7s7", "; <0<4<8<@&", "9<9L9T9\\9d9h9l9p9t9x9|9", "LastIndexOf", "ifHasRtti", "7<7F7h7x7", "cmZip", "LongDayNames", ",$YXZ", "TFormatSettings.TEraInfo", "&op_LessThanOrEqual", "SystemhO_", "4N5c5q5", ",,,l|", "TEnumerable", "ifUnused1", "TComponent.Create@$ActRec\\", "SVWQf", "Close", "csFreeNotification", "System.SysConst", ";-;5;Q;t;", "LMNrr", "9!:N:", ">,><>D>L>T>X>\\>`>d>h>l>p>t>x>|>", "FRootName", "Leave", "GetVersionExW", "021?1Q1n1", "PJwA $J", "ParentD", "WVV>2", "7&747", "ParamList", "H~~vaa", "afIgnored", "FComponent", "Y>", "%?gbb", "tkSet", "5 5$5(50585<5@5D5H5L5P5T5X5\\5`5d5h5l5y5", "3*3;3P3^3w3", "+TList.TEnumeratorhU_", "9!9V9", "c0g0k0o0s0w0{0", ",]_^[", "<#>", "AHasSelf", "H0b0v0", "3 3(3034383<3@3D3H3L3P3T3X3\\3`3h3p3x3", "TProcParam", "ComponentName", "TRttiPointerType", "25393=3A3E3I3M3Q3U3Y3]3a3e3i3m3q3u3y3}3", "4,4>4c4k4", "CurrentMajorVersionNumber", "FShutdown", "PList01_", "3 3$3(3,3034383@3H3_3t3", "<\"<(<0<8<@4D4l4w4", "EAssertionFailed0", "PushEBP_55", "GroupWith", "TObservers&", "iu-Cans-CA", "TEnumerator", "SlicesPerDisk", "2%272G2O2]2p2", "GetIndexedProperty", "Module", "ExtractRawDataNoCopy", "Synchronize", " Invalid floating point operation", "!:x=B", "%TCollectionNotifyEvent", "TListHelper.TInternalNotifyProc{", "Cardinal", ")TList.TEnumerator5", "1 1P1T1", "Decimal", "2TList.TEnumerator5", "TEnumeratordx_", "utf-7", "2 2(2024282<2@2D2H2L2P2T2X2\\2`2d2l2", "UTF8String", "7;?E{r", "mkSafeFunction", "4+4A4R4j4{4", "TCollectionNotification", "%TEnumerator", "^&''YZZ\"", "5 5$5(5,5054585<5@5M5d5y5", "SignFlag", "1 1+161A1k1v1", "PResStringHashItem", "AsInt64", "TStreamCapability", "tkMRecord", "8\"8*888J8`8n8}8", "828z9", "Windows Server 2008 R2", "opaque_TempDictionary", "macarabic", ":TSetupHeader.:2", "IsStandardEncoding", "IOffset", "ReadSingle", "ExitThread", "WinVersion", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "iso-ir-226", "=(=6=H=e=s=", "System.Generics.CollectionshO_", "GetSingleCastObserver", "TryIsObserving", "csisolatin2", "FOnKeyNotify", "))),...C...M+++B***+", "EEncodingError", "cp850", "Reserved", "1,141<1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1", "iso8859-7", "oleaut32.dll", "S,Z^[", "utf-16be", "8]9w9", "8!9=9d9", "VarBstrFromDate", "4'4?4G4O4W4_4g4o4w4", "9TDictionary.TKeyCollectionTv_", "ExtractItem", ",IEnumerable", "cp1258", "FState", "FOnFindMethodName", "^o@^AWV", "ResName", "VTEnumerable>'", "7#7-777B7L7W7a7g7y7", "TRttiStringKind", "TStrongRandom: BCryptGenRandom failed (0x%x)", "tkChar", "TryEnter", "vaDate" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 8, "cape_type": "Unpacked PE Image: 32-bit executable", "process_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe", "process_name": "uninstalltool_setup.exe", "module_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe", "pid": 4848, "virtual_address": "0x00570000" }, { "name": "6162cf5441f22c3be4d56a04767aca2d885519a973bcbb9f796ab7799a92e556", "path": "/opt/CAPEv2/storage/analyses/109/CAPE/6162cf5441f22c3be4d56a04767aca2d885519a973bcbb9f796ab7799a92e556", "guest_paths": "8;?C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe;?C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe;?0x00570000;?", "size": 926208, "crc32": "2F597A42", "md5": "25600ec2316d50161cc96e6896f22d1b", "sha1": "99f1311b4440b9d50232faf511ec4f9aad3a77c4", "sha256": "6162cf5441f22c3be4d56a04767aca2d885519a973bcbb9f796ab7799a92e556", "sha512": "0d3ca50119d6a2b15770dcf4b2ec1bcf92e7c46636b06a111237087c7f97012591e6569ce48ccd2e79e76a9793c12201bc037194a9c3f82b8a3a1c74d0d1839f", "rh_hash": null, "ssdeep": "12288:13C5iae7h6BN/cP3w0PbDG38+SLyBEr4TnsboNKXS6dW:13C5iae7h6vaG38+SwE8sMNKi6dW", "type": "PE32 executable (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1CD154D27A34A633FF85E1A3B86A69A105F3A6791B553CC66DBF44C8CCF251801A3D347", "sha3_384": "eb9d77151095d97eb33704f55e9e6ad4b58236a9f9017f609ddaa7e6517867f79452b5561c9cae1a24322f568cb4a77f", "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce", "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "File not found: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\109\\uninstalltool_setup.exe", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00570000", "entrypoint": "0x000afe60", "ep_bytes": "558bec83c49053565733c08945b08945", "peid_signatures": null, "reported_checksum": "0x006b373e", "actual_checksum": "0x000ed35b", "osversion": "6.1", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": null, "imports": { "kernel32": { "dll": "kernel32.dll", "imports": [ { "address": "0x62d2dc", "name": "GetACP" }, { "address": "0x62d2e0", "name": "GetExitCodeProcess" }, { "address": "0x62d2e4", "name": "CloseHandle" }, { "address": "0x62d2e8", "name": "LocalFree" }, { "address": "0x62d2ec", "name": "SizeofResource" }, { "address": "0x62d2f0", "name": "VirtualProtect" }, { "address": "0x62d2f4", "name": "QueryPerformanceFrequency" }, { "address": "0x62d2f8", "name": "VirtualFree" }, { "address": "0x62d2fc", "name": "GetFullPathNameW" }, { "address": "0x62d300", "name": "GetProcessHeap" }, { "address": "0x62d304", "name": "ExitProcess" }, { "address": "0x62d308", "name": "HeapAlloc" }, { "address": "0x62d30c", "name": "GetCPInfoExW" }, { "address": "0x62d310", "name": "RtlUnwind" }, { "address": "0x62d314", "name": "SetFilePointerEx" }, { "address": "0x62d318", "name": "GetCPInfo" }, { "address": "0x62d31c", "name": "GetStdHandle" }, { "address": "0x62d320", "name": "GetModuleHandleW" }, { "address": "0x62d324", "name": "FreeLibrary" }, { "address": "0x62d328", "name": "HeapDestroy" }, { "address": "0x62d32c", "name": "ReadFile" }, { "address": "0x62d330", "name": "CreateProcessW" }, { "address": "0x62d334", "name": "GetLastError" }, { "address": "0x62d338", "name": "GetModuleFileNameW" }, { "address": "0x62d33c", "name": "SetLastError" }, { "address": "0x62d340", "name": "FindResourceW" }, { "address": "0x62d344", "name": "CreateThread" }, { "address": "0x62d348", "name": "CompareStringW" }, { "address": "0x62d34c", "name": "GetFileSizeEx" }, { "address": "0x62d350", "name": "LoadLibraryA" }, { "address": "0x62d354", "name": "ResetEvent" }, { "address": "0x62d358", "name": "GetVolumeInformationW" }, { "address": "0x62d35c", "name": "GetVersion" }, { "address": "0x62d360", "name": "GetDriveTypeW" }, { "address": "0x62d364", "name": "RaiseException" }, { "address": "0x62d368", "name": "FormatMessageW" }, { "address": "0x62d36c", "name": "SwitchToThread" }, { "address": "0x62d370", "name": "GetExitCodeThread" }, { "address": "0x62d374", "name": "GetCurrentThread" }, { "address": "0x62d378", "name": "LoadLibraryExW" }, { "address": "0x62d37c", "name": "LockResource" }, { "address": "0x62d380", "name": "GetCurrentThreadId" }, { "address": "0x62d384", "name": "UnhandledExceptionFilter" }, { "address": "0x62d388", "name": "VirtualQuery" }, { "address": "0x62d38c", "name": "VirtualQueryEx" }, { "address": "0x62d390", "name": "Sleep" }, { "address": "0x62d394", "name": "EnterCriticalSection" }, { "address": "0x62d398", "name": "LoadResource" }, { "address": "0x62d39c", "name": "SuspendThread" }, { "address": "0x62d3a0", "name": "GetTickCount" }, { "address": "0x62d3a4", "name": "GetStartupInfoW" }, { "address": "0x62d3a8", "name": "GetFileAttributesW" }, { "address": "0x62d3ac", "name": "InitializeCriticalSection" }, { "address": "0x62d3b0", "name": "GetSystemWindowsDirectoryW" }, { "address": "0x62d3b4", "name": "GetThreadPriority" }, { "address": "0x62d3b8", "name": "SetThreadPriority" }, { "address": "0x62d3bc", "name": "GetCurrentProcess" }, { "address": "0x62d3c0", "name": "VirtualAlloc" }, { "address": "0x62d3c4", "name": "GetCommandLineW" }, { "address": "0x62d3c8", "name": "GetSystemInfo" }, { "address": "0x62d3cc", "name": "GetTempPathW" }, { "address": "0x62d3d0", "name": "LeaveCriticalSection" }, { "address": "0x62d3d4", "name": "GetProcAddress" }, { "address": "0x62d3d8", "name": "ResumeThread" }, { "address": "0x62d3dc", "name": "GetVersionExW" }, { "address": "0x62d3e0", "name": "VerifyVersionInfoW" }, { "address": "0x62d3e4", "name": "HeapCreate" }, { "address": "0x62d3e8", "name": "LCMapStringW" }, { "address": "0x62d3ec", "name": "VerSetConditionMask" }, { "address": "0x62d3f0", "name": "GetDiskFreeSpaceW" }, { "address": "0x62d3f4", "name": "FindFirstFileW" }, { "address": "0x62d3f8", "name": "GetUserDefaultUILanguage" }, { "address": "0x62d3fc", "name": "lstrlenW" }, { "address": "0x62d400", "name": "SetEndOfFile" }, { "address": "0x62d404", "name": "QueryPerformanceCounter" }, { "address": "0x62d408", "name": "HeapFree" }, { "address": "0x62d40c", "name": "WideCharToMultiByte" }, { "address": "0x62d410", "name": "FindClose" }, { "address": "0x62d414", "name": "MultiByteToWideChar" }, { "address": "0x62d418", "name": "LoadLibraryW" }, { "address": "0x62d41c", "name": "SetEvent" }, { "address": "0x62d420", "name": "CreateFileW" }, { "address": "0x62d424", "name": "GetLocaleInfoW" }, { "address": "0x62d428", "name": "GetSystemDirectoryW" }, { "address": "0x62d42c", "name": "DeleteFileW" }, { "address": "0x62d430", "name": "GetLocalTime" }, { "address": "0x62d434", "name": "WaitForSingleObject" }, { "address": "0x62d438", "name": "WriteFile" }, { "address": "0x62d43c", "name": "ExitThread" }, { "address": "0x62d440", "name": "DeleteCriticalSection" }, { "address": "0x62d444", "name": "TlsGetValue" }, { "address": "0x62d448", "name": "GetDateFormatW" }, { "address": "0x62d44c", "name": "IsValidLocale" }, { "address": "0x62d450", "name": "TlsSetValue" }, { "address": "0x62d454", "name": "CreateDirectoryW" }, { "address": "0x62d458", "name": "GetSystemDefaultUILanguage" }, { "address": "0x62d45c", "name": "EnumCalendarInfoW" }, { "address": "0x62d460", "name": "LocalAlloc" }, { "address": "0x62d464", "name": "GetUserDefaultLangID" }, { "address": "0x62d468", "name": "RemoveDirectoryW" }, { "address": "0x62d46c", "name": "CreateEventW" }, { "address": "0x62d470", "name": "SetThreadLocale" }, { "address": "0x62d474", "name": "GetThreadLocale" } ] }, "comctl32": { "dll": "comctl32.dll", "imports": [ { "address": "0x62d47c", "name": "InitCommonControls" } ] }, "user32": { "dll": "user32.dll", "imports": [ { "address": "0x62d484", "name": "CreateWindowExW" }, { "address": "0x62d488", "name": "TranslateMessage" }, { "address": "0x62d48c", "name": "CharLowerBuffW" }, { "address": "0x62d490", "name": "CallWindowProcW" }, { "address": "0x62d494", "name": "CharUpperW" }, { "address": "0x62d498", "name": "PeekMessageW" }, { "address": "0x62d49c", "name": "GetSystemMetrics" }, { "address": "0x62d4a0", "name": "SetWindowLongW" }, { "address": "0x62d4a4", "name": "MessageBoxW" }, { "address": "0x62d4a8", "name": "DestroyWindow" }, { "address": "0x62d4ac", "name": "CharUpperBuffW" }, { "address": "0x62d4b0", "name": "CharNextW" }, { "address": "0x62d4b4", "name": "MsgWaitForMultipleObjects" }, { "address": "0x62d4b8", "name": "LoadStringW" }, { "address": "0x62d4bc", "name": "ExitWindowsEx" }, { "address": "0x62d4c0", "name": "DispatchMessageW" } ] }, "oleaut32": { "dll": "oleaut32.dll", "imports": [ { "address": "0x62d4c8", "name": "SafeArrayPutElement" }, { "address": "0x62d4cc", "name": "VariantInit" }, { "address": "0x62d4d0", "name": "VariantClear" }, { "address": "0x62d4d4", "name": "SysFreeString" }, { "address": "0x62d4d8", "name": "SafeArrayAccessData" }, { "address": "0x62d4dc", "name": "SysReAllocStringLen" }, { "address": "0x62d4e0", "name": "SafeArrayCreate" }, { "address": "0x62d4e4", "name": "SafeArrayGetElement" }, { "address": "0x62d4e8", "name": "SysAllocStringLen" }, { "address": "0x62d4ec", "name": "SafeArrayUnaccessData" }, { "address": "0x62d4f0", "name": "SafeArrayPtrOfIndex" }, { "address": "0x62d4f4", "name": "VariantCopy" }, { "address": "0x62d4f8", "name": "SafeArrayGetUBound" }, { "address": "0x62d4fc", "name": "SafeArrayGetLBound" }, { "address": "0x62d500", "name": "VariantChangeType" } ] }, "advapi32": { "dll": "advapi32.dll", "imports": [ { "address": "0x62d508", "name": "ConvertStringSecurityDescriptorToSecurityDescriptorW" }, { "address": "0x62d50c", "name": "OpenThreadToken" }, { "address": "0x62d510", "name": "AdjustTokenPrivileges" }, { "address": "0x62d514", "name": "LookupPrivilegeValueW" }, { "address": "0x62d518", "name": "RegOpenKeyExW" }, { "address": "0x62d51c", "name": "OpenProcessToken" }, { "address": "0x62d520", "name": "FreeSid" }, { "address": "0x62d524", "name": "AllocateAndInitializeSid" }, { "address": "0x62d528", "name": "EqualSid" }, { "address": "0x62d52c", "name": "RegQueryValueExW" }, { "address": "0x62d530", "name": "GetTokenInformation" }, { "address": "0x62d534", "name": "ConvertSidToStringSidW" }, { "address": "0x62d538", "name": "RegCloseKey" } ] } }, "exported_dll_name": "SetupLdr.e32", "exports": [ { "address": "0x57e578", "name": "__dbk_fcall_wrapper", "ordinal": 2 }, { "address": "0x62863c", "name": "dbkFCallWrapperAddr", "ordinal": 1 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x000c0000", "size": "0x00000071" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x000bd000", "size": "0x00001028" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x000d5000", "size": "0x00014710" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x006a4930", "size": "0x00004f98" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x000c3000", "size": "0x00011440" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x000c2000", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x000bf000", "size": "0x000001a4" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000600", "virtual_address": "0x00001000", "virtual_size": "0x000ae000", "size_of_data": "0x000ad800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.41" }, { "name": ".itext", "raw_address": "0x000ade00", "virtual_address": "0x000af000", "virtual_size": "0x00002000", "size_of_data": "0x00001800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.22" }, { "name": ".data", "raw_address": "0x000af600", "virtual_address": "0x000b1000", "virtual_size": "0x00004000", "size_of_data": "0x00004000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "5.71" }, { "name": ".bss", "raw_address": "0x000b3600", "virtual_address": "0x000b5000", "virtual_size": "0x00008000", "size_of_data": "0x00007400", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "3.28" }, { "name": ".idata", "raw_address": "0x000baa00", "virtual_address": "0x000bd000", "virtual_size": "0x00002000", "size_of_data": "0x00001200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "5.13" }, { "name": ".didata", "raw_address": "0x000bbc00", "virtual_address": "0x000bf000", "virtual_size": "0x00001000", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "2.88" }, { "name": ".edata", "raw_address": "0x000bbe00", "virtual_address": "0x000c0000", "virtual_size": "0x00001000", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.25" }, { "name": ".tls", "raw_address": "0x000bc000", "virtual_address": "0x000c1000", "virtual_size": "0x00001000", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "0.00" }, { "name": ".rdata", "raw_address": "0x000bc000", "virtual_address": "0x000c2000", "virtual_size": "0x00001000", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.36" }, { "name": ".reloc", "raw_address": "0x000bc200", "virtual_address": "0x000c3000", "virtual_size": "0x00012000", "size_of_data": "0x00011600", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.71" }, { "name": ".rsrc", "raw_address": "0x000cd800", "virtual_address": "0x000d5000", "virtual_size": "0x00015000", "size_of_data": "0x00014a00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "7.30" } ], "overlay": null, "resources": [ { "name": "RT_ICON", "offset": "0x000d54f8", "size": "0x0000d3c4", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.99" }, { "name": "RT_ICON", "offset": "0x000e28bc", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.06" }, { "name": "RT_ICON", "offset": "0x000e4e64", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.32" }, { "name": "RT_ICON", "offset": "0x000e5f0c", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.10" }, { "name": "RT_STRING", "offset": "0x000e6374", "size": "0x0000024c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.11" }, { "name": "RT_STRING", "offset": "0x000e65c0", "size": "0x000002e4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x000e68a4", "size": "0x00000400", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.51" }, { "name": "RT_STRING", "offset": "0x000e6ca4", "size": "0x000003d0", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.24" }, { "name": "RT_STRING", "offset": "0x000e7074", "size": "0x000003fc", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.35" }, { "name": "RT_STRING", "offset": "0x000e7470", "size": "0x000002d4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.37" }, { "name": "RT_STRING", "offset": "0x000e7744", "size": "0x000000b8", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.34" }, { "name": "RT_STRING", "offset": "0x000e77fc", "size": "0x0000009c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.15" }, { "name": "RT_STRING", "offset": "0x000e7898", "size": "0x0000038c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.32" }, { "name": "RT_STRING", "offset": "0x000e7c24", "size": "0x00000398", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.29" }, { "name": "RT_STRING", "offset": "0x000e7fbc", "size": "0x00000368", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.33" }, { "name": "RT_STRING", "offset": "0x000e8324", "size": "0x000002a4", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "3.29" }, { "name": "RT_RCDATA", "offset": "0x000e85c8", "size": "0x00000010", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "4.00" }, { "name": "RT_RCDATA", "offset": "0x000e85d8", "size": "0x0000038c", "filetype": null, "language": "LANG_NEUTRAL", "sublanguage": "SUBLANG_NEUTRAL", "entropy": "5.15" }, { "name": "RT_RCDATA", "offset": "0x000e8964", "size": "0x00000040", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.77" }, { "name": "RT_GROUP_ICON", "offset": "0x000e89a4", "size": "0x0000003e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.55" }, { "name": "RT_VERSION", "offset": "0x000e89e4", "size": "0x00000584", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.83" }, { "name": "RT_MANIFEST", "offset": "0x000e8f68", "size": "0x000007a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.89" } ], "versioninfo": [ { "name": "Comments", "value": "This installation was built with Inno Setup." }, { "name": "CompanyName", "value": "CrystalIDEA Software " }, { "name": "FileDescription", "value": "Uninstall Tool Setup " }, { "name": "FileVersion", "value": "Uninstall Tool " }, { "name": "LegalCopyright", "value": "Copyright © CrystalIDEA Software " }, { "name": "OriginalFileName", "value": "uninstalltool_setup.exe " }, { "name": "ProductName", "value": "Uninstall Tool " }, { "name": "ProductVersion", "value": "3.8.1 " }, { "name": "Translation", "value": "0x0000 0x04b0" } ], "imphash": "ac4ded70f85ef621e5f8917b250855be", "timestamp": "2025-11-10 17:25:51", "icon": "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAQ30lEQVR4nL2ZeXTV5ZnHP7/t7jf3Zg9rAgQpiwurKCIi1dZBra1YdabtiLa14wxWLKet1s6MU85pHXu0nY7OUJVi1SlSsFVRCFAQIZZUIWwhCVlIyH7vzc3dl986f9AbkhAwduw85+Tkd97z5rnf7/P9vs/z/nIFxhhFj+/5qV2NfmfO3yxNFRUVuDJZsyWVNTYamvbGruV5DWPN82mHMNaNJY9VpVxWwjnz3i/h0gzcoonTMrEMk6wlxvqj2f9RVfXFXbcWH/5rAh4ZYyJQ8IOqSTZDP1tY4mLSjTeghgewOdw4AJdlkS+b5IkWhm6QzJp0xvRfqbr+6o4vle39K+NHHssm05RvEM0M7nHjqCTFdLWRPcc7adWc5I2fQrhoHE7ZjgcolAXmFSurNU1cPX1XiFDE+n0ilXzxrfsq3vlrEBiTAkWP7d5s0+J3T115Y/YnV/rsS/LPrWuGzrYPm9h9rIW6sIqcPxFv4ThcDg9u0cQvQ5EdDM0kmTHpjxlV8UTm5W0PTt2MIFj/bwRKflCVdOhJV8WqO3jnKgHPRXR7v76dqtpW/tQaJm0rxFNYhsflxylZ5EkWhU4B0RSJJ0yS6dDhe2+uPeOV81ephko023m0KXlw7ZrLt773qRLwrKsqcUlGX0GRh8tvWsKWK8UxJT7TG+bNmib+dLqXswkFn388dmchxd4eFk4/bV03rUKwyz50I0FT7CDH+n9LVO3hqWs7x9xYYAxnQJFtNwlmEmdpMXM9Y088payAR75wNQCaBq/XVBEQfs/c8klMybteiAltnInv548dm8hYcdJhBYfvE2EfGwFJsG7DMnGWleiLfOKYDv3QqA+9z+G+d1GKBT474bOYcoK6gd+w/8wGTMEg1isSaDGY7J2VynhPuT51ApZo3YYAtrw8aW7e2JJm9BTHA1XUhfbhcNmonDIHm+Smvns7NZ2vgCAT6xIJtJosqFzO+m/+hCJHuWv1bm/oUyXgWVdVgqm7XAX55NsEocB26WT96Q6O9u2kLXqEwoIiZs6Yg66aHGvbQUP4D1imTLhdIdolsHT2rTz33f/ALjkASCYzxAXN/FQJKLLjJqw0zpJCFnkvvq89epzavncY0LooKypj7uRFDESC7Kv7FX3JFgxDor9ZJtvv5JZFf8fXv7r+ghxSJpx8pL6s5Y2ap+OEWxtp2nW38PDelv8TAVPgNsGw8JQUWlf7peEnzLI4HtrDib7dYNMZXzqByd4F9IXOsq3mKZL6AGpaItgCYjyPL9/wEHcu+vbIjzDY+4sj7Pm53aGrV1w//wvXMGMxySPG/N7W0ub2td/YWv7sC3f9xQQEwfo8WLiL8rlqiP+P9v2Bs/HDWPYkUyrLscsu2nvreOv4s5iCRiYq0Ndk4hcn8q0b17Fizr3DEx/d3sK76/sJtc1j6sKFLP0aGcNPoLqW0MavYsRVvE4Hntmz8i+F79IE1hzKs6ykz+H3kS+LQv4Q/z9dvY5SbxH/eO2/cSK0nT3N/40kyyRCIoHTBpP8s/iXO55kbsXy83/UeSLMW//aRMP+mVRcNY05K6YZvgqCHxwj8OIh0r1xPHYFv6jQYap0RVJ6ZUqYessta+w7dvwi+4kJePPMFZZhkVdSwFXe4VO/K9JFXyJEZ/Bsalfbc65UwE6w2WLmhHk8fv9PmFZ8+bmN8aDOuz+uo+a1IoqnTmD64qu56qf0154m+EY98aaD2GUJl6JgSAr1kaTmvm6pPP/Bbwq90ZTc/NQ/T7lxQVWosvya43Vd163Z+/bTRz6WwJo1a+xOUX3yd5GT3+v1VJJXWsiCEQNGFCRkU2Zf81tqX5PsuqLoZp599OfkOwrObdj3fAO7fiZgt81gxtIr+fJTxFu7Ce4/SfjEJkRDxG2z47M5aeofQL1sul75pTvkVX+7SgHACqPvWc3l//42Qj4eHG3Xtn0UP/y4dM0p2Tv7+VdeefG5HJYLRt+SJUus5rqjJB/4LZZsZ8HKxWxZ5KLEfn7PDS9MQkwrfKZwGl9f/h3mjf88/ft/Q8+2HzPLEUWcvRwqryEdMwi9X0t/bRtGXMdls6Mg0R1P0CvLVtmttwgL/+HrOAv95xJrQdT6tZB4DTkPxKJSssml9B5uJn76KFUBmU375zLrM1NObdmyZfaoCjTU16OLDoxUAk+hiM1mxzXi+qOnJIS4QtZtMWn85SRffgxvRw2Fa/4TLZsltP1tgm++Tbo7idPmwCs7SJgqdYEY7uuu5sqv3cv1SxadL56WQG38J4i9jOQFaVIxmrGMjuo2Qie2ItuAIojGbmfVnfNoOl0/66IWsjscOEyNUM1vLGPWAsHt+Rx3Hga/pTPPZ7C42A5ZET0pYmkSrc1nGdixl+KeBq68x8ap7/8MYSCFw2bHZvPQ1B9BmzSBKV/9CqtW3z2iEkm0xkewYpuQPDrSxDxUczldtSECR7Yi2UAugaqua61QYqUQjXURaT9OIpEYTHEBAcuysASZwu5qgY79HNj9i6x39jX24vkrCM68mg8qFyDpCtmkAKZCW2s7dsMkEoe2d/fhjlj0JA1Op1OU3LKC67/193gmjbsQePOjWJGNSG4dabwDXfgiXaeCdNa8iSKDrRTe61tEZ+cdVqS/Uwj3H0GSJCRJQhDOi3fRLmQJEsgSdrCnTxygsWZnxtBUh9tZwNyn8ol2JYjEY1iChaqq9KsaBZ3d1GcSXP/Mkyy98doLk44EPs6BLt9B54kAnTW/RZLBVQIHQ/No7VhlRfo7hf7gh4IoioiiOAz4xxIYJAKIsoLHl+8wTZNUIq0d2XhG+faaR1hz6w853dXG8UQCNINIOM6q997G5nEMT2Kk0JrWngdeJmMoK+mqz3D2g61IEjiK4Gh8DifP3mtFw91Cf/AjASwkSQIYFfxFCciyjGEYWNb5/m9ZFoIgoBmq8srj25g3bx6pTJJQsB81ncHSDf7U2cP+Z5+mpLCQB77xEHYFtKZHsfqfR3JnEUsEcK6kq1Gk/f23EUVwFcKxxGUca/8KiViA3p4aQRCEPwO/EPRIIqMSyLE2TRPTPH9BTKfTPPPMM8yeM4tUOomYFXnise8zPZBlmWXRmlL50UMPUX3gAG++8EXuWrQT0ZZBLAYcN9PXqtC6/9y7vTMfGrJTOdK5mthAgL7eI1iWiWVZGIaBJEkJwHOp6n8sAUEQEEURXdexLIvCwkJuv/12gsEgfr+fzZs309p4mna7Q3+915Tff/4HnGlp4dZb7+B793+RL99pQ7JuorfFTvN7O8AycHihzZhETff9JGJRujs/xDAMBEFAVVWmTZsWveeee3xr1671TJs2bdAFY7aQZVnI8vll0zSRJIlsNsvKlSuJxWJIksTAwAC//vWvURQFXc3KV1x5FaWVFcSiURQZuhqBM9P44weH0FJxXF7oEsaxv/M+tIzG2faj6LqGKIpomsbEiRMH7rrrrvwJEyb4BEGwSktLBcMwEEVxEFfueUwKCIKAIAiD1cmt5Szl8/lYvHgx27Zt4+677+aBBx5AU1X8fj/hcJgth+0sfqaea+ZDSCjiUM83SKUNzp45hWFog13F6XTGH3zwQW9FRUW+qqoANDU1GYqiyDngn0gBAJvNhqqqSJI0aCFZlqmvr0eSJCzrXOtct24dTz75JKZpkkqlEASBkpIS1q9fT4HPww+rvFrNjw4r+zf8F20tpwYrnqukpmmsWbPG6/V6MU2TeDyeeumll1wnTpyQ8/PzKSgouMAdYyIgyzKWda6FaZqGoigIgsDhw4dJJpMoioKmaUiSRDQaxTAMXC4Xfr+fo0ePsn37dhRFxuVSlM2vvkBbyymG2mEooLKyMgKBQOa1115zVFdXu5xOJ+Xl5YiiOKz6uS44ksSoZ8Butw92g9xvWZax2Ww0NDQwY8aMQYKKouD1enE6ndTW1rJx40bOnj2L1+vNdZNBO44MRVF46aWX2Llzp0MURSZPnoyiKJimeVHwuedLKpBLomnaYBJN05g1axaXXXYZmqYxc+ZMPvzwQ44dO0YsFqOjo4P29nYOHTqE1+sdJvlo0gOIokhtbS1lZWU4HOeG39C2PbKwOfBD94yqgM1mG9yUOwPZbJb777+fVCrFjBkz8Pl8HDx4kJ07d9LV1UVnZyd+vx+fzzdYLdM0MQxjVEC5GAo8V9mhFTZNc9BOOfCjKjBx4kSnpmlllmXhcDgG25amaZimybx585gyZQoApaWl7N69m2g0ykcffYQsy/h8Ptxu9zD5cwAupsBI4KOtDwU91D4ej2em3+9vG9lYSwVBIJPJ4HK5sNvt2Gw2RFHktttuI5PJUFlZSTqd5sCBA+zevRu73Y4kSbjd7sGuNVTNS4EfGbn9OdK555ySgiCQTqfJZrPIslxqmqYwzEJ/7j67amtrby4tLR2s+PTp05kwYQJ2u53i4mI2b95MJBLhzJkzKIqCZVk4nc4LbJcDMBbgl1rP5YvFYqRSKdLp9F6Hw5GCIRbq7OxMV1RUNGSz2cclSdoTDAYfDYVCZRUVFSxcuBBVVZk9eza9vb3U1dVx6NChQf8qijLYWnOgcy34UgRGAz604+S8H4lESKVSZLPZvnA4/FQymdxbWlra2tjYmBqmQFtbWwQ4PH78+IBlWcez2ew95eXl91VUVOD1eikoKGDDhg2Ew2F6enqw2WwYhoHX60UUxcF5MbTnj3YGRt5yRyNjmiaJRIJkMomu61oikdgYi8VeE0WxMRKJBCKRCMMUGBrd3d0dQGD+/PmRBQsW3GeaJpWVlTQ3N9PT00NzczOCIKAoCqIo4vF4sCxrcLgNbXU5K40cQiOBD92TyWRIJBLouk46nd4VCoWeE0WxLhgMtgHD2tqlXmiyy5Yt+2llZSV+vx+3282mTZtoaGigo6MDp9M5eLAcDge5e0zOOhdTYOjBHgleVVUSiQSZTAZd1xsDgcDTgiB8JAhCSyAQSDBKXJTAE088Md0wjOvsdjtTp07lxIkTRKNRq7q6+t1YLLbS5XLh8/nw+XzIsjwIIDe9cwrkhuGlgJumSTKZJJPJoGnaQCQSeS6dTu8RRbEhEAj0XaLIFyfQ39//zrJlyygqKkKWZXbs2EFfX9+m7u7uVrfbPaCq6ore3t5xdrsdv9+PqqqDJHKVH6nAaHZJJpOkUikMwzASicSWRCLxummadaFQ6Awj7DJmAg8//PByh8Mx3ePxUF5eTk1NDdlsVv/lL3+5DVBUVe3Xdb3H7XZPCYVCnxsYGPCWl5djt5/775coioMEhr6aDr0OZDIZ4vE4hmGQSqUODQwMbACOAs3BYHBUu4yZQCqVevWKK67A4/FgGAbV1dW0tLT8HEgATk3TjpeUlLyhKMo4XderDMO4p7m5eYXf76esrAxJkobNgaHAdV0f6vOOSCTynGmaNYIg1H+cXcZMQFXV8U6nE6fTyb59+9B1Pfb666+/CriAU0AwEAgA9E2cODFomuZZ4EAsFrsvFotVlJWV4ff7AYadiSE+T0Sj0Zez2ewfLMs6GQwGWxmDXcZMwGazIUkSra2t1NfX09TU9F2g988/w6Kzs7MLCE2aNKnbsqwW0zRv7OnpuTMSieTlJmgymSSZTGIYhpFMJt+Nx+O/B2qBpk9ilzETsNvt9508efJpVVWtVCq1fuvWrRs+Jk+2o6PjpMfj6fN6ve2yLO/LZrNLBEFYrWmaLRaLoev6G/39/b8TRbEDaAwGgxcU4y+JT/7F7MeHWFBQ4CktLZ2sKEop4DIMI2lZVl9vb29HOBxOAJ/4y7yLxf8Cqcce7B/KtMAAAAAASUVORK5CYII=", "icon_hash": "4740e8214f71a7b8bfa204b086a75d41", "icon_fuzzy": "1a1010aa6a1d01679c6b3c7d467dd16a", "icon_dhash": "7cfccce0d88ce672", "imported_dll_count": 5 }, "data": null, "strings": [ "JTDictionary.TValueEnumerator", "+TArray", "8/878H8Z8b8p8~8", "3TDictionary&", "(A;OICI;", "&op_UnaryPlus", "FAsUByte", "|Winapi.Windows.PkgHelper", "ClassInfo", ":6:::>:B:F:J:f:}:", "$]_^[", "7,7;7]7|7", "505b5f5t5", "<(<0<8", "Invalid destination array\"Character index out of bounds (%d)", "2$242:2J2]2k2z2", "ShortInt", "9*989N9c9q9", "FBufPos", "Range check error", "System.UITypes", "7/7:7\\7", "!TMethodImplementation.TInvokeInfo\\", "< <0<8.TValueCollection;", "Comparer8w[", "stdddddddddudddddddddddddddv'wxyz{|}~", "<0<>.TPairEnumerator<", ">1>D>W>l>", "TLZMA1SmallDecompressor'", "BHl~q", "iso_8859-6", "8H8s8", "ReturnTypeInfo", "FromOrdinal", "}c+F@nA", "Ancestor", "aaaaa", "VOleStr", "\"IComparer", "819G9[9", "ExceptionRecord", "Message", "", "$TMultiReadExclusiveWriteSynchronizer", "878M8^8r8", ";\";7;O;W;_;g;o;w;", "AIdentToInt", ":$:(:P:w:", "787<7e7s7", "TReader", "838H8^8u8", "626=6B6R6]6b6r6}6", "ATicks", "SetEvent", "t=HthH", "tkWString", "FOffsets", "PIntfMethodEntryTailx$Z", "PTypeData", "022A2", "IsClear", ":+:A:R:_:g:u:", "Property '%s' is read-only", "iso-ir-148", "=;=E=I=h=", "elType2", "ReturnType", "2\"2)2@2D2H2c2g2k2", "3\"383I3^3l3", "AMPM ", "Ancestor for '%s' not found", "TCustomDecompressorClass", "CurrentBuild", "Boolean", "FAsSingle", "CriticalSection", "]TEnumerable>", "DictionarySize", "TProcedureParam", ":$:(:,:0:8:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "FClients", "VLongWord", "WaitForAny", "TPropSetK", "$TEnumerablel", "ADelay", "=/>=>K>Y>g>t>", "MovEBP_ESP_1_89", "UninstallDisplayName", "Invalid property path", "iso-8859-8", "GetDriveTypeW", " ", "WizardSmallImageBackColor", "TMultiWaitEvent", "WizardSizePercentX", "PropInfo", "sms-FI,sms,se", "FreeEncodings", "DebugInfo", "1TList.TEmptyFunc", "EVariantArrayCreateError8", "UnsafeAttribute@!W", "Variant overflow", "_RTL_CRITICAL_SECTION", "7TArray>", "GetArgLoc", "2,2?2M2c2v2", "TFileSharing", "TGlobalContext", "AsVarRec", "crGreaterThan", "UnitScope", "hij@klmn-opqArstuBwxyz{|}~", "TComponentStyleItem", "AObject", "TBasicActionLink", "LookupRoot", "0-0[0", "Saturday", "EVariantError(", "PProcedureParaml\"Z", "TPropSet", "January", "%s[%d]", "6>6L6", "?#?'?+?/?k?", "+IEnumerable", "WriteBufferData", "HTDictionary.TKeyCollection;", "1K2O2|2", "6#606D6Q6f6|6", "PInstItem", "", "@TDictionary.TItem", "7b7o7", "user32.dll", "iso_8859-9", ";+;B;W;e;t;", ":@:y:", "4(40484@4H4P4X4`4h4p4x4", "TRttiMethodType|", "5h5z5", "?,?8?", "`>g>", "UnaryOp", "9 9$9(9,9094989<9@9D9H9L9P9]9n9", "TDuplicates", "iso-2022-jp", "3!3/373E3W3g3o3}3", ";(;6;J;W;_;m;", "Uh9e]", "vaInt8", "7 7$7(7,7074787F7N7`7r7", "SetArg", "Extended", "EAccessViolation", "4I6h6", "TRttiMethodTypeQ", "(basic) procedure ", "0#090L0T0b0p0", "This program must be run under Win32", "AElCount", "$TList(", "ATypeInfos", ":$:,:4:I:W:_:p:", "*TEnumerator(", "FInBufferAvail", "STATIC", "DeleteFileW", "GetValue", "ReadResHeader", "AQualifiedName", "Windows 2000", "mkProcedure", "SetProc", "4!444E4X4f4z4", "2t3{3", "TChaCha20Ctx@", "", "LongBool", "6@6{6", "/DIR=\"x:\\dirname\"", "ftDouble", "9Y:]:a:e:i:m:q:u:y:}:", "UhRxW", "tpTimeCritical", "Variant", "TRttiPointerType8", "AClient", " !\"#$%&'(!)*+,-./0'", "TPoolToken<#\\", "SVWUQ", "DropContext", "UInt64", "GetBytes", "StringKind", "Invalid destination index (%d)", "ibm863", "AItems", "NumPermissionEntries", "8 8p8", "EArgumentOutOfRangeException$qX", "OnNotify,", "Shared.SetupEntFunc\"Compression.LZMA1SmallDecompressor", ";+;=;V;g;u;};", "?!?/?C?P?X?f?x?", "cspc8codepage437", ";*;.;2;6;:;>;B;F;J;N;R;V;Z;x;|;", ">C>c>", "TArray", "csReading", "DesignInfo", "8 8$8(8,8084888<8@8D8H8P8X8z8", "FLoaded", "TEnumerable", "TRttiObject", "GetPreamble", "? ?$?(?,?0?4?8?.ParrayofT", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;a;v;", "011Qm", "EVariantArrayLockedErrorx", "091&2G2X4g4n4", "? ?$?(?,?4?8?'", "iso-ir-149", "TPoolToken&", "<(<>4F4N4V4^4f4n4", "435C5M5f5", "Exponent", "525C5Z5h5y5", "FAttributeGetter", "0!0'0,02070=0D0J0V0^0g0s0y0", "ACapacity", ";K;u;", "7#747A7I7Z7i7q7", "t]gdt", "TRttiInstanceProperty", "7&8>8G8R;Y;", "2%262I2Q2_2v2", "=$=,=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=p=", "count64", ";TDictionary.TValueCollection", "DTDictionary.TValueEnumerator ", "System.Math", "AsOrdinal", "/Lang=", "3 3$3(3,3034383<3@3D3H3L3P3d3p3t3", "FFinished%", "TWriter(", "ClassName", "em92a;", "/NOSTYLE", "3N3v3", "TObservers.TCanObserveEvent", "(TList.TEmptyFunc", "/TEnumerator", "TPrivateHeap&", "CompiledCodeText", "Specifies the internal name of the language to use.", "EVariantDispatchError0", "EnterCriticalSection", "t$>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>x>", "iso-8859-2", "EVariantBadIndexError", "Event", "Extract", "TRttiManagedField", "$IComparer", "csDesignInstance", "Construct", "TCriticalSection&", "ResetEvent", "Invalid pointer operation", "HandleU", "dupAccept", "FIndexedProps", "GetPackages", "pnU`Y", "@u*1`Iu", "TotalElementCount", "MH)Xe", "ReadVar", "=D=Y=j=", "TPropSetV", "TRttiInstanceFieldClassictj\\", "]TEnumerator>0", "hz-gb-2312", "3 3(3034383<3@3D3H3L3P3T3X3\\3`3d3h3l3z3", ">*>=>P>^>p>", "AsBoolean", "StartGroup", "aTEnumerator>(", "0,0;0C0Q0c0q0y0", "fsNZero", "BeforeDestruction", "cp775", "9);0;Q;X;", "7&7x7", "? ?$?(?,?D?V?Z?x?", "Item1", "cp1250", "Out of memory", "FBuckets", "c6?Bwk", "ITDictionary.TItemArray", "%LazyLoadAttributes.MakeClosure$ActRec", "5$5,545<5n5", "!TArray", "%TEnumerable", "303c3n3t3", "3<3U3x3", "vaWString", "Thursday", "TBasicAction", "csLoading", ";E&", "2H2t2", "7TCollectionNotifyEvent", "StringFileInfo", "7F7^7n7x7", "FActiveClass", "pfConst", ">+>A>T>b>u>", "cnDeleting", "TList&", "cspc862latinhebrew", "InnerException", "opaque_BufferLim", "QualifiedClassName", "TFilelCa", "3-3;3Q3f3t3", "HeapCreate", "4(4L4P4w4~4", "$IComparer", "FOnChange", "FromMilliseconds", " ", "doOwnsKeys", "SVWUj", "5&5.5?5P5X5i5z5", "eucjp", "2V3m3", "_od#:.", "InitObservers$1$Intf", "OnlyBelowVersion", "8*8<8_8c8", "232@2H2V2h2y2", " index ", "&op_GreaterThan", "aTEnumerable>'", "6$6,6:6G6Y6k6s6", "{}xMw", "TRttiDataMemberE", "VDouble", "OnFindComponentInstance", " TList.TEnumerator", "PTypeInfo", "PProcedureSignature", "ParentInfo", "MethodKind", "&TEnumerator(", ",TEnumerator,", "Collection", "iso-8859-11", "? ?$?(?,?0?4?8?.arrayofT", "cp869", ".ParrayofT", "csibm861", "2,2A2Z2k2", "FEvent", "JTDictionary.TValueCollection;", "6 6$6,64686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "TMBCSEncoding&", "MaxClassesInCache", "Setup", "ibm860", "3L4b4y4", "0 1+141D1L1T1\\1`1d1h1l1p1t1x1|1", "ListP", "CompType", "IntfUnit", "=F>Q>\\>", "SafeArrayAccessData", "VariantClear", "CharCount", "", "9.959U9l9", "FFieldType", "FBlockedCount", "IEnumerable", "iso8859-13", "TVarData", "7.767G7U7]7k7x7", "Overrides the default directory name.", "DynArrAttrData", "=#=G=K=n=", "TListSortCompare", "euctw", "wdsDynamic", "IsType", "2J2r2", ";C$tI", "FInnerException", "9aBcPaH.TPairEnumerator", "AIndex", "^>", "GetLastError", "List$([", "TValue", "ReadInt64", "AppPublisherURL", "?F?}?", "FAsObject", "6 6$6(6,60646T6o6s6", "(TRttiPool.GetPackageList.DoUpdate$ActRec`", "wdsDark", "505@5H5P5X5\\5`5d5h5l5p5t5x5|5", "Params", "878;8b8l8", " AMPM", "5-5;5Q5f5t5", "1%2G2", "TRttiPackage", "S0_^[YY]", "]TEnumerable>'", "FValueCollection", "pfVar", "System.Hash", "DialogFontBaseScaleWidth", "#TThreadList", "Type_18", "1(2=2K2]2l2t2", "UhR[Y", "FStackSize", "FSize", "EVariantUnexpectedError", "csibm869", "0%0-0;0J0`0n0v0", "= =$=(=,=0=4=8=<=@=H=P=X=", "Comparert'[", "/RESTARTAPPLICATIONS, /NORESTARTAPPLICATIONS", "EntryCount", "TEnumerator(", "ListA", "9\":R:i:", "-IComparer", "iso8859-16", "xXZZ\"", "6,777", "TThread.TSystemTimes ", "/HELP, /?", "ibm865", "686C6r6y6", "?2?L?e?}?", ",IEnumerable", "Default", "iso-celtic", "7a-eF", ":&:5:=:L:", "IsValidLocale", "4 4$4(4,404L4c4g4", "6'6/676?6G6O6q6", "5$656]6n6", "=5=>=", "&TEnumerable'", ";4", "IInterfaceComponentReference", "ProductName", "Collisions", "4#4'4+4/43474;4?4y4", "'TArray", "AIntf", "|@vp/?3?Z?d?", "/TList.TEmptyFunc", "MakeWithoutCopy", "UhG^Y", "TListTh`", "NumIniEntries", "RemoveComponent", "2@2a2", "\\P=FP*", "vaTrue", "VUInt32", "#,,.Q", "TlsSetValue", "AHelpContext", ">", "EMathError4{X", "646w6U7c7q7", "9 979;9?9Z9b9z9~9", "TStream ", "CTCollectionNotifyEvent", "\"IComparer", "2TList.TEnumerator5", "ReadCurrency", "RttiDataSize", "Invalid argument to time encode", "Rni($", "/FORCECLOSEAPPLICATIONS, /FORCENOCLOSEAPPLICATIONS", "UhcG`", "TRttiPool&", "windows-1252", ">>>e>v>", "_RTL_CRITICAL_SECTION_DEBUG ", "1 1$1(1,1014181<1@1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "Entry", "=2=@=X=g=o=", "Invalid access$Error creating variant or safe array)Variant or safe array index out of bounds", "<$<@ >$>(>,>0>4><>", "CheckTokenMembership", "sr-Latn-RS", "8X9_9", "TypeKind", "TRttiManagedField\\", ")TList.ParrayofT", "LicenseText", "SaveToFile", "=8=H=P=X=`=d=h=l=p=t=x=|=", "System, [", "iso_8859-14:1998", "5.6C6T6i6w6", "TInterfaceEntry", "csisolatinarabic", "3 3$3(3,3034383<3X3o3s3", "PVmtMethodExEntry", ":TDictionaryH", "LockCount", "TIntfMethodEntryTail", "[KCpJ", "AParameters", "iso8859-3", "FTypeToName", "ReadData", "Equals", "4,4=4O4e4}4", "%LazyLoadAttributes.MakeClosure$0$Intf", "PM^w`8/w", "GetString", "GetDiskFreeSpaceW", "6,646<6D6H6L6P6T6X6\\6`6d6h6l6p6x6", ">D?\\?", "849m9", ":*:A:j:", "vaBinary", "EVariantBadVarTypeError", "3,3B3P3`3r3", "7\\8a8", "^^bVIb", "1o1w1", ";*;A;U;a;", "Argument out of range", ")TList&", "TRegGroups&", "889X9`9", "878V8", "ToString", "?3?K?S?[?c?k?s?{?", "immett", "laDestUnique", "Address", "PList|_^", "opInsert", "ABuffer", "AElType", "7$7(7,70787@7D7H7L7P7T7X7\\7`7d7h7l7z7", "=3=I=^=l=", "FBufSize", "2~2`3u3", "7#898J8^8f8w8", "%TEnumerable'", "TMethodImplementationp", "Windows Server 2008", "8)888", "property ", "Thread", "macthai", "<#<5<=", "<,<<.TPairEnumerator", "VTEnumerator>hT[", ">wp0>wP4>wp", "TSynchroObject", "9.9?9]9k9", "AOwnsObjects", "AAccess", "", "__dbk_fcall_wrapper", "Uh6 \\", "UnhandledExceptionFilter", "LongTimeFormat", "tis620.2533-1", "smn-FI,smn,se", "RootName", "QK#=u", "=\"=1=H=`=d=", "ccCdecl", "prLowest", ":TFormatSettings.:3", "TRttiPackage'", "utf-16le", "procedure ", "TRttiIntfMethParameter6", "PAnsiChar0", "25292W2[2v2z2", "TThreadLocalCounter'", "FStatus", "vaNull", "<'", "EStackOverflow", "TRttiInterfaceType=", "PVariant", "=+=@=L=T=e=p=x=", "csunicode", ":%:::H:^:t:", "2#282X2f2w2", "Unlock", "=\\>l>t>|>", "BeginInvoke", "VarR4FromStr", "AComponent", ":\":*:8:F:]:p:x:", "GNo single cast observer with ID %d was added to the observer collectionFNo multi cast observer with ID %d was added to the observer collection$SHA2: Cannot update a finalized hash", "RawData", "GetReferenceToRawData", "tkVariant", "/LOG=\"filename\"", "IEnumerable", "CappedSize", "SleepConditionVariableCS", "FGHIJKLMN&OPQRS", "greek8", "AIntegerType", "ALeft", "GetCurrentThreadId", "?\"?4?G?Z?n?", "DTDictionary.TValueCollection;", "ReadMethod", "OnChange", "BTDictionary.TKeyCollection;", "0!020G0U0k0", "DTDictionary.TValueEnumerator", "0'0~0", "WU|UEm", "FromDays", "TMultiWaitEventImpl&", "InstanceRoot", "<\"<1<9.TPairEnumerator", "Finished", "HeapFree", "=(=8=@=P=X=i=q=", "AppSupportURL", "rDlPtS", "= =$=(=,=0=4=8=<=@=D=H=U=i=q=y=", "iso_8859-1:1987", "ITDictionary.TKeyCollection;", ",TEnumerator(", "2 2(2,2024282<2@2D2H2L2P2T2X2\\2`2m2~2", "=,=@=D=d=t=|=", "L6Mel", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "iso8859-9", "4(484@4H4P4T4X4\\4`4d4h4l4p4t4x4|4", "l>}>", "<(<0<>", "TArray", "???N?V?h?", "csiso2022jp", "IDispatch", "5O6S6z6", ".rdata", "FReadPropData", "< <@<[<_,>:>M>c>t>", "1TList.TEnumerator", "File not found", "UpdateAction", "VWord", "LockSemaphore", "Uninstallable", "<,>N6", ":!:0:C:I:W:[:j:}:", "UhtbY", "TTimeSpan", "ftSingle", "OnNotify4s^", "zh-HK,zh-Hant,zh", "&((((", "=/=C=K=\\=j=r=", "94:C:", "TCustomComparer", "TRttiType3", "9(9<9T9o9", "KTDictionary.TValueEnumerator", "QualifiedName", "VarNot", "VarType", "Currency", "TThread", "3'3/3L3\\3d3l3t3x3|3", "8-8=8", "8'9c9r9", "CloseApplicationsFilterExcludes", "SizeOfMem", "Uh#sY", "AParent", "TStrongRandom: Failed to get address of BCryptGenRandom", "707@7D7H7P7X7\\7`7d7h7l7p7t7x7|7", "GetDataSize", "iso-8859-3", "cnAdded", "2TList", "WriteDate", "ExtractAt", "IOp6TL,j}", ">2>B>J>[>w>", "1!1<1W1p1", ";0;G;Z;s;", " ", "TSeekOrigin", "4#4-4;4E4T4X4`4d4l4p4x4|4", ";0DGG", "iso_8859-14", "<&=;=I=[=j=r=", "-Winapi.ImageHlp", "vaIdent", "Destroying", ";+;3;D;b;f;", "2 232B2X2g2o2}2", ">!>/>A>S>[>i>x>", "IDATK_cS|", "FNameToType", "ItemClass", "FFile", "GetCPInfoExW", "=*=8=L=Y=a=o=", "DeleteCriticalSection", "BTDictionary.TKeyCollection`", ">0>A>O>W>e>{>", "PRecord", "EMonitor", "bs-Latn-BA", ":!:6:D:W:l:z:", "0 0$0(0,0004080@0D0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "8(8,8084888<8r8", "+TList.TEmptyFunc", "515B5T5b5o5", "FTail", "!TArray", "AOpenArray", "3TPair", "FHandle", "UnsafeAttribute", "001P1_1o1", "macromania", "UhqI_", "%TEnumerable", "?\"?0?>?J?X?", "RecInfo", "404K4\\4p4t4", ")TList.TEnumerator5", "DWWWe?", "ccReg", "P]_^[", "9TDictionary4", "FSentinel", "System.VarUtils", "7)7T7c7g7", "DialogFontName", "NameIndex", "IntfGuid", "8*979o9", "Uh^e]", "9 9$9(9,9D9`9l9p9t9x9", "SafeArrayGetUBound", "csCheckPropAvail", "FHandleToObject", "4 4,4?4R4`4h4}4", "?+?z?", "8-8P8d8w8", "'", "iso8859-11", "", "TDateTime", ">3>?>M>", "TProcParam6", "3%3-353=3[3w3", "Translation", "AppPublisher", "?!?I?z?", "Bounds", "FileName", "FOnExecute", "4-454:4F4K4R4]4f4r4", "0TArray>", "Uh`]a", "=$>4><>D>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "ENonPublicType", "FMMaped", "QTArray>", "/HELP", "fsZero", ";c'", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>", "<,.TEmptyFunc", "Observer is not supportedLCannot have multiple single cast observers added to the observers collection4The object does not implement the observer interface5Insufficient RTTI available to support this operation", "FatalException", ",TList.TEnumerator", "Stream read error", "?%?3?C?U?r?", "", "TRttiIntfMethParameter", "TOrphanPackage&", "FPosition", "8D8d8", "// NOP", "4!4%434A4L4", "=!=7=;=E=M=U=", "3!4.4?4V4d4t4", "=TList.TEmptyFunc", "Abstract ErrorKAccess violation at address %p in module '%s' (offset %x). %s of address %p", "P8^[]", "tkProcedure", "2 2G2Q2U2t2", "TRttiInvokableType'", "9%939B9U9h9v9", "pfOut", "313<3D3l3w3", "Pointer", "&TThreadList", "9(9G9k9", "TComponentStyle", ":;;Q.", "2/272E2T2n2|2", "6/6K6Y6l6", "System.Variants", "0)1g1", ")AkBpm", "0O1S1", "WizardImageBackColor", "0.060H0", ">$>6>K>Y>a>p>x>", "DefaultHandler", "`.itext", "TEnumerator`", "56789", "FDecrypt", "OTDictionary.TValueEnumerator|", "PVmtMethodEntryTail8 Z", "BuildUp", "747B7Y7n7|7", "EndWrite", "MIMEName", "SetSpinCount", "TEnumerator(", "tkFloat", "/TASKS=\"comma separated list of task names\"", "FCanObserve", "VDate", "ExecuteTarget", "ecma-114", "EInvalidCast", ";TDictionary.TValueCollection;", "ibm437", "ElCount", "IsOpenArray", "@.reloc", "7*727@7P7d7l7z7", "?'?9?G?U?d?l?z?", "RemoveItem", ">#>.>", "TRttiStringTypep", "ProcessLocksList", "#IEnumerable", "Priority", "?\"?*?8?J?Y?a?o?", ":+;J;G=p=", "E*};_", "InfoBeforeText", "&TListl", "7\"717B7U7a7n7}7", "868D8S8c8u8", "FStackInfo", "3 3$3(3,3D3W3[3|3", ";!;);1;9;A;I;Q;Y;a;i;q;y;", "RootAncestorH", ":G:K:O:S:W:[:_:c:g:k:o:s:w:{:", "040B0Q0a0s0", "BkU'9", "EAbortLsX", "8'8/8M8m8~8", "6 6>6a6", "FIndex", "FCapacity", "jjjjjjj", "TSetupVersionData", "?/?E?X?`?n?|?", "opaque_RemainLen", "3 3$3(3,3034383<3`3~3", "FExecuteAfterTimestamp", "TCollectionItem\\", "TRegGroups,", "GetCurrentThread", "253\\3", "asmo-708", "0 0$0(0,0004080@0r0", "6$696G6Z6o6}6", "ReadBoolean", "/COMPONENTS=\"comma separated list of component names\"", "212c2h2", "TRttiInterfaceTyped", "FResultFP", "windows-1254", "TFindMethodEvent", "Buffer", ".edata", "1 1$1(1,10141A1T1e1{1", "=,=:=P=e=s=", "AsRecord", "TList&", "TIdentToInt", "(TList.ParrayofT", "dkVtable", "%IEnumerable", "CIDAT", "ConvertStringSecurityDescriptorToSecurityDescriptorW", "= =$=(=,=0=D=S=W=x=", ";%;-;5;=;E;M;U;];e;m;u;};", "#IEnumerable", "VarBstrFromBool", "NameThreadForDebugging", "EVariantInvalidArgError", "ifUnused3", "/ALLUSERS", "FResultLoc", "t f;J", "IsStatic", "0 0$0(0,0004080<0@0D0H0L0T0\\0d0", "ExceptionCode", "VarDateFromStr", "DVCLAL", "D$hPuz", ";#;:;A;K;O;l;p;", "laXor", "~]x[[)", "300@KK", "'u);7~%", "%System.Classes", ":!:8:M:[:r:", "TRttiIntfMethod", "Delete", "TRttiArrayType", "InitInstance", "Alias", "090C0h0x0", "lmOverwrite", "/NOICONS", "cmBzip", "GetTickCount", "2&242G2^2l2", ".TList.ParrayofT", "5%6)6P6Z6^6|6", "iso-ir-101", "+5fM\\", "EReadError", "HTDictionary.TKeyEnumerator;", "8g8t8", "363W3r3", "AItem", "InitDecryption", "Q4_^[]", "ZE6?D", "TSetNameEvent", "|||%yyy", "<9<>l>", "CurrencyString", "9.:2:Y:c:", "DisposeOf", "ASharing", "6,646<6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6", ":(:1:", "opaque_Probs", "ExceptionFlags", "7n048", "(TArray", "CreateFmt", "WriteInteger", "EIntOverflow", "TDictionaryOwnership", "ccSafeCall", "7&9;9F:", "cp936", "BaseType ", "30343;3N3b3w3", "TVmtFieldEntry", "UnitName", "EraStart", "skAnsiString", "<-<;3Q3b3u3", "CurrentH5_", "Compressed block is corrupted", "Windows 7", "lstrlenW", ";1;>;O;Y;a;o;", "5!535I5Z5m5~5", "Wednesday", "FMethods", "Invalid code pageNNo mapping for the Unicode character exists in the target multi-byte code page", "TRttiProperty", "~v8E]A=48R", "5K6`6n6", "4l5}5", ">w0u=w", "ImplGetter", "5#5:5O5]5q5", "6&616B6W6m6w6", "ftComp", "/TList.ParrayofT", "#IComparer", ":4:D:L:T:\\:`:d:h:l:p:t:x:|:", "4)4;4I4Z4n4", "<,<;+>8>H>", ";$;3;;;I;\\;k;s;", "0)010B0P0X0f0t0", "FObservers", "<\\=e=", "TEnumerator(", "8T8r8", "ACollection", "Read64", "NumTaskEntries", "&TEnumerator(", "WizardImageBackColorDynamicDark", "IsRegistered", "SystemTimes", "3TList.ParrayofTdv[", "TRegGroup", "TLightweightEvent&", "Winapi.SHFolder", "AAncestor", "Origin", "6,6@6S6g6{6", ";&;=;R;`;w;", "FClass", "#TEnumerator(", "TWriterProc", "/MERGETASKS=\"comma separated list of task names\"", "PCurrency", "4#494Q4V4", "Instructs Setup to create extra logging when closing applications for debugging purposes.", "List count out of bounds (%d)", ":1:J:`:~:", "4&484J4\\4q4", "1 1$111H1]1e1", "BTDictionary.TKeyEnumerator;", "5+5?5P5h5", "0$040<0D0L0P0T0X0\\0`0d0h0l0p0t0x0|0", ",TList.TEnumerator5", "TArray", "TRttiRecordMethodl", "iu-Latn-CA", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", ">0>A>M>~>", "gb2312", ": :$:(:,:0:8:S:b:j:x:", "2(282@2H2P2T2X2\\2`2d2h2l2p2t2x2|2", "Reset", "TInstItem", "0:1?1X1h1y1", "=\">6>q>d?", "0 0(00080@0H0P0X0\\1`1d1h1l1p1t1x1|1", "BufSize", "0%1_2", "2 2$2(2,2024282<2J2\\2n2", "CrystalIDEA Software ", "SafeCallException", "1*1H1\\1d1", ";j;q;", "*TEnumerablet", ";E~?", ">D>Y>b>", "34934", "FAsComp", ":%:4:D:H:L:T:\\:`:d:h:l:p:t:x:|:", ";+;E;M;^;};", ":%:3:B:U:o:}:", "SetupLdr", "?9?s?", ":%:,:6:M:v:", "3*3G3U3b3t3", "t,HtYH", "262b2n2y2", "opaque_Properties", "<@t!QS<$t", "RegisterClass", "WaitForAll", "WriteSignature", "SignatureU", "ONNR.", "AThreadID", "Listh3\\", "System(", "1#191P1e1y1", "EObserverException", "7%7:7N7d7", "Right", "TBasicActionLink7", "<'<<:H:l:", "9#:<:z:", "OnNotifyU", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "lmAppend", "070B0H0z0", "SpecialCryptContextType", "TDictionaryOwnerships", "CreateRes", "TUTF8Encoding", "PVmtFieldClassTabD", "<61E1L1S1Z1a1x1|1", "3\\3`3d3h3l3p3", "big-five", "0C0|0", "515R5y5", "frbbbG", "FAction", "2'3+3/333A3O3[3h3", "6#646}6", "EraEnd", "/LANG=language", "Writer", "IsObserving", "VRecord", "GetOpenArrayArg", "?'?5?G?^?l?", "TDirection", "System.Generics.Collections|", "CastToOle", "T*177gi", "D:\\Coding\\Is\\issrc-build\\Components\\ChaCha20.pas", "6-6?6M6Z6l6", "prNone", "IEnumerable", "TPropSet", "QQQQSV", "Uh5X]", "7$777M7^7", "TList'", "es-ES_tradnl", "az-Latn-AZ", "IComparer", "FTerminated'", "?@?]?u?", "VAnsiString", "tkString", "ContainsValue", ">-?:?N?]?t?", "BestGroup", "BeginReferences", "9TDictionary&", "euckr", "?\"?9?A?a?v?", "UhkR`", "9!:h:l:p:t:x:|:", "EraName", "TList.arrayofT", "SVWRPj", "LibModule", "1^1s1", "FOnFindMethod", "9!9%9)9D9d9h9", "Index", "WelcomeFontSize", "TypeSize", "dkInterface", "$TEnumerable", "IInterfaceList", ")IComparer", "1+1<1^1k1|1", "TListEnumerator5", "+TList.TEmptyFunc", "6 6C6G6n6u6|6", "FActionComponent", ". %s range is 0..%d", "AppName", "TPropSetK", "TArray", "4\"444K4Y4i4{4", "FPropName", "TEnumerator", "ExceptObject", "Uhy|]", "GetEnumerator", "&IEnumerable", "iso-8859-10", "6O7[7n7|7", "GetLocalTime", "TypeRef", "Instructs Setup to install in non administrative install mode.", "9TObjectDictionaryM", "Uh6+a", "3#343>3F3T3e3y3", "WriteIdent", "Instructs Setup to load the settings from the specified file after having checked the command line, or to save them to it.", ":0;S;^;", "4 4(464D4", "*TList.TEmptyFunc", "%TEnumerator4P_", "MaxLength", "G0]_^[", "EInvalidOp", "WriteVariant", "FStateAndSpin", "6 6(6,6064686<6@6D6H6L6P6T6b6j6|6", "FList", "Chars", "`.data", "IsObjectInstance", "WriteFile", "Int64AttrData", "=-=A=I=W=i=w=", "pfArray", "A1_d`p", "WaitAll", "TVarArrayBoundArray", "ComponentClass", "TAsyncConstArrayFunctionEvent", "CTDictionary.TPairEnumerator;", "L]_^[", "The password you specified is not correct. Please try again.", "?!?2?M?h?p?x?", "/CURRENTUSER", "253B3", "0 0:0H0W0j0", "EArgumentOutOfRangeException", "ntdll.dll", " TArray", "9\"9&9*9E9M9e9i9", "6`7m7", "UninstallLogMode", "FAsDouble", "%TEnumerator(", "TEnumerableD", "FOwnerships", "?Y>G?h?", "FWriteSignal", "TArrayTypeData", "==DBAV", "EncryptionBaseNonce", "Component", "<*=9=", "8@TList`1.Pack[1]$ActRec\\(a", "7B8m8", ">%>3>@>V>Z>q>{>", " IEqualityComparer", "prPowerUser", "TRttiParameter", "TThreadPriority", "csbig5", "IsImplementorOf", "9&9.9<9J9m9u9", "2TList.arrayofT", "OpenProcessToken", "3%3;3?3I3Q3Y3", "TMethodImplementation.TFloatReg", "3TDictionary", "AppReadmeFile", " ", " hD:a", "TwoDigitYearCenturyWindow", "*TEnumerator", "7:8I9[9", "3.8.1 ", "Duplicates", "TFieldExEntry", "FClassList", "1/161M1", "TimePMString", ";2;\\;v;", ">TDictionary&", "4(464F4\\4r4", "5TList.TEnumeratorpy[", "DTObjectDictionaryh", "}]]x<", "1)1H1T1X1\\1`1h1p1t1x1|1", "EncodingName", "DirExistsWarning", "iso_8859-1", "_Reserved1", "Queue", "=9=c=", "Keys8", "TOrdinalIStringComparer", "LocalAlloc", "TListSortCompareFunc", "AFilename", "407n7", "en-US,en,", "FRefCount", "PFieldExEntry", "UhRYZ", "5 595A5O5]5q5y5", "/RESTARTEXITCODE=exit code", "EHeapException", "9TDictionary.TKeyCollection;", "Comparer`", "KTDictionary.TValueCollection;", ":%:3:;:I:X:", "TMemoryStream", "TRttiIndexedProperty", ";*w@1>w", "1$121:1H1Z1l1t1", "FDecompressor", "vaUTF8String", "*TDictionary&", "?$?5?W?d?u?", "8;9N9", "SafeArrayPtrOfIndex", "PRTLCriticalSectionDebug", "=<>f>", "FVarType", "232Q2_2z2", "<<%?:?H?`?t?|?", "Contains", "4Z!S= ", "4+4B4U4f4y4", "?&?P?", "0,090A0N0T0d0q0w0", "UhaH`", "Winapi.PsAPI", "Truncate", "FKeyCollection", "ibm855", "PPTypeInfo", "TryGetValue", "PPropDatal*Z", "989Z9", "Inno Setup Messages (6.5.0) (u)", "QueryPerformanceFrequency", "TRttiRecordType@", "NTDLL.DLL", "4E5o5", "FindResourceW", "TProcSig", ": ;0;4;8;@;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "DefineBinaryProperty", "ReadPrefix", "0 0$0(0,040P0e0t0", "r`+l%", "TSymbolName", "Field", "CreateResFmtHelp", "8&8.868>8F8N8V8^8f8n8v8~8", "TElementAlias", ":.:2:P:T:o:s:", "1 20282@2H2L2P2T2X2\\2`2d2h2l2p2t2x2|2", "TArray", "=4=R=", "TInternalEraInfoRecord", "3TDictionary&", "5$5(50545<5@5H5L5T5X5`5d5l5p5x5|5", "BufferSize", ":*;1;@;", "4a4l4%5", "5,545<5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5", "IsSet$", "$IEnumerable", "$TEnumerator", "Integer overflow", "FBufEnd", "6\"7W7", "Start", "0#050C0K0Y0k0}0", "8$868O8]8o8", "7\"787I7W7_7m7", ",TList.TEnumerator5", "NewIndex", "1%131B1Y1l1}1", "HashCode", "0Q0W0", "Uhd`Y", "8K9X9", "; ;2;D;Y;l;p;w;", "CompressMethod", "MakeGlobalReference", "FormatMessageW", "CanObserve", "3TDictionary,", ">TDictionary.TItemArray", "TMultiWaitEvent<", ":;;;;;;;;<<<<<<<<<<<<<<<<<<<<<<<<<", "TCallConv", "-TPair", "=P=h=", "AddClass", ":$:,:4:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:", "FOnFindComponentInstance", "EOutOfMemory", "TList.ParrayofT", "uninstalltool_setup.exe ", "2 2.2E2X2`2n2|2", "7%8.8V<]<", "1)1=1E1V1d1l1z1", "TMonitor.TSpinLock", "cp1254", "VarBstrFromCy", "DynUnitName", "Position", "2*222@2N2b2x2", "?*?2?@?\\?k?o?", "Suspended", "TrimExcess", "0 040<0M0[0c0q0", "AGroupClass", "csUpdating", "csiso2022kr", "TList&", "TList", "PThreadInfo", "TPropFixup", "HIJKLMNOPQRSTUVWXYZ[\\]^_`", "SystemX", "2(2N2R2y2", "&TEnumerator", "OnObserverAddedtE^", "BTDictionary.TKeyCollection", "Shared.Struct", ";$;0;?;U;[;g;v;", ":l:q:", "5'5/575?5G5O5W5_5g5o5w5", "ReadStr", "FQueueLock", "FAsMethod", ">(?8?@?H?P?T?X?\\?`?d?h?l?p?t?x?|?", ":0:=:N:p:}:", "GetTempPathW", "PeekMessageW", "VExtended", "Property %s does not exist", "vaLString", "0(080", "WriteVar", "$0M0s0", "Z0_^[", "TRttiArrayType;", "9TDictionary.TItem", "Convert", "3F3N3V3^3f3n3v3~3", "NameList", "abcddddddddde", "FHelpContext", "VShortInt", "FldOffset", "AResult", "ClassType", "73777S7v7~7", "020@0W0l0z0", "cnExtracting", "DefaultUserInfoName", "ucs-2", "iso-ir-109", "TMethodImplementationCallback", "kWinapi.PsAPI", "VTEnumerable>", "3L3S3|3", "cp1255", "=$>P>q>", "=+=@=T=g=z=", "1 1$111H1d1}1", "TCustomDecompressor", "~array~of~", "mn-MN,mn-Cyrl,mn", "&IEnumerable", "TThreadList4s^", "GetModuleHandleW", "Q(_^[", "IntfUnitFld", "5&5>5M5U5d5", "XZZbee", "6#6+6<6m6q6", "SetSubComponent", "> >6>H>P>^>p>", "TDecompressorReadProc", "=,=4=B=R=d=l=}=", "9&959G9a9o9~9", "DTDictionary.TItem", "ManagedFldCount", "IdleTime", "=->I> ?_?~?", "euc-tw", "opaque_GlobalPos", "Software\\Borland\\Locales", "1#2-2P2`2h2p2x2|2", " ", "<$ar0f", "ProcOrMeth", "otUByte", "=\"=6=>=L=Z=i=q=", "sccCompressedBlocks2", "414f4w4~4", "TArray", ")TList.TEmptyFunc", "7TCollectionNotifyEvent", "5 6/7;7R7B8T8", "FTicks", "5!585N5_5u5", "0$0,040<0D0L0T0\\0d0l0t0|0", "=E>N>j>s>", "Uhiu]", "UhGv\\", " ", "5 595H5\\5n5", "0(0B0F0]0d0k0r0y0", "4*4>4F4W4e4m4{4", ">)???Y?", "csiso58gb231280", "8\"808S8b8", "=,>6>@>R>l>", "CleanupInstance", "ComponentIndexD>^", "System", "RaiseError", "0TList.TEmptyFunc", "Operation", "$TEnumerator(", "151=1N1`1h1v1", "63777^7h7l7", "8\"8*888J8\\8j8y8", "7 7$7(7,7074787<7@7H7P7X7`7h7p7x7", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8t8x8|8", "<4<;.TValueEnumerator;", ";&;<;M;`;u;", "GetDateFormatW", ">->?>\\>j>}>", ";0]0|0", ">'>+>H>X>\\>`>h>p>t>x>|>", "tOf;J", "2b2f2", "TValueType", "ReadListBegin", "4F5N5V5^5f5s5x5", "ArrayTypeInfo", "GetTickCount64", "MTDictionary.TKeyEnumerator", "ReadString", "Uh)EY", "FHashTable", ";2>9>t>", "Owner", "HasExtendedInfo", "cp-gr", "External exception %x", "VCLComObject", "0C1c1", "6.6=6E6S6f6u6}6", "InitializeCriticalSection", "7'7+757=7E7", "Uh8VW", "MTDictionary.TKeyEnumerator;", "5[5h5|5", "CurrentVersion", "8\"8*828:8B8J8R8Z8b8j8r8z8", "9$929:9B9J9R9Z9", "'TList.arrayofT", "onv,OUU", "AByRef", "ElementCount", "+A'CCtuw;rjq", "GetCPInfo", "fdTruncateExisting", "sr-Latn-ME", "TryParse", "8%868K8Y8j8", "FDecoderState", "0!0%0D0", "ComponentStyle", "? ?(?0?8?@?H?P?X?`?h?p?x?", "AHandle", "@UUUUUU", "DupsAllowed", "565Y5a5", "The sizes of unexpected leaked medium and large blocks are: ", "Application Error1Format '%s' invalid or incompatible with argument", "Shows this information.", "iso8859-2", ";\";1;D;^;l;{;", "9f9w9", "TChaCha20Context", ">+>3>A>P>", "hd\"rI_", "AIncludeActiveGroups", "LoadFromStream", "dSystem.Hash", "282S2m2", "TLibModule", "InitObservers$0$Intf", "iso-ir-58", ": :$:(:,:0:4:8:<:@:D:L:g:z:", "Uh\\L\\", ";+;:;I;", "'", "macintosh", "7-7D7Y7g7z7", "Qkkbal", "ITDictionary.TKeyCollection", "Compare", ">*><>O>W>e>w>", "7 8)8", "HasAttribute", "ReadSignature", "Handle", "6)6<6J6]6l6~6", "S-1-5-18", "?/?>?E?M?W?", "TMemberVisibility", "TFieldsCache&", "FAncestorList", "TReaderProc", "GetArg", ".didata", "040;0B0L0o0", "RegCurr", "NameListFld", ">[?n?", "opaque_Reps", "csisolatin4", "Initialize", "3(4H4P4w4", "FClassTab", "BeginWrite", "?%?E?I?g?", "2\"2V2", "Uhs1`", "MessageBoxA", "+TList.TEnumerator", "059G[~", "StaticQueue", "Yield", "VirtualProtect", ";G$tF", "JTDictionary.TPairEnumeratorH", "ListX", "7T7h7|7", "/TCollectionNotifyEvent", "2TList.TEnumerator", "VirtualQuery", ".arrayofT", "5*5;5F5N5l5~5", "FAsUWord", "UserTime", "?7?B?", "CurIndex", " TArray", "6<7@7D7H7V7d7p7", "TEnumerable'", "0&0=0c0", "7$7,7074787<7@7D7H7L7P7T7X7|7", "FReachedEnd", " !\"#$", "WWY[[gmi", "TAsyncFunctionEvent", "DataType", "Invalid property value", "3~4\\5", "FromHours", "8*8G8U8g8", "Uninstall Tool Setup ", "ReadWideString", "2W3^3", ";T.TEmptyFunc", ">6>C>R>e>i>x>", "5h6u6", "TRttiOrdinalType", "System.Generics.Collections4", "FInBuffer", "Please specify the password using the /PASSWORD= command line parameter.", "WriteDescendent", "=(=7=Y=x=", "UnregisterModuleClasses", "TList.ParrayofT", "$WizardSmallImageBackColorDynamicDark", "IFinalizer", "0:0j0w0,1?1", "FOnTerminate", "? ?$?(?,?0?4?8?", "(TList.arrayofT", "0/1d1", "9/9C9K9\\9j9r9", "ibm862", "PTypeTable", "=6=R=f=", "zh-SG,zh-Hans,zh", "VUString", "SystemT", "CreateWithExistingHandle", "tkLString", "505>5o5", "ParOff", "PListPd`", " TArray", "PList\\", "oShared.SetupEntFunc", "Uh:E]", "euc-cn", "BigEndian", "Timeout", "SeN_\\", ":R:l:", "HdGhM", "FConstant", "111?1O1_1q1", "<0<>.TEmptyFunc", "mkClassConstructor", "UhIgW", "TUnicodeEncodingH", "IntfFlags", "JTDictionary.TValueEnumerator;", "ksc_5601", "#TEnumerable'", "TFilex", "ReadValue", "%TEnumerabletQ_", "WriteMethod", ":(:6:J:W:_:m:", "RelTarget", "3(3d3o3x3", ">->5>C>U>k>|>", "CompareStringOrdinal", "Z_^[XX", "9i9x9", "0@0J0N0l0|0", "Resume", "535A5S5b5j5|5", ":':6:M:g:u:", "tkUnknown", "PExceptionRecordt6W", "=/>\\>", "1$1.181B1L1^1t1|1", "1=2%3)3-3135393=3", "keystream", "ifDispInterface", "7%7;7P7^7u7", "TranslateMessage", "RegECX", "TRegGroup6", " hd@]", "soBeginning", "0,050", "CharNextW", "PPackageTypeInfoX2W", "A call to an OS function failed", "6&7-7S7r7", "&op_UnaryNegation", "#TEnumerator(", ";$<4<8<<", "Count", "DELPHICLASS TRttiMethod; DELPHICLASS TRawVirtualClass", "B.rsrc", "PrevSystemTimes", "TExternalThread ``", "7,7;7C7Q7d7s7{7", "iso8859-10", "NameFld", "%&'()*+,", "PInterfaceTable", "oaEiC9>", "VariantInit", "Z]_^[", "OnCanObserve0@^", "1@5r5+6l6", "0i1{1", "LookupPrivilegeValueW", "&TEnumeratord", ".TEnumeratorL)[", "3Z3g3z3", "}l`aa", "EEncodingErrorx", ">TList.TEnumerator5", "TUE{{{", "0TList.TEnumeratorh", ":;:?:f:p:t:", "NTServicePack", " ", "TPropData", "&TList.arrayofT", "finalizer", "DefaultUserInfoOrg", "CTDictionary.TPairEnumerator;", "mkClassProcedure", "=$=@=P=e=s={=", "CallWindowProcW", "Specifies a list of tasks that should be initially selected.", "SetupLdrAndSetup.InstFunc", "4 5G5K5O5S5W5[5_5c5g5k5o5s5w5{5t6", "GetDeclaredProperties", "ListB", "'TMethodImplementation.TRuntimeTypeInfosL", "ftCurr", "TFinalizer@", "iso-ir-110", "111?1U1j1x1", "6-6C6T6e6m6~6", "FreeNotification", "6)63676X6h6l6p6x6", ")TCollectionNotifyEvent", "<,<0<4<<>", "> >D>H>V>d>", "DataInstance", "4x6|6", "ifHasGuid", "<8=?=;>B>", "=#>->P>`>h>p>x>|>", "5!6V6O7v7", "Locale", "", "7!7)71797k7", "8$8,8084888<8@8D8H8L8P8T8X8e8", "6J7_7m7", "ExceptAddr", "7,7A7T7u7", "939D9S9[9l9", "> >(>0>8>@>H>P>X>`>h>p>x>", "FValueData", "%TCollectionNotifyEvent", "3%3>3O3]3e3s3", "Invalid count (%d)", "./szy", "ChangesAssociations", "$TArray", "@sggg", "fsDenormal", "Operator", "FreeMem", ":8;h;", "mkOperatorOverload", "FWaiter", " TSetupPrivilegesRequiredOverride", "='=5=C=W=_=p=~=", "$TEnumerator(", "iso_8859-6:1987", "RequestedVarType", "EMonitorLockExceptionT", "Friday", "iso_8859-9:1989", "&IEnumerable", "=+=B=P=g=|=", "TCustomMemoryStream", "EFilerError", "1$2O2", "Windows 11", ":TListHelper.:4", "7$7?7G7U7c7s7{7", "5 525:5H5W5m5", "Uho-Z", "3$3,3@3K3S3q3", "4&4.4<4L4\\4n4y4", " type=\"win32\"/>", "iso_8859-16:2001", "Ph8P8i8q8", "EVariantInvalidOpError", "TReaderError", "InitObservers$ActRec", "5!@hW", "?>?e?", "$IEnumerable", "EInvalidPointer", "EUnderflow", "31484X4", "0C0J0N0T0X0^0i0o0s0", "3 3.3<3]3p3v3", "FMaxClassesInCache", "7>7I7P7`7h7p7x7|7", "/PASSWORD=password", "2+25292X2d2h2l2p2x2", "4\"4&4*4.42464:4>4B4F4J4", "646B6R6e6w6", "UhZ^a", "8 8(8,84888@8D8L8P8X8\\8d8h8w8", "808E8V8l8|8", "GetVolumeInformationW", "4&444B4V4l4", "TRttiNamedObject6", "WriteWideString", "SafeArrayPutElement", "FParams", "MTEnumerable>'", "Acquire", "K0O0v0", "S.UI$", "WriteChar", "}W#ANK", "cp866", "./335", "Smallint", ";';.;9;I;~;", "l~7fV", "<#\">0>B>S>[>i>x>", "FFlags", "8!8+838A8S8j8x8", "sr-Latn-CS", "^0C1c1", "QQQQ3", "UhxO`", ">b?q?", "FVirtCount", "7,7A7[7s7", "0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0l0t0|0", "GetReferenceToRawArrayElement", "Windows", "tpLowest", ";';D;|;", "7'7?7N7V7h7", "?/?3?T?X?s?w?", "0$020D0Y0e0m0~0", "Sunday", "FBuffer", "TList,", "YZ_^[", "mvProtected", "5&5?5P5t5x5", "FOnSetName", "WriteStr", ";(;;;X;f;v;", "kernel32.dll", "%TThreadList", "PResStringRech4W", "VInterface", ")TList.TEmptyFunc", "FParamType", "696@6", "LoadResource", "QSVWf", "TRttiInstanceMethodEx6", "ReservedStackSize", "FTypeInfos", "IsHFA8", "9-9;9J9\\9v9", ":\\:g:", "1%2E2L2t2", "EThread", "FComponentState", "1$121F1z1", "Write", "macturkish", "EObserverExceptiontE^", "?1?U?", "/Silent", "GetCharCount", "TRttiInt64Type", "MethodName", "415c5", "1TList.TEmptyFunc", "TRttiRecordField", "1.1C1Z1p1", "&!a5kYk", "FItemClass", "CreateThread", "7L7l7t7", "ReadBuffer", "6%616@6]6c6o6~6", "ACallConv", "[ExceptObject=nil]", "koi8-u", "FDesignInfo", "90X0h0u0", "_LIST_ENTRY", "EMathError", "EraCount", "fdOpenAlways", "System.Generics.Collections\\", "TFormatSettings", "DTDictionary.TValueCollection", "TArray", "1TCollectionNotifyEvent", "cmLZMA", "9'909j9r9}9", "iso_8859-10:1992", ":TDictionary&", ";.;B;S;q;", "0040[0e0i0", "VmtSize", "6L6\\6`6d6l6t6x6|6", "Observers", "9*9?9G9", "TCollectionEnumerator;", "WelcomeFontName", "ParamCount", "wrIOCompletion", "System|[^", "8ZZDKD", "-TDelegatedComparer8", "TCustomFileT@a", "CharLowerBuffW", "QQQQQQ3", ">0>8>F>U>e>w>", ";3;C;T;Z;j;y;", ";\\.ParrayofT _^", "&TEnumerator(", "pfAddress", "TBasicActionLinkXV^", "TFindComponentInstanceEvent", ":4:H:P:q:", "3$3,3034383<3@3D3H3L3P3T3X3f3x3", "wn>Jj", "]jIk7", "dSystem.SysConst", "csibm864", "?l-\\Y(", "2.2<2J2", "; ;$;(;,;0;4;B;T;i;z;", "858C8P8`8", "Collisions8", "2%232G2^2o2", "?b?s?", "2Y2^2f2", "ascii", "2)262C2O2V2`2h2s2", "&", "Windows Server 2003 R2", "5$51595J5Y5a5o5", "TProcedureSignature", "464:4X4h4p4x4", "Location", "windows-1256", "4+4a4", "989L9P9g9q9u9", "8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8n8v8", "FLockEvent", "cp949", "m/d/yy", "iso-8859-13", "TPropSetK", "GenuntelineI", "Empty", "TComponent6", "FoundIndex", "FInBufferNext", ";T&", "ASourceFile", "2$2,272@2q2|2", "0$080N0a0i0w0", "<#<+<3<;6Q6f6|6", "Parameter count mismatch&", ";vV", "Y\\\\duu", "Error", "GetParentComponent", "DialogFontBaseScaleHeight", "pqdddddddddddddddddddddddddddddddddr", "4U5~5", "U=%v\\;", "#TThreadList&", "SetDefaultDllDirectories", "FromSeconds", "000L0d0", "=,=P=T={=", "FWriterID", "ITDictionary.TPairEnumerator;", "uK|+#", "858G8O8]8o8", "8.82868:8>8B8F8", "TPropSet", "VTEnumerator>(", ":#:(:", "4`5i5", "Shared.SetupMessageIDs", "000>0W0]1", "AValue", "NumFileLocationEntries", "818e8s8", "PInterfaceEntry", "csFixups", ">+>B>m>", ":/:V:y:", "TUnitHashEntry", "FindType", "W)UkL", "Iww7]]]", "7\"747A7I7W7e7w7", "AOwner", "2(2I2", "AnsiChar", " TList", "1+1T1d1", "?5?H?V?i?x?", "ByRef ", "8E8L8", "VirtualIndex", "6/6[6", "6(60686@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "IsMoved", ":!:8:R:`:o:", "?2?:?H?`?", "TRttiParameter3", "FProcSig", "TRttiMethod", "Uhm>`", "OTDictionary.TValueCollection;", "ActiveClass", "FByRefParam", "FLookupRoot", "TListH5_", "8y9~?", "9 9'9.959<9C9J9Q9X9b9", "iso8859-14", "FAcquireInnerException", "3 313D3R3h3{3", "859A9P9", "March", "; ;(;0;4;8;<;@;D;H;L;P;T;X;\\;", "MTDictionary.TKeyCollection;", "l6799", "0?1a1", "<+++$", "jjjjjj", "StringBaseIndex", ">-?T?", "0T1v1", "NTVersion", "T*%Ys", "OwnsObjects", "Group1", "csSubComponent", "utf-8", "FCallerPopsStack", "232?2U2", "RegOpenKeyExW", "J%FGG1M", "RemoveQueuedEvents", ":.:A:Z:m:", "stcOSErrorInfo", "8\"818C8\\8m8{8", "iso_8859-2", "8!8.868E8K8W8f8n8}8", "GetNamePath", "ibm869", ":#:7:K:x:", "GetMethods", "IComparer", "FThreadID", "9T9X9\\9t9", " h(9a", ",i???O", "$TList.TEnumerator", "AClassName", "LanguageID", "; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\\;`;d;h;l;p;t;x;|;", "dupError", "TRttiContext", "TSpecialCryptContextType", "CodeInstance", "1$141G1Z1h1z1", "5TList.TEnumerator5", "~y#}y", "maciceland", "848@8D8H8L8P8T8\\8`8d8h8l8p8t8x8|8", "t?Htb", "Uh;J_", "TRttiMember", "Activate", "e&@gld", "$TEnumerator,", "TInstHashMapX", "898A8I8Q8Y8a8i8q8", "iso-8859-15", "fsNInf", "sr-Cyrl-BA", "DynArrElType", "TEnumerator", "Invalid NULL variant operation%Invalid variant operation (%s%.8x)", "PExtendedd", "FOnError", "AppModifyPath", "?\"?5?C?U?j?v?~?", "cp861", "5'6G6|6", "VarSub", "ldUILanguage", "Invalid argument to date encode", "iso-ir-138", "ResStringRec", "SafeDLLPath", "VTEnumerator>", "TEnumerator(", "2c2k2", "IntfParent", ":9:C:G:h:t:x:|:", "50575d5k5", "GetDeclaredMethods", "080g0", "<6=Q=`=w=", "FVirtualIndex", "SetValue", "AnsiString", "838:8M8", "9,:0:W:^:e:l:s:z:", "%TArray", "iso-8859-9", "elType", ";4<=<", "SpinCount", ">H>[>k>", "9@:U:c:{:", "TEnumerator(", "VUnicodeString", "<'<>", "088H2", "*TMethodImplementation.TFirstStageIntercept", ")TList.TEnumerator", "ReadComponent", ":(:,:0:8:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:", "AAAAA", "Too many open files", "GetExitCodeProcess", ">!>C>P>a>", "uz-Cyrl-UZ", "VType", "csInline", "WTArray>", "FPackageVer", "Unexpected variant error", "System.Classes", "&TArray", "nb-NO,nb,no", "FromMinutes", "Uh0(`", "TComponentClass", "0'0K0Q0`0o0u0", ".ParrayofT", "iso-2022-cn", "HasName", "5'5/5@5H5T5\\5b5h5r5~5", "EIntfCastError", "2&2H2U2f2", "iso_8859-5", "FContextToken", "=I>[>o>", "= =$=(=,=0=4=8=<=J=\\=z=", ">#>Q>y>", "='=/=7=?=G=O=W=_=g=o=w=", "9TDictionary.TItem", "4+5J5S5f5|5", "6!6%6D6T6X6\\6d6l6p6t6x6|6", "1TCollectionNotifyEvent", "?$?H?X?`?h?p?t?x?|?", "9 9$9(9,9094989<9@9D9H9L9P9^9p9", "tpIdle", "6#616A6T6o6}6", "ccStdCall", "/TEnumerable$u[", "= =(=0=8=@=H=P=X=`=h=p=x=", "2V2\\2w2", "0#040I0W0j0v0~0", "ForceQueue", "8%868@8H8V8h8", "090X0", "'TList.ParrayofT", "HPPGENAttribute5", "vaFalse", "Capabilities", "9 9$9B9d9x9", "Offset", "FInstanceRoot", "%LazyLoadAttributes.MakeClosure$ActRecXF\\", ">+>M>a>", "FFree", "FTypeInfo", ":$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "gYY_g`", "Uh&w]", "7 7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "UTF8Length", "GetArrayLength", "EAccessViolation|", ">L?R?o?", "0 0$0(0,0004080<0@0d0", "OrdType", "&TEnumerable", "Fdsx1", "tpNormal", "=!>%>L>S>Z>a>h>o>v>}>", "GetUserDefaultUILanguage", "DynUnitNameFld", "aTEnumerator>", "HC{z-U", "&TComparison", "FAsSByte", "&TCollectionNotifyEvent", "6>6t6z7", "TWriter'", "5'565L5^5f5t5", "8.8h8x8|8", "FHeaderProcessed", "xPBKDF2", "FSVWU", "TModuleInfo", "VObject", "@1T4m4", "NormalizedLocaleName", "Property '%s' is write-only=RTTI objects cannot be manually destroyed by application code\"%s (Version %d.%d, Build %d, %5:s):%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)", "#TArray", "9s:|:", "<.&", "?2?:?K?Y?a?o?|?", "0.060G0U0]0k0x0", "^/}}}", "AComparer", "tis620-0", "#TEnumerable", "=(=,=L=X=\\=`=d=l=t=x=|=", "3?3G3g3p3", ":0;9;r;", "Comments", "CurrentMinorVersionNumber", "ComparerT", "koi8-r", "0#0F0N0V0^0f0n0v0~0", ":-:;:C:Q:`:", "VarCyFromStr", "InfoAfterText", "5,5A5^5f5n5v5~5", "FGroupClasses", "> ???h?", "TStrongRandom: Failed to load bcrypt.dll", "InitialState", ">,>;>N>h>v>", "windows-874", "384H>", "< ", "9&9r9", "5TDictionary.TItemArray", "0TList.TEnumerator5", "8$8,84888<8@8D8H8L8P8T8X8\\8`8d8h8p8", "4-474;4`4p4x4", ">2>^>t>", "PropList", "0S1u1", "&op_Equality", "ASpinCount", "VarOr", "FieldOffset", "EArgumentException", "*TEnumerator(", "EInvalidCast(", "7/7>7F7T7c7v7", "41454\\4f4", "2TList&", "EN]XA)", "VirtualAlloc", "'TMethodImplementation.TRuntimeTypeInfos&", "DTDictionary.TValueEnumerator;", "VChar", "Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread", "CreateProcessW", "667M7", "2(2>2F2m2{2", "SetTypeOrSize", "7'7l7p7t7", "iso-ir-144", "2 272P2g2", "GrowThreshold", "ITDictionary.TKeyEnumerator;", "191W1b1", "#TEnumerable'", "cyrillic", "2 2$2(2,2024282<2@2D2H2L2P2T2X2\\2`2d2h2l2p2t2x2", "vaNil", "ClearAndResetID", "CTDictionary.TPairEnumerator", ";7|8U", "TList&", "csibm855", "StaticSynchronize", "7a869E9", "CallingConvention", "9\"9*9A9", ";);1;?;L;|;", "CheckValue", "FMemory", "FReadMethod", "8TPair", "0123456789ABCDEF", "ACompare", "8V8n8w8", "RecursionCount", "!TList.arrayofT", "$TEnumerator", "&op_Subtraction", "<)", "edddS", "CryptKey", "MinVersion", "FCryptContext", "1'1+1L1\\1d1l1t1x1|1", "csTransient", "FRttiDataSize", "fsWrite", "TTypeInfo", "&TEnumerable'", "5$535F5\\5k5s5", "TClassFinderT", "TCustomFile=", "List index out of bounds (%d)", "TSetupLanguageEntry3", ".42N2h2", "OnValueNotify", "BTDictionary.TKeyEnumeratorp", "GetComponent", "> ?K?S?s?|?", "TApplication", "?!?)?1?9?A?I?Q?Y?a?i?q?y?", "1Z2,3D3", "GetCPUUsage", "CurrencyDecimals", "2\"2&2*2.22262:2>2B2F2J2N2R2V2Z2^2b2f2j2n2r2v2", "ENotImplemented", ">#>+>9>H>", "8*898A8O8b8q8y8", "FUseBOM", "!TSetupPrivilegesRequiredOverrides", "TEnumerable", "9,9;9", ":TLZMAInternalDecoderState.:1", "AfterConstruction", ":4;`;", "The unexpected small block leaks are:", "*TEnumerable'", "3E3V3e3o3", "2'3=3N3b3j3{3", "TMultiWaitEventImpl", "FInstItems", "greek", "FFatalException", "3 35393P3^3d3", ":q:v:", "2 2$2(2,2024282<2@2D2`2t2x2", "ResultType", "Unknown", "4'4/4@4u4y4", "6#606A6Y6g6}6", "OnError", "X-21_", "R\\gma", "BTDictionary.TKeyEnumerator;", "TCustomVariantType&", "ResInstance", "class ", "ThrowOuterException", "0K1m1", "*TDictionary", "=&=<=N=`=n=", "GetUserDefaultLangID", "8@9I9", "GetProcessHeap", "volatile bool FTerminated", "8P9b9", "FVCLComObject", "0 0.0?0T0f0n0", "Instance", "GetDeclaredFields", "HandlesTarget", "8$8+82898@8G8^8b8f8", "Uhz&Y", " $(,048<@DHLLPPTTXX\\\\``ddhhllppttttxxxx||||", "AllocateAndInitializeSid", "ASelf", "ExtractRawData", "9 9$9(9,949k9z9", "8TEnumerable'", "TArrayPropInfo", "AppId", ":!;);4;<;L;T;\\;d;h;l;p;t;x;|;", "CodePage", "Shared.VerInfoFunc", "8TEnumerator(", "RegQueryValueExW", "fsPositive", "5lho;", "FOnReferenceName", "4$494G4Z4o4}4", "q=,@H", "AsClass", "VarAnd", "FFreeInstItems", "4A4`4w4", "IDATx", "az-Cyrl-AZ", "TClassd", "Uh\\0a", "?(?0?>?P?^?f?t?", "5 5<5", "pGWj+1+", "2J2t2", "TFilerG", "585F5\\5n5", "VWideChar", "mkClassFunction", "> >D>d>", "6$6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6v6~6", "FRevisionLevel", "TryAsOrdinal", "8>9#:C:x:", "2%2B2T2e2{2", "EFileError", "Validated", "575h5", "PMonitorT$W", "ERangeError", "VVariant", "FReturnTypeInfo", "FAsULong", "KTDictionary.TValueCollection", "<;=B=", "Bww7/", "", "BCryptGenRandom", "tttT7", "T$4#D$8#T$<3", "?/?5???I?N?j?", "/SuppressMsgBoxes", "2$272P2e2l2", "2+2:2B2P2\\2l2p2", "J%Z[[", "otSByte", "4B4Q4", "<$<4<<.TValueCollectionx", ":%;);K;O;t;", ":,:A:O:c:y:", " ", "Instructs Setup to attempt closing applications using files that need to be updated, or prevents it from doing so.", "iso_8859-10", "Version", "WriteDouble", "ibm775", "3TArray", "GetDeclaredIndexedProperties", "WriteString", "2%2,2C2G2K2f2n2", "8.9F9O9", "?'?1?V?^?", "GetParameters", "TRttiIndexedProperty6", "VByte", "2G3c3q3'4.4", "!TList.TEnumerator5", "919Q9t9", "5'5A5`5z5", "IsSingleByte", "65696d6", "7.7]7g7", "9&989N9_9r9", "FStarted", "3/33373;3?3C3G3T3", "080D0H0L0P0X0`0d0h0l0p0t0x0|0", "GetTempPath2W", "7=7S7r7z7", "7 7(7,74787@7D7L7P7X7\\7d7h7t7x7", "", "6I6f6j6n6r6v6", "TRttiInstancePropertyClassic4h\\", "6$636D6O6W6h6{6", "6%6:6Z6}6", "?:?I?U?{?", "ASetDefault", "Control-C hit", "SizelCa", "cmLZMA2", "/CLOSEAPPLICATIONS, /NOCLOSEAPPLICATIONS", "WizardSizePercentY", "TSetupPrivilegesRequired", "181E1[1k1", "RetAddr", "lzma1smalldecompressor: %s", "cp1253", "SetupLdrAndSetup.Messages", ";!;%;?;F;M;T;[;e;i;m;", "AReadProc", "GetArrayElement", ";';?;N;V;h;", "AChildPos", "VSingle", "TEnumerable'", "3,303P3`3h3p3x3|3", "WaitForSingleObject", ">*>9>A>O>a>o>w>", "3(343E3M3S3^3l3|3", "WordBool", "RegSingle", ":\":*:@:U:c:s:", "FOffset", "ProductVersion", ";A;_;j;", "8+8;8O8W8e8w8", "5,5<5N5V5d5q5", "EndUpdate", ":.:::B:S:a:w:", "TAttrData", "UninstallDisplayIcon", "TIntfFlagsBase", "TPropSet", "macukraine", "Specifies a custom exit code that Setup is to return when the system needs to be restarted.", "afPremultiplied", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", " >(>0>4>8><>@>D>H>L>P>T>X>\\>`>d>l>", "TObservers.TObserverAddedEvent", "tzm-Latn-DZ", "1>6Fss3", "5*54585X5h5l5p5x5", ";#;-;7;?;E;S;n;", "4\"4C4J4Q4X4_4f4m4t4{4", "AFunc", "9pGt'+", "TReader'", "TlyUU)", "CreateWindowExW", "iso-8859-14", "VarBoolFromStr", "UnregisterClass", "iso_8859-8", "GetReturnType", "%TEnumerable'", "Mantissa", "vaInt32", ">w`5>w0", "2)272?2M2_2q2y2", "FixupResourceHeader", "macgreek", "vaExtended", "3#3>3B3^3", "tg-Cyrl-TJ", "2>3c3", "\\TEnumerator>(", ";.;F;T;b;u;", "tkInteger", "4'5P5", ";_", "TObject&", "6,6>6T6e6x6", "8?9|9", ";.;I;W;f;w;", "6-666o6", "#TEnumerable", "%IEnumerable", "? ?$?(?,?0?4?8?(", "HFAElementCount", ":4;C;J;", "p8BS$DWw", "ComponentState", "8@TList`1.Pack[1]$ActRec", ",TList.TEnumerator", "859J9X9j9y9", "2+2h2", "3+3:3J3\\3v3", ">)>1>@>H>]>e>{>", "UnderlyingType", "TStreamProc", ". %s is empty+Out of memory while expanding memory stream)%s has not been registered as a COM class", "TRttiInstanceFieldEx", "DefaultDirName", "0-0A0T0c0u0", "TMemoryStream'", "5 5.5>5P5g5u5", "NumRunEntries", "EInsufficientRttiP", "546D6H6L6T6\\6`6d6h6l6p6t6x6|6", "LockList", "cp932", "TIntfMethodTable", "ffInherited", "CloseApplicationsFilter", "1 111G1X1g1o1", "UUimm", "System.SysUtilsL", "MinValue", "8 8$8(858H8c8k8s8{8", " ", "VolatileAttribute", "mn-Mong-CN", "Uh[Y\\", "3.32363:3>3B3F3", "Stack overflow", "GetMaxByteCount", "LoadLibraryW", " ", "8 8@8P8X8`8h8l8p8t8x8|8", "<%<9#>1>@>[>_>v>", "3*3;3O3W3h3v3~3", "jkdlmn", "OnFindMethodx", "TSynchroObject'", "TPrivateHeap4q[", "3-3d3", "OnSetName", "FCodePage", "&op_Addition", "dnnn=#", "Windows Server 2016", "AsUInt64", "%fgg-", "?#?+?3?;?C?K?S?[?c?k?s?{?", "4.4?4M4U4c4x4", "$ZXs?", "TPackageTypeInfo", "ha-Latn-NG", "csWriting", "TRttiMethod'", "t-Rf;", "fdOpenExisting", "TFiler", ">k?r?", "8'858H8_8m8", "Qh(wY", "TList", "GetAttribute", "S(_^[", "ibm866", "sr-Cyrl-ME", "TArray", "D:PAI", "3/3=3M3_3v3", "1+131A1Q1`1w1", "2$2,242<2D2L2T2\\2d2l2t2|2", "vaList", "CreateAnonymousThread", "YYYq\\", "I[|;Bld", ".DEFAULT\\Control Panel\\International", "N>_`~~", "iso_8859-15", "tpHighest", "TRttiClassRefType", "SetWindowLongW", "%TEnumerator(", "CreatorBackTraceIndex", ".Owner", "iso8859-4", "1%2Q2f2", "$TEnumerable'", "WriteResourceHeader", "RemoveObserver", "Uninstall Tool ", "WriteUTF8Str", "SetThreadLocale", "SetSearchPathMode", "TCompressedBlockReader", "RegEAX", "TFilerFlags", "525`5z5", "GetNativeSystemInfo", "EAbort", "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<", "8Compression.Base", "Release", "%&'()*+,-. ", "ComparerL", ":%;4;<;L;", "hddddddddddddddddddddddddddidddddd", "CreateReturn", "0TList.ParrayofT", "UnitHashArray", "2\"2*222r2", "WizardImageAlphaFormat", "8TEnumerable<<[", "PathFunc", "<2<:.arrayofT", "=wp3>w", "dpAuto", "?1?A?I?W?j?z?", "3$3,3:3E3X3k3z3", "", "GroupedWith", "4'4A4I4Q4Y4a4i4q4y4", ":$:,:4:<:D:L:T:\\:d:l:t:|:", "Class %s not found%List does not allow duplicates ($0%x)#A component named %s already exists$''%s'' is not a valid component name", "FOrphanPackage", "1X2\\2b2f2p2", "TArray", "Handle,s[", ";!;B;X;i;x;", "9;:?:C:G:K:O:S:W:[:_:c:g:k:o:s:w:{:", "TLZMA1SmallDecompressor", "TMultiWaitEvent.TWaitInfo", "AddInstItem", "6 7)7", "):TMethodImplementation.TInterceptFrame.:1", "ClassRefAttrData", "8)8/8>8Q8W8f8y8", "1/1I1c1", "FOwner", "FindClose", " name=\"JR.Inno.Setup\"", "6)6-6T6d6l6t6|6", "t!Ht:", "cp855", "FloatType", " CrystalIDEA Software ", "AUserData", "? ?4?F?_?v?", "8IEnumerable", "CloseHandle", "YZ]_^[", "6+656P6", "DispatchMessageW", "ToShortUTF8String", "PPropInfoEx", "2 2$2(2,2@2D2H2L2X2\\2h2l2p2t2x2|2", "(TRttiPool.GetPackageList.DoUpdate$ActRec", "TArray", "Dg!K&", "BFGGY]]", "9 9$9(9,9094989<9@9D9H9P9X9~9", "EPrivilege,", "Embarcadero Delphi for Win32 compiler version 36.0 (29.0.55362.2017)", "%TEnumerator(", "6 6(6", "4%4<4O4W4e4s4", "0;1J1l1", "061=1p1", "TThreadInfo", "10181F1T1l1p1", "FReturnType", "7l7p7", "*IComparer", "EventCount", "Z#3]k", "2^2s2", "\"PrivilegesRequiredOverridesAllowed", "advapi32.dll", "OnTerminate", "TFloatSpecial", "t=HtN", "5#5+535;5C5K5S5[5c5k5s5{5", "function ", "FUpdateCount", "AdjustTokenPrivileges", "DimensionCount", "VClass", "ReadComponentRes", "Uh/Q]", "<(<8.TEnumerator", "494O4r4", "\"Variant method calls not supported", "Waiting", "crLessThan", "Uh#r\\", "UhXh]", "Started", "5D6m6", "zh-CN,zh-Hans,zh", "windows-1251", "8+838D8S8[8i8{8", "nnnAvvv", "akhrrr", "Parse", "VUnknown", "3/4S4m4", "Overrides the default component settings.", "Write64", " = procedure", ":>:b:", "=<=J=`=n=", "IsEmpty", "iso_8859-8:1988", "TPropSet", ":,:4:<:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "EComponentError", "HasInfo", ">,>>>F>T>c>y>", "4)4>4W4_4g4o4w4", "iso-2022-kr", ">w@3>w0", "CheckTerminated", "", "GetProc", "RttiCount", ".TArray", "AIntToIdent", "3)3-3L3X3\\3`3d3l3t3x3|3", "PropCount", "TArray", ";,;C;R;i;x;", "DeclaringUnitName", "2>w 2>w`", "GetLocaleInfoW", "@[utc", "TRttiInvokableTypex", "$TList&", "'TCollectionNotifyEvent", "cp437", "111C1Z1l1q1", "< <$<(<,<0<4<8<<<@@>t>", "Uh%!\\", "iso_8859-11", "Index1", "", "PAttrData", "9'9=9R9`9w9", "232H2V2h2", "EInOutError", "+++C\"", "4 4(40484<4@4D4H4L4P4T4X4\\4`4d4h4l4t4", "7$8H8y8", "TIntfMethodEntry", "TList", "AllowFree", "&TCollectionNotifyEvent", "4D4K4~4", "GetImplementedInterfaces", "1!101U1\\1}1", "SetLastError", "cp864", "4&4.4?4N4V4d4v4", "InitializeConditionVariable", "5$5,5_5u5", ">wp1>w`", "Shared.FileClass", "GetInterfaceTable", "1)1`1p1t1x1", "tkInt64", "System.RTLConsts", "UhjyW", "WriteDescendentRes", "FIgnoreChildren", "=5===Q=X=u=}=", "9,959n9", "&TList", "OUnsignedFunc", "5$565:5Q5X5b5f5", "1)171I1^1j1r1", "CompareOp", "?%?/?W?}?", "VerifyVersionInfoW", "XINFNAN", "TRttiObject'", "cp950", "$Z]_^[", "TypeInfos", "System.SysUtils", "FAliasList", "csibm866", "=9=U=\\=k=z=", "iso_8859-4:1988", "LanguageDetectionMethod", "TCustomDecompressor9", "EndOfList", "SizeofResource", "QQQQQQQ", "TComponentStateItem", "WriteComponentRes", "; ;$;(;,;0;4;8;P;`;d;", ":!?%?)?-?1?5?9?=?A?E?I?M?Q?U?Y?]?a?e?i?", "FMeths", "AProcedure", "fsNone", "ADecompressorClass", "EInvalidOpException", "OTDictionary.TValueCollection", "Indirect", "EHashException", "TMultiWaitEvent.TWaiterFlag", "Instructs Setup to attempt restarting applications, or prevents it from doing so.", "InnoSetupLdrWindow", "8'8/878?8G8O8W8_8g8o8w8", "GetSystemDefaultUILanguage", "UseQualifiedNames", ">$>(>/>B>V>k>", "FFinder", "OnKeyNotifyps_", "^)wU[", "FMaxCharSize", "7\"7&7*7.72767:7>7B7F7d7h7l7p7t7x7|7", "@GetPackageInfoTable", "PList,", "> >$>", "FromVarRec", "r!t3Hta", "RegExtended", "Uh ~\\", ";(;8;K;];e;s;", "TRttiInstanceProperty3", "628`8", ">)>:>P>a>u>", "string", "0$060A0H0O0Y0a0y0", "1*2]2d2{2", "TComponentEnumerator:", "EVariantErrorH", "Values<", "_Default", "5\"5I5R5", "OnReferenceNameL", "6'6/676?6G6O6W6_6g6o6w6", "aZ[[)", "FWriteMethod", "CharUpperW", ">3>W>", "GetParams", "?4?E?X?i?|?", ">/>?>G>U>h>x>", "Active,", "CopyFrom", "fsNaN", "StackInfo", "=D>Z>d>", "TMultiWaitEvent.TMultiWaiter&", "FTotalMethodCount", "VarXor", "2;2j2", "FOnFindComponentClass", "0F0a0", "fsInf", "windows-1253", "0B0F0p0", "&TArray", ",//[Qyn", "Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread", "414B4W4e4{4", "QQQQS3", ">*>:>M>_>g>u>", "GetFields", "8*8?8M8d8y8", "%&'()*+", "destructor ", "0 0$0(0,0004080E0W0k0s0{0", "FromTicks", "IsDestructor", "Invalid argument", ":-:F:[:p:", "TEnumerable'", "7 7$7(767>7P7b7t7", ":6:\\:", "AppMutex", "Unexpected Memory Leak", "FiredEvent", "wrTimeout", "$YZ_^[", ":5:O:W:_:x:", ":,;E;d;", "Uh8Q\\", ":(:>:O:_:g:x:", " version=\"1.0.0.0\"", "b?????", "GD_^[", "Reserved1", "NumIconEntries", "8 8(80888@8H8P8d8y8", "KeysD", "CurrentL=^", "AList", "526L6g6", "4*484O4d4r4", "6<7K7", "=*=8=J=]=r=", "TProc", "I/O error %d", "Ordinal", "TGetStreamProc", "ACallback", "6TCollectionNotifyEvent", "5/7W7^7v7", ":':.:F:M:w:", "=wp]?w", "windows-1257", "IsSet", "6!6'626E6K6X6n6t6", "System.Generics.CollectionsT", "+TList.TEmptyFunc", "{?U}wOw", "Uh#.`", "8 8$8(8,80888q8", "Destroy", "1 161M1j1r1z1", "1 1.1=1P1c1q1", "WeakAttribute", "Unused1", "RevisionLevel", "AppContact", "6 6L6P6w6", "ibm852", ">5?J?X?p?", ":$:C:G:O;_;+<7<>6???H?z?", "=0=F=j=n=r=v=z=~=", "Minutes", "mkDestructor", "hij@klmn-opqArstu", "tGf;J", "!TArray", "TRttiIntfMethod6", "PListL2\\", "ReadCollection", "TEnumerable", "TVarCompareResult", "IComparer", "TPropSetV", "6$6(6,6064686<6@6D6H6L6P6T6X6e6{6", "3!3%3D3T3\\3d3l3p3t3x3|3", "4,5M5i5x5", ":%:@:N:`:z:", ":TInstHashMap.:1<", "TClassFinder", ":\";W;", "PVmtMethodEntry", "=2=I=", "ccPascal", "UhiK\\", "ACreateDisposition", "tXf;J", ":9;U;", "9.9A9G9V9i9o9~9", "DefaultUserInfoSerial", "=*=5=", ":$:6:<:P:h:", "D$hPW", "CreateImplementation", "6(7,70747B7P7f7x7", "tww?x", "TVarArrayBound", "cp874", "Uh<}`", "TInterfaceListEnumerator<", "3$3T3X3", "/TCollectionNotifyEvent", "big-5", "0'0=0", ":%;q;", "TPropSettFZ", ":E;r;", "PLibModule", "8#8+838;8C8K8S8[8c8k8s8{8", "System0", "TEnumerable", "aTEnumerable><", "< <(<0<4<8<<<@", "TArray", "=w@\\?wp", "TListAssignOp", "TArray", "4 4$4(404M4[4c4q4", "5F5[5l5", "1D1o1", "WriteWideChar", "TValueDataImpl8", "Winapi.ActiveX", "iso-8859-6", "AInstance", "FInstanceMethod", "1*171b1", "ReadIdent", " ]_^[", "EInOutErrorA", "8L9.:h:w:", "TRttiPropertyE", "TArray", "UhHPZ", "System.Generics.Collectionsd", "?-?=?P?c?q?", "FSynchronizeException", "ProcSig", "9\":P:g:", "RegComp", "FInitLock", "7'7/777?7G7O7W7_7g7o7w7", "cp858", "PByte", "<$<,<4<8<<<@", "8$848F8c8q8", "ByteOffset", "ContentionCount", "TStream", "TSetupEncryptionKey ", "2.2C2T2i2w2", "HPPGENAttribute", "1&181M1g1", "TCollectionEnumerator", "=P>n>", "sma-SE,sma,se", "5*5>5O5^5f5w5", "Uh{f\\", "=r>y>", "0\"040S0a0x0", "5/5B5P5d5q5y5", "%4w?u", "%TEnumerator`._", "6s6w6{6", "TLZMAInternalDecoderStateP", " of object", "TCustomAttributeClass", "Milliseconds", "TSetupEncryptionNonce", "OnFindAncestor4", ">7>E>T>k>", "Options", "Causes Setup to create a log file in the user's TEMP directory.", "TArray", "TRttiInstanceType", "IsReadable", "stcPreallocateOptimization", "EStreamError", "IEnumerable", "csDesigning", "PList`y^", "maccentraleurope", "2D3p3", "EInsufficientRtti,", "IsInstanceOf", "WizardDarkStyle", "CastTo", "#IComparer", "EPrivilege", "Uh@<]", "Prevents Setup from restarting the system following a successful installation, or after a Preparing to Install failure that requests a restart.", ";\";&;@;P;X;`;h;l;p;t;x;|;", "Inno Setup", "0TDictionary.TItem", "Windows XP", "iso_8859-3", "<#<1<^?>J>", "/SL5=\"$%x,%d,%d,", "TEnumerator(", "LOO355E", "BaseFilename", "0TCollectionNotifyEvent", "MsgWaitForMultipleObjects", "GetSystemWindowsDirectoryW", "iso-ir-203", "929I9W9n9", "FPageSize", "BinarySearch", "969@9y9", "6\"666T6", "&TEnumerable'", "@w+AUUUUUU", "November", ";.;<;D;U;b;j;|;", "213F3W3l3z3", "GetExitCodeThread", ";0.TEnumerator5", "September", "VarDiv", "1#2L2w2", "3>3O3]3s3", "5.686<6D6H6P6T6\\6`6h6l6t6x6", ":mm:ss", "4E4d4u4", "Uhc1a", "7#767\\7j7|7", "dsb-DE,dsb,hsb", "TUTF7Encoding", "SetReturnValue", "Like the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been selected by default.", ":,:<:@:D:L:T:X:\\:`:d:h:l:p:t:x:|:", "TList&", "opaque_DictionaryPos", "ShortDateFormat", "<0<@.ParrayofT", ":9;O;`;t;|;", "", "EndRead", "Q8FKu", "RegisterWeakRef", "TCollectionItem:", "727@7P7b7{7", "TObject", "4)4;4K4S4a4t4", "PLIST_ENTRY", " TList.TEnumerator5", "_Construct", "PIntfMethodTable", "W!IY#", "A0p0}0", "ExitProcess", "%TEnumerable'", "VarMul", "Uh4~]", "TAsyncProcedureEvent", "TVmtFieldClassTab", "7.7<7N7h7v7", "FGrowThreshold", "3<3L3P3T3\\3d3h3l3p3t3x3|3", "Duplicates not allowed", ">Dkk+}}}", " TArray", "GetTokenInformation", "7PathFunc", "BTDictionary.TKeyCollection;", "IsClassMethod", "FListObj", "5!5)5y5", "AName", "VWUUh", ";:;>;_;c;~;", "0 0.0=0N0Y0a0o0}0", "5)595L5c5q5", "FGlobalContextCounter", "B!}pp", "WriteProperties", ".TCollectionNotifyEvent", "UnitNames", "AStartIndex", "FIsSingleByte", "fsReadWrite", "cp853", "2,3U3", "=%=K=k=", "MethodAddress", ":2:A:S:l:}:", "EnumCalendarInfoW", "TRttiInstanceFieldEx6", "2S3u3", "CreateDuplicate", "=\"=4=F=X=h=", "CreateUninstallRegKey", "windows-1258", "vaDouble", "TRttiManagedField8", "6.6<6O6e6v6", "E7`p[", "TGetDeltaStreamsEvent", "Uhe\"`", "707D7U7b7j7{7", "5 5$5(5,50545P5f5j5", "ResolveReference", "D7q/;M", "GetCurrent", ",TEnumerable", "CreateHelp", "Uhr'`", "AVarType", "0!0*0[0c0", ": :C:Q:Y:g:x:", "969I9T9i9t9", "TCollectionItem", "VTEnumerable>'", "6Q6~6", "=i7I!", "TRttiNamedObject", "iso-8859-4", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", "FAsSInt64", "TMethodKind", "=$=7=L=d=r=", "Uh\":Y", "9*9;9]9j9{9", "const ", ">TDictionary.TItemArray", "WriteSingle", "/TList.arrayofT", "Uh8oW", ":,:C:V:g:z:", "qps-ploc,en", "313F3h3v3", "UseBOM", "TResStringRec", "DefineOpenArray", "Uh7N_", "FComponentStyle", "NumComponentEntries", "'?IWw%", ">!>8>M>[>n>", "474?4M4[4", "ClassNameIs", "TRttiSetType", "TRttiClassRefTypeX", "FInBytesLeft", "4\"444`4d4", "RegEDX", "EConvertError", "*TList.TEnumeratorP", "-TPair", "#D$`#T$d3", "122o3", "Array ", "VCurrency", "+TEnumerator(", "FWaitRecycle", "RtlUnwind", "ECompressDataError", ";-;D;o;~;", "SkipValue", "3H3P3", "8!S3S,/.", "constructor ", "VBytes", "FCount", "1*101Y1", ";+<4<%=|=", "SeekToEnd", ";!;3;I;W;f;x;", "DefineProperty", "686H6P6X6`6d6h6l6p6t6x6|6", "; ;$;(;,;0;4;8;<;@;D;R;Z;l;~;", "csibm857", "/NOCANCEL", "FAsSWord", "FOpenArray", "DialogFontSize", "SetItem", "Parent, [", "EraInfo", "System.Generics.Collections", "6B7r7", "1!191A1I1Q1Y1a1i1q1y1", "GetProcAddress", "PropertyType", "TVmtMethodEntryTail", "9?9_9h9", "TPersistent'", "SwitchToThread", "skShortString", "csisolatinhebrew", "GetDimension", "OnUpdate", "ks_c_5601-1987", "Assertion failed", " TListX", "$TMultiReadExclusiveWriteSynchronizer&", "ReadFile", "FileVersion", "7 717C7K7Y7f7x7", "iso-8859-1", "ir]sfY", "TTypeKind", "MoveNext", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:|:", "ReadWideChar", "Shared.EncryptionFunc", "6 6H6^6o6", "FCanHandleExcepts", "BaseAddress", "EndFunctionInvoke", "3!3/3=3Q3g3z3", "LzmaDecode failed (%d)", "909l9{9", "&op_Implicit", "0 0$0(0,0004080<0I0`0u0}0", "ITDictionary.TPairEnumerator8", "'TArray", "Uhds]", "2,2<2D2L2T2X2\\2`2d2h2l2p2t2x2|2", "=>?X?", "TValueDataImplZ", ":*:B:P:`:x:", "4 4$4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4", "TRealPackage'", "wQ\\/s", "cPZXn", "System(#[", "TList&", "/TEnumerable'", "0#0+030;0C0K0S0[0c0k0s0{0", "0)0;0U0c0r0", "AFlag", "TThreadMethod", "DTDictionary.TValueCollection;", "AFrame", "_^[Y]", "0$0,040<0@0D0H0L0P0T0X0\\0`0d0h0l0p0", "Exception in safecall method", "GetBufferEncoding", "FPropInfo", "?,?4?", "<,`", "<0<4.TValueEnumerator;", "6\"6&6*6.62666:6>6B6F6", "Current", "TRttiAnsiStringType", ";);7;E;`;h;v;", "7(707>7L7c7v7~7", "?(?=?E?", "dkDynamic", "LoadStringW", "$IComparer", "Uh4*`", "TRealPackage", "ddddddddd", "505J5X5h5{5", "Floating point underflow", ">,>H>L>l>|>", "ASelfTypeHandle", ":M:Z:i:|:", ">1>9>G>V>l>z>", "TRttiInt64Type(", "&TArray", "TPrivateHeap.THeapItem", "GetThreadPreferredUILanguages", "System.VariantsH}Y", "StartIndex", "CreateFileW", "GetVersion", "EStreamErrorl", "7\"7&7*7.72767:7>7B7F7J7N7R7V7Z7^7b7", "FixupReferences", "0#040G0X0k0y0", "t@G;}", "TPersistent", "243`3", "2>2s2", "UnlockList", "/SILENT, /VERYSILENT", ";TList.arrayofT", "FMessage", "TThreadProcedure", "Iterations", ".TItem", "><>G>", "maccyrillic", "GetByteCount", "= =1=E=V=c=k=|=", "LOOS/", "ByteCount", "Overrides the default folder name.", "TPropSet", "Suspend", "VariantChangeType", ";3;P;", "GetClass", "1#161L1]1", "IsArray", "1200 (Unicode)", "%TMethodImplementation.TInterceptFrame(", "IsClass", "ToArray", "OleVariant", ";4;K;Y;p;", "GetStartupInfoW", "$TComparer", "1Y1|1", "TNoRefCountObject", "1,1=1P1^1t1", "TVarArray", "0(0,0L0\\0d0l0t0x0|0", "TRttiInstancePropertyEx", "8 8(8084888<8@8D8H8L8P8T8X8\\8`8d8q8", "Unused2", "IndexOfItem", "GetEncoding", "RemainingRandom", "Read beyond end of file", "ParamType", "DTObjectDictionaryM", "AMethod", ";TCollectionNotifyEvent", "525h5", "Y,//c}}", ";d#>4>H>P>a>o>w>", "Must wait on at least one eventECannot call BeginInvoke on a TComponent in the process of destruction", "Insert", "JTDictionary.TPairEnumerator;", " TList", "J%ZZZhmmEUU4M[", "1 2'2i3", "File access denied", ":TSetupHeader.:3", "Uh]#`", "=!=0=B=P=b=j=x=", "5 5$5(5,5054585<5@5D5H5L5P5T5b5j5|5", "$TEnumerableD_[", "uz-Latn-UZ", "tis620.2533-0", "tis620", "mkSafeProcedure", "<%<<'", "List T_", "IdentToInt", "1%131A1S1f1z1", "KeysH", "11151O1Y1]1|1", "IInterfaceListExd", "?$?:?O?h?w?{?", "o0J|t+", "WriteFloat", "tis620.2529-1", "J%fgg", "TList", "ToByteArray", "8.8G8c8", "FSVWQ", "OleAutoVarType", "FTagCounter", "cp860", ";*;;;C;Q;d;};", "2#222:2H2Z2h2p2~2", "&TEnumerator", "AddOrSetValue", "Target", "TUTF8Encoding&", "cseuctw", "For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline", "GetThreadLocale", "Listde`", "-TPair", "FParameters", "ShortMonthNames", "TryAdd", ":2;Q;w;", "Instructs Setup to be silent or very silent.", "SmallInt", "VLongs", "+TList.TEnumerator5", "5<5H5L5P5T5\\5d5h5l5p5t5x5|5", " bytes: ", "TArray", "TReadComponentsProc", "9,9:9F9T9d9h9l9t9|9", "8+888", "4&424@4[4c4q4}4", "FRecursionCount", "5K5w5", "HelpContext", "030<0f0", ":TFormatSettings.:20", "232Q2d2u2y2", "475N5p5w5I6m6", "laAnd", "TResStringHashItem", "ExecuteAction", "vqbi3", "HTDictionary.TKeyEnumerator", "WriteListBegin", "1 1$1(1,1014181<1I1_1u1}1", "FRoot", ")TList.ParrayofT", ":$;R;b;1.TEnumerator", "TTypeTable", "0#050Y0h0z0", "='>H>T>b>q>", ",TEnumeratorh", "rYf;5", "\"TArray", "4'474?4S4a4o4w4", "3$363F3N3\\3n3", "EOSErrorx", "ErrorCode", "LoadLibraryA", "<6", "Overrides the default setup type.", "TList", ">&>:>O>g>o>w>", "SetArrayElement", "TFieldsCache.TFields&", "Windows Server 2025", ">0>O>", "2!2)232;2J2_2p2", "TParamFlags", "(TRttiPool.GetPackageList.DoUpdate$0$Intf", "cp865", "CreateResHelp", "G0K0O0S0a0o0{0", "GetInterfaceEntry", "4=4R4[4", "SetEndOfFile", "LongDateFormat", "IntegerType", "FSpinCount", ":<:\\:`:", "IsTimeout", "MBToWCharFlags", "PreviousFrame", "n00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0123456789ABCDEF", "$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)", "Subtract", "7/7B7S7f7t7", "GetDiskFreeSpaceExW", "$TEnumerable'", "><00p", "faWrite", "6!6%6)676E6Q6`6", "Source", "0\"080H0j0n0", "TEnumAliasEntry", "Comparert>[", "GetField", "UhI@]", "$ZXsB", "=2=@=O=f=", ">$>9>G>^>s>", "DisableProgramGroupPage", "Winapi.Messages", "5*585L5]5v5", "171I1R1n1", "IsObject", "cp1256", "X,2<<", "\"3)3I5Y5b5h5x5", "===A=\\=`=|=", "4;4M4_4p4", "?\"?0?G?^?l?", "Mvm})", "Invalid property value List capacity out of bounds (%d)", " IEqualityComparer", "}t7N,", "ARight", "TParamFlag", "euc-kr", "WaitFor", "3'3/3=3K3d3l3z3", "EVariantUnexpectedErrorp", "7+737A7R7n7", "AddObserver", "7H8q8", "", "ReadListEnd", "RegCloseKey", "SortList", "1 1$1(1,1014181@1]1k1s1", " ", "LocaleName", "SetData", "7'797L7k7o7", "8*8;8O8W8h8v8~8", "iso8859-6", "EListError", "\"Compression.LZMA1SmallDecompressor", "636P6T6p6", "7)8R8", "TThread.TSynchronizeRecord ", "InitCommonControls", "TIntConstf", "EControlC", "<6=y=", ".idata", ";!;%;D;T;X;\\;d;l;p;t;x;|;", "3)3;3U3c3r3", "FHits", ">-?>lo_", "9%949F9Y9a9o9}9", "VirtualFree", ";Z]_^[", "FOnFindMethodInstance", "CreateDirectoryW", "ReadVariant", " ", "?&?i?", "Aifaa!", ">5?U?\\?", "TMethod", "%TArray", "=,=0=4=8=<=@=I=b=y=", "4&474T4b4y4", "8 8-8s8z8", "!IEqualityComparer", "Specifies the password to use.", ">(>9>N>a>s>", "/LOGCLOSEAPPLICATIONS", ",tdBHu", "FUserData", "TPointerList", "WCharToMBFlags", "8G8V8", "<#=h=q=", "RightToLeft", "mkConstructor", "AppVersion", "&PL@^hD", "1*121P1b1{1", "/TList.arrayofT", "FParent", "TListp", "ByteIndex", "?J?{?", "TWaitResult", "ENoMonitorSupportException", "252S2e2y2", "SafeArrayUnaccessData", "f; >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "TCollection", "|:Fo[vsB", "VerSetConditionMask", "=&=*=H=a=", "4Y+p:w", "PShortString", "smj-SE,smj,se", "8\"8^8", "wdsLight", ";4;I;W;n;", "8 868H8]8", "February", "TExternalThread&", ";(;8;I;Q;[;h;y;", "?#?1?@?j?n?", ";%;,;<;D;L;T;X;\\;`;d;h;l;p;t;x;|;", "SysInit", "*1#J$", "GetThreadPriority", "HeapDestroy", "RootAncestor", "?&?=?K?^?u?", "Populate", "GetItem", "FOwnsObjects", "GetInterface", "> >$>(>,>0><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "X0\\0`0d0h0l0p0t0x0\\7`7d7h7l7p7", "iso-ir-166", "ibm864", "1\"141J1X1g1x1", "UninstallDisplaySize", "4!4;4B4I4S4W4[4v4~4", "opaque_Buffer", "5 575;5R5Y5`5g5q5u5", ">w 4>w`", "<0V0~0", "System.SyncObjs", "90949O9S9o9", "=%=-=u=", "CTDictionary.TPairEnumerator;", "3K.TKeyEnumerator;", "cp862", "SetProcessDEPPolicy", "NumUninstallRunEntries", "TIntfFlag", ";A;x;", "< <$<(<0<8<<<@1X1f1u1", "'?ISS", "521C!", "<5e1_", "QTArray>", "TRttiRecordType<", "tis-620", "ComObject", "141T1d1x1", "KernelTime", "AsObject", "System.Diagnostics", ">+><>\\>m>", "NewInstance", "9\"979E9Y9o9", "ComparerdS_", ":TDictionary.TPairEnumerator;", "Windows Server 2012 R2", "cp1252", "Error reading %s%s%s: %s", "AFile", "cp863", "3-3;3M3\\3d3t3", "ReadFloat", "ComponentCount", "SuspendThread", "FSortedComponents", "FreeSid", "1#141H1P1a1o1w1", "5 5$5(5,5054585<5@5D5H5L5Y5l5}5", "%TMethodImplementation.PInterceptFrame", "8-8A8u8", ":G;h;", "SystemL", "VPointer", "6 6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6", "tkClass", "PropType", "= =/=7=E=X=g=o=}=", "Invoke", "6T6f6o6", "ExternalThreadd", "abc?defg", "PropData", "FFreeOnTerminate", "PListh", "csibm860", "jjjjjjjj", "oM\"%8", "4E4L4c4", "TStreamCapabilities", "VArray", "UhdpW", "GetChars", "< =q=", "Comparison", "Update", "$YZ^[", "CurrentBuildNumber", "afDefined", "828I8W8n8", "WriteListEnd", "]TEnumerator>(", "*IEnumerable", ";$;h;", "GetName", "8 8$8L8\\8d8l8t8x8|8", "CreateWithoutCopy", ")TList.arrayofT", "iso8859-5", "6$6/656:6E6K6P6[6a6f6q6w6|6", ";2;@;R;l;z;", "dbkFCallWrapperAddr", "TVarRec", "wrError", "FSuspended", "TArray", "iso-8859-7", "Invalid StringBaseIndex", "TPropSetLIZ", "6%6;6P6^6u6", "?.ParrayofT", "IValueData", "FAsPointer", "FReadMethData", "IReadWriteSync", "? ?$?(?,?0?4?8?", "gb_2312-80", "NumCustomMessageEntries", "VarIdiv", "opaque_Dictionary", ">f?}?", "VariantCopy", "CreateEmpty", "1'1=1S1", "TInterfacedObject", "364:4a4k4o4", "dkStatic", "%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)", "2<2L2T2\\2d2h2l2p2t2x2|2", "?,?>?U?]?e?", "NumDirEntries", "Windows 8", "TRttiPool@", "4 4(4,4044484<4@4D4H4L4P4T4X4\\4`4d4r4z4", "windows-936", "\\TEnumerable>'", "Uh)L`", "5+5=5M5U5c5v5", "4$474?4M4_4r4z4", "3'393I3Q3_3r3", "Start index out of bounds (%d)", "Capacity", "Windows 10", "ReadRootComponent", ":%:B:P:`:r:", "TSetupLanguageDetectionMethod", "2L3S3e3l3~3", "6Shared.VerInfoFunc", "FProcedure", "BTDictionary.TKeyCollection;", "5^6&8g8", "VUInt64", "Uhur]", "4#4.464G4[4l4y4", "ArrayData", "ExtractPair", "92969M9T9[9e9i9", "ALock", "ECompressError", "VarAdd", "SeShutdownPrivilege", "3-3@3V3k3y3", "GetSystemDirectoryW", "UpdateTarget", "IAsyncResult", "", "Execution", "?$?;?D?h?", "csisolatin5", "<\\=z=", "3 3$3(3,303=3N3_3y3", "1 1$1(1,10151<1C1J1Q1-23292?2E2e2k2q2w2}2L3i3", "fvvv[$~OO", "TRttiInstanceMethodClassic", "Hours", "7W*.;", "TRttiInstanceType@", "NewSize", "ClassRef", "323@3P3c3v3", "456789", ": :=:S:d:r:z:", "ItemClassH", "5<6@6D6H6L6P6T6X6\\6`6d6h6l6", "EVariantOverflowError", "IsManaged", "VTEnumerator>", "8 8$8(8,8084888<8@8D8H8L8P8T8a8z8", "608g8o8z8", "TRttiEnumerationType3", "FStream", ">TDictionary", "6*656;6J6W6h6z6", "StoredProc", "8*80858E8K8O8%9U9", "ValuesPzZ", "MinInt64Value", "TDate", "AType", "ReadComponents", "TFileCreateDisposition", "NextValue", "proDialog", "6;6L6W6[6w6", "6]6y6", "c,J^$x^q", "TRttiInstancePropertyClassic", "G(LCC", "0<1C1Y1]1a1e1i1m1q1~1", "TPersistentClass", "TVariantBoundArray", "CurrentD", "1$1,141<1D1L1T1\\1d1l1t1|1", "fsNegative", "1 161G1Z1k1~1", "1 101B1X1f1v1", "TComponentEnumerator", "PIntfMethodEntry", "TStringComparer'", "FAsExtended", "[ OZ+", "=#=+=3=;=C=e=z=", "CodeAddress", "ReadInteger", "Exchange", "ibm819", "6:6A6m6t6", "0#0.080^0q0", "Invalid numeric input", "7c8p9w9", "UhkF`", "ThreadID", "PList<", "NumUninstallDeleteEntries", "Result", "DestroyWindow", "X?g?", "0,0>0B0Y0`0j0n0", ": :$:(:,:0:4:8:<:@:D:H:L:P:T:", "TRttiStringType", "9(909@9H9P9X9\\9`9d9h9l9p9t9x9|9", "2$2L2[2c2t2", "<*T", "IsRecord", "EArgumentExceptionlpX", "tkUString", "/SPAWNWND=", "cp857", ">TDictionary.TItemArray", "BTDictionary.TKeyEnumerator", "", "&op_Explicit", "Active", " 0@P`p", ";-;S;|;", "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<", "2TList.TEnumerator", "6/676E6W6n6|6", ",TList.TEnumerator5", "DTDictionary.TValueEnumerator;", "FData", "TThread&", "849X9d9h9l9p9x9", ";/;=;U;d;l;|;", "PInt64", ":*:D:_:o:", ":TInternalEraInfoRecord.:1", ",TEnumerator(", "TClass", "=1=?=N=`=q=u=", "EPropWriteOnly", "RegDouble", "ifUnused2", "!TMethodImplementation.TInvokeInfoK", "2!2/2>2T2i2w2", "csAncestor", "iso8859-1", "TIntfFlags", "AsCurrency", "TUVW'XYZ[\\]^_`(", "/TEnumerator(", "<\"<*<", "ReadIndex", "slAuto", "4 444L4_4h4", "MTEnumerator>(", "LoadLibraryExW", "tkClassRef", "Uh.rY", "Copyright ", "CompanyName", "= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\\=`=d=h=l=p=t=x=|=", "10171N1R1V1Z1^1b1", "FindFirstFileW", "varType", "csibm863", ">(>0>A>P>X>f>t>", "?*?P?W?n?", "Uh:tY", "TRttiEnumerationType@", "1 1$1(1,101H1X1\\1|1", "AInterfaceList", "Privileged instruction", "vaInt64", "ReferenceInterface", "$Z_^[", "mkFunction", "<-<1", "2&2=2K2b2y2", "5!6)6", "Values", "PVarArray", "9$929I9^9l9", "6#7h7", "8 8$8(8,8084888<8@8D8H8L8P8T8X8e8", "Package", "SetupLdr.e32", ":mEZ;iy[-c3", "skWideString", "FReadSignal", ">&><>R>Z>h>~>", "TCriticalSectionD", "&TList.arrayofT", ">(>0>>>L>", "=)=G=Q=[=`=q=", "6 757J7d7|7", "DecimalSeparator", "4+434D4O4W4h4|4", "TComponentState", ":TPropData.:1", "FHandleCreated", "VPWideChar", ">K?n?", "OnNotify", "2:2B2J2R2Z2b2j2r2z2", "ElType", "iso-ir-127", "FMethodBuckets", ";0;A;E;d;t;|;", ";-;L;W;", "1Z[Z@", "8%8)8@8J8N8p8", "5,6f6", "TRttiRecordField6", "Windows Vista", "csisolatincyrillic", "VTEnumerator>(", ":TFormatSettings.:4", ":TFormatSettings.:5", "QQQQSVW", ">A>P>X>h>", "=#=1=I=]=e=v=", "4$4(4/4B4V4k4", "maccroatian", "3R3g3u3", "Uh7\"a", "+TList.TEnumerator5", "?)?y?", "macroman", "The setup files are corrupted. Please obtain a new copy of the program.", "Winapi.Windows", "> >$>(>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>", "iso-8859-5", "IComparer", "ThreadProc", "ASyncResult", "? ?(?S?a?w?", "ibm861", "9&9@9c9", "Push_68", "TList&", ">@[{;", "FromArray", "TypeInfo", "4+4?4T4o4", "TSetupHeader-", "1%161{1", "\";wogt", "8=Gy%\"-", "faReadWrite", "sr-Cyrl-CS", "ibm850", "GetSystemMetrics", "2!212C2Z2h2x2", "IAsyncResult(", "windows-1255", "InsertRange", "EAssertionFailed", "TLightweightEventX", "Memory", "FReturnValue", "TRttiStructuredType ", "TRttiStructuredType", "B!ZZZx", ">+>j>", "TRttiProcedureType@", "=*=;=H=P=a=p=x=", "TInstItem.TBucketArray|", "OOO[u", "WideString", "bigfive", "-TArray>", "Operation not supported", "arxx8911", "position", "1rN_.", "AStartTime", "3h3l3", "-TList.arrayofT", "FCallConv", "9&979N9\\9o9", "WriteCollection", "zh-MO,zh-Hant,zh", "System.Types", "Direction", "(TList.arrayofT", "#TList.TEmptyFunc", "EVariantOutOfMemoryError", "DTDictionary.TValueEnumerator;", ":?:e:", "TFinalizer'", "ffInline", "7*$,/", "6;7j7", ">)>1>9>A>I>Q>Y>a>i>q>y>", "opaque_State", "AAAaaa", "System\\", ";#;1;@;N;^;f;t;", "IsSubComponent", "proCommandLine", "\\TEnumerable>D", ";-;C;S;h;w;", "iso_8859-13", "MultiByteToWideChar", "9+999F9X9", ";,;<;L;m;", "0TEnumerator", "PUnitHashEntryP:Y", "5#545U5Y5", "TFindMethodInstanceEvent", "AsInterface", "d2IGg", "PBKDF2", "494g4", "7(7-7<7A7V7[7j7o7", "BeginUpdate", "0TCollectionNotifyEvent", "TRecordTypeField", "8'9P9{9", "FClasses", "UhBJ`", "VWords", "EZeroDivide", "4-414\\4l4p4t4|4", "elSize", "575?5G5O5W5_5g5o5w5", "1#111?1K1X1", "4 4$4(40484<4@4D4H4L4P4T4X4\\4`4d4h4l4y4", "PACKAGEINFO", "8:8K8", "3Q3y3", "IsEmpty@", "dupIgnore", "AAction", "7=7E7t7", "CompareStringW", "eS\\XY`N", "8.8;8L8n8{8", "AThreadProc", "=0=<=@=D=H=P=X=\\=`=d=h=l=p=t=x=|=", ": :$:(:,:0:4:8:<:@:\\:p:t:", "0'0C0R0Z0h0w0", "9TDictionary.TKeyEnumeratorxt_", "#TEnumerator", "TRttiInstanceMethodClassic6", "GetThreadUILanguage", "ShortTimeFormat", "q-IK\"G", "VDispatch", "7 7$7(7,7074787<7@7D7Q7t7", "Collisionsxw_", "^[YY]", "727G7^7q7", "Feature not implemented Method called on disposed object", "515?5Q5k5y5", ";2;M;", "DTDictionary.TItemArray", "Destination", "opaque_DistanceLimit", "1#151E1M1[1n1~1", "+TEnumeratortv^", "ShortDayNames", "Current,", "SetSize", "ElementType", "TComponentName", "TCollectionItemClass", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING", "TMultiWaitEvent.TWaiterFlags", "FRootAncestor", "Access violation", "TailHandle", "TOrdinalIStringComparerD", "TRttiInstMethParameter", "FFixups", "3TDictionary", "pfResult", "9U:a:o:", "72868]8g8k8", "FComparer", "TFloatType", "9G:V:i:m:|:", "4 4.4@4O4W4h4", "NegCurrFormat", "@.tls", "@^[YY]", "3TDictionary&", "?(?8?@?H?P?T?X?\\?`?d?h?l?p?t?x?|?", "='=:=L=T=b=q=", "9\"9(929>9K9P9l9}9$:i:", "1,1F1T1c1z1", "888G8j8y8", "soEnd", "TCustomAttribute", "String", "=+=3=>=D=^=", "6)616?6M6[6c6q6", "PPropInfo", "2Chkognf", "6(6,60686@6D6H6L6P6T6X6\\6`6d6h6l6p6t6", "TComponent.TValueEnumerator;", "4O4X4\\4d4x4", "TCompressedBlockReaderQ", "8$949<9D9L9P9T9X9\\9`9d9h9l9p9t9x9|9", "Single", "JTDictionary.TValueCollection", "3 3$3(3,3034383<3@3D3H3P3X3`3", "GetEraYearOffset", "q`g'7n", "+TEnumerable'", "1N1k1w1", "0TEnumerable", ":$:i:t:|:", "WriteBuffer", "2 2$2(2,2024282<2@2N2V2^2p2", "<1<9&", "Enter", "QQQQQQQQS3", "= =$=(=,=0=4=8=<=J=\\=u=", "/GROUP=\"folder name\"", "MAINICON", "LoadFromFile", "TExtended80Rec", "= =$=(=,=0=4=8=<=I=g=o=w=", "2 2(2,2024282<2@2D2H2L2P2T2X2\\2i2z2", ";8;d;", "9\"9*989F9Z9b9s9", ">(?A?", "WriteBoolean", ">8>f>n>y>", "Reference", "?$?,?4?|", "csisolatin6", "FCompare", "9!9(9/999Y9{9", "?(?2?=?U?`?j?t?~?", "0 0$0(0,0004080<0@0D0H0L0Y0p0x0", "FPropertyType", "&TEnumerable", "%;~}XO", "TIntConst", "3.3<3O3c3q3", "LegalCopyright", ">,>J>X>r>", "TInterfaceTable", "6)6<6K6]6p6x6", "Disables the \"This will install... Do you wish to continue?\" message box at the beginning of Setup.", ">+>/>9>A>I>", "Systeml#[", "Aliases", "ReadChar", "6(7k7x7", "9 9(90989@9H9P9X9`9h9p9x9", "000004b0", "TimeSeparator", "5$5(5,5054585<5@5D5H5L5P5T5b5t5", "VarMod", "IInterface", "tOFOu", "708?8k8", "TUTF7Encoding&", "3S4b4", "IsBufferValid", ";);:;B;P;_;u;", "5TCollectionNotifyEvent", "0\"0*020:0B0J0R0Z0b0j0r0z0", "1 131L1_1c1j1|1", "System.Character", "8Alx3", "Windows Server 2022", "XL,--", "RefCount", "1TList.TEnumerator5", "IntfMethods", "5\\5`5", "7+7O7S7W7[7_7c7", "SysAllocStringLen", "BTDictionary.TKeyCollection`", "TFieldsCache.TFields", "<$=/=8=H=P=X=`=d=h=l=p=t=x=|=", "TRttiDynamicArrayType", "3!3;3P3t3", "GetLongPathNameW", "3O4d4r4", "=;>r>", "TVmtMethodExEntry", "AIsClas", "PVmtFieldEntry", "*TEnumerable'", "TEnumerator", "Winapi.ImageHlp", "4Y^^fbb", "Uh|-`", "vaSet", "cmStored", "6Q6}6", "OriginalFileName", "4,5B5S5g5o5", "7\"8)8", "TList.arrayofT", "", "212T2", "; ;$;(;,;0;4;A;R;i;q;", "System.Rtti", "Flink", "FSection", "Uho8Z", "AddRange", ";-;@;D;K;^;r;", "TFindComponentClassEvent", "*TMethodImplementation.PFirstStageIntercept", "L$$^][", " GetDeclaredImplementedInterfaces", "<'<5.TValueCollection", "ldNone", "TPropSetV", "9TObjectDictionaryL8]", "Reader", "Uhzx\\", "mvPrivate", "BinaryOp", "IndexOf", "iso_8859-7:1987", "L($\"SA", "LNN19y", "\\o{=D0O-", ": :B:O:`:j:r:", "BeginRead", "1 2L2m2", "OnFindComponentClass8", "0Q1[1f1n1", "283G3Z3^3m3", "*TList.ParrayofT@", "GetAttributes", "InsertComponent", "TFindMethodNameEvent", ";\";*;2;:;B;J;R;Z;b;j;r;z;", "<1.TEmptyFunc", "2\"2*222:2B2J2R2Z2b2j2r2z2", "GetTempDir: GetTempPath failed (%u, %u)", "0!010D0V0^0l0{0", "DecompressInto", "ConvertSidToStringSidW", "4*494]4g4s4}4", "Uh~I\\", "4&5M5", "ReadDouble", "iso_8859-7", "Countdx_", "g\"6`v", "3!3/373E3S3g3o3", "TDispatchKind", "faRead", "OnKeyNotify", "csInheritable", "FMethOfs", "\\TEnumerator>", "tkPointer", "=+=;=N=a=o=", "?,???G?U?c?z?", "QQQQQQQSV", "CopyValue", "&op_Inequality", "5E5%636@6\"7?7F7g7", "IsEmptydv[", "3%3/333P3T3u3", ".TList.arrayofT", "AsInteger", "%TObjectList&", "PRTLCriticalSection", "b2p2T3n3", "2/2=2M2`2r2z2", "9,9;9K9]9w9", "TList&", "333E3M3[3i3}3", "TList.arrayofT", "5>w`/>w`", ":&:5:=:K:^:m:u:", "This installation was built with Inno Setup.", "Handle4-^", "TTime", "iso-ir-179", "FOnAncestorNotFound", "TPropIntfFixup,", "HasData", "VY_/2>1N2", "9+:n:", "ExitWindowsEx", "SevenZipLibraryName", "3'353L3c3q3", "otUWord", "IsOrdinal", ">K>R>b>i>", "AsyncResult", "ddAuto", "ChaCha20", "FBaseAddress", "6IComparer", "UnregisterWeakRef", "QQQQQSV", "(A;OICI;FA;;;SY)", "cp852", "AM/PM", "BTDictionary.TKeyEnumeratorp", "System.Generics.Defaults", ".TItem", "<)<7(", "shift_jis", "RandomXorStartOffset", "2 2(2P2^2t2", "3)434?4J4W4\\4b4", "VS_VERSION_INFO", "GetProperty", "TEMP\\", "YZXtp", "CurrencyFormat", "9<9S9y9", "FreeLibrary", "tkArray", "d%J$E1", "!TList.TEnumerator5", " TList&", "Value", "-0B0S0h0v0", ":TSetupHeader.:4", "2 2$2(2,2024282<2@2N2V2h2z2", "%s (%s, line %d)", "FName", "Interface not supported", "iso_8859-2:1987", "(TList.TEmptyFunc", "CreateEventW", "UninstallFilesDir", "fdCreateAlways", "cp-is", ":P;&<*<.<2<6<:<>", "IsInstance", "=T=X=", "DateSeparator", "System|", "1 151F1Z1b1s1}1", "\\TArray>", "ZTUWVSPR", "2!2)21292A2I2]2r2", "SpinWait", "System.Internal.ExcUtils", "6-6;6Q6i6w6", "vhM%(", "RefType", "RemoveDirectoryW", "", "3&3-373X3", "0*0D0R0b0t0", "DisplayName", "arabic", "gb18030", "969L9]9q9y9", "Windows 8.1", "8r8/989K9Y9", "Disk full", "AData", "Division by zero", ">&>+>D>T>X>\\>d>l>p>t>x>|>", "csDestroying", "DeleteRange", "DisableDirPage", "him]{1", "9B;v;", "<\\=l=r=", "fsNDenormal", " TList.TEmptyFunc", "UnregisterWeakMethodRef", "3,3<3D3L3T3X3\\3`3d3h3l3p3t3x3|3", "*TList.TEnumerator", "AFormatSettings", "NumInstallDeleteEntries", "818?8L8^8k8s8", "BTDictionary.TKeyEnumerator;", "TAncestorNotFoundEvent", "False", "Same as /LOG, except it allows you to specify a fixed path/filename to use for the log file.", "303O3[3v3", "FAncestorPos", "4 4$4,4044484<4@4D4H4L4P4T4X4\\4`4d4h4l4p4t4x4|4", "TRttiInstancePropertyExXi\\", "QQQQQQQS", "Inno Setup Setup Data (6.6.0)", "soCurrent", "IComparer", "FSetDefault", "TFieldsCache.TFields8k_", "AShared.EncryptionFunc", "UhCta", "nn-NO,nn,no", "FExternalThread", ">p?y?", "=>CDE", "UnitNameFld", ": :;:[:_:}:", "4%4?4M4\\4o4", ";9<=&?I?a?", ">)?W?", "545<5m5", "ACount", "hebrew", "LanguageName", "IntToIdent", "EraOffset", "TSetupDisablePage", "EVariantTypeCastError", "ATypeInfo", "Prevents Setup from activating custom styles (including the built-in custom dark style).", "FindItemID", "GetACP", "9.9E9_9q9y9", "InstanceType", "ISHA256", "FGroups", "9%989@9N9\\9s9", "404<4@4D4P4T4X4`4h4l4p4t4x4|4", ":TFormatSettings.:10", "ActionComponent", "4TPair", "FileDescription", "GetLogicalProcessorInformation", "TStreamC", "TPropSetK", "9I:M:Q:U:c:q:}:", "IsPublicTypeD/W", ">4>D>H>L>T>\\>`>d>h>l>p>t>x>|>", "O-20'", "IsWritable", "6$666M6[6k6~6", "PRecordTypeFieldt%Z", ":\":*:2:::B:J:R:Z:b:j:r:z:", "dpYes", "< <$<(<,<4;?O?^?t?", "ExtraDiskSpaceRequired", "RaiseException", "? ?0?I?j?|?", "iso_8859-3:1988", "FWCharToMBFlags", "iso-ir-157", "8 8$8(8,8084888<8@8D8H8L8P8T8X8\\8`8d8h8l8p8", "9#9+939;9C9K9S9[9c9k9s9", "TFilerFlag", "8H8]8f8", "AThreadName", "TInterfaceList&", "?'?5?G?X?`?n?}?", "RD_^[Y]", "3 3(3X3c3l3", "Windows Server 2012", "1TCollectionNotifyEvent", "*TList.TEnumerator5", "FInterfaceList", "929[9", "TypeTable", "4$424E4a4r4", "AppVerName", "6%7Y7", "GetCommandLineW", "%TList", "fdCreateNew", ">", "SafeArrayCreate", "= >2>;>R>s>|>#?", "7 7$7(7,7074787<7@7D7H7L7P7T7X7\\7`7d7h7l7p7t7x7|7", "", "vaInt16", "5!5<5@5\\5", "VarR8FromStr", "QTArray>", "VirtualQueryEx", "909H9[9s9{9", ":,:4:<:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:", "YFFFH&", "AReturnType", "3!343F3N3\\3k3~3", "MaxInt64Value", "FAllocated", "/TCollectionNotifyEvent", "=6=K=Y=h=z=", "Int64", "7oGHp", "b'us-ascii", ":!:8:F:]:r:", "RecSize", "8C8J8Q8X8_8f8m8t8{8", "NumTypeEntries", "bs-Cyrl-BA", "?'?/?7???G?O?W?_?g?o?w?", "ManagedFields", "UnitCount", "Listh", ";-;7;;;X;h;p;x;", ";sht'", "]_^[]", "TMonitor", "Components", "FGG9v", "UhFy\\", "3$444]4m4", "Compression.Base", "VTEnumerable>'", "LeaveCriticalSection", "BaseType", "otSWord", "TypeData", "Instructs Setup to force close when closing applications, or prevents it from doing so.", ">8>B>d>t>|>", ";1;?;L;^;s;", "=G>h>t>x>|>", "7#717C7T7g7k7", "TObjectD", "EmptyAsAnyType", "vxoo/", "&op_GreaterThanOrEqual", "NumFileEntries", "8&9*9K9O9j9n9", "Identifier", "9H9f<", "&TEnumerable", "%s.Seek not implemented", "ClassParent", ">G>]>n>", "TThreadList&", "FHeapBase", "December", "Ident", "---V'", "?+?.ParrayofT", "Stream write error", "1$1A1E1d1t1|1", "FHasSelf", "ContainsKey", "JmpRel_E9", "FLock", "AOperator", "Z!)%N*", "0TEnumerable'", "tkInterface", "AppCopyright", "?&?5?G?Z?b?p?~?", "? ?(?6?E?[?i?q?", "InGroup", "UhV#Y", "qps-plocm,ar", "rMn3=", "< <$<(<,<0<4<8<@8F8N8V8^8f8n8v8", ")TList8{[", "Uht2a", "1 1$1(1,1014181<1@1D1L1P1T1X1\\1`1d1h1l1p1t1x1|1", "WideCharToMultiByte", "TPropInfoEx", "FLatestPackageList", "8>8i8", "4;4m4", "#TEnumerator", "4'454E4X4k4y4", "6%656H6S6[6i6y6", "7R7\\7m7}7", "*TArray", "TFindAncestorEvent", "=@=I=", "sr-Cyrl-RS", "323C3_3g3~3", "sccPasswordTest", "Invalid variant type conversion", "(IComparer", "FInstance", "Software\\Borland\\Delphi\\Locales", "EHashException", "SetupMutex", "prAdmin", ";L", "TList`c^", "FChildPos", "TOperation", "FOnGetDeltaStreams", "WriteRootComponent", "Reserved3", "Index2", "October", "\\6\\", "FreeOnTerminate", "RemoveFreeNotification", "TList.TEnumerator", "/IEnumerable", "Uh&$`", "5g5v5", "586H6P6X6`6d6h6l6p6t6x6|6", "2 2$2(2,2024282T2k2o2", "fSystem.Rtti", "System.TypInfo", "4,4>4P4e4x4|4", "otULong", "lzma1smalldecompressor: Compressed data is corrupted (%d)", "qps-ploca,ja", "NTDictionary.TPairEnumerator;", "5TCollectionNotifyEvent", "Windows Server 2019", "EWriteErrord", "FItems", "August", "Floating point overflow", "value", "OleStr", "laCopy", "TRttiDataMember$", "FCollection", "HandleXi\\", "7E8Z8", "Duration", "korean", "=+=7=?=P=[=c=t=", "EVariantInvalidArgError<", "Instructs Setup to initially check the Don't create a Start Menu folder check box.", "TRttiFloatType", "4)4-4I4l4t4", "<'.ParrayofT", "BaseException", "2#212=2L2{2", "7&787Q7b7p7x7", "VariantChangeTypeEx", ";';4;I;Z;n;", "Dispatch", "crEqual", "656F6X6`6n6{6", "4R8Y8", "d28]w", "TMultiWaitEvent.TMultiWaitert", "8 888<8\\8l8t8|8", "Invalid source array", "7+7E7M7U7w7", "TEnumerator(", "TArray", "OnFindMethodName", ";!;8;M;U;", "FOwningThread", "volatile bool FFinished", "TInterfaceListEnumerator>", "vaCurrency", "9#949I9W9m9", "5\"505:5g5", "FAsCurr", "WR!:K", "7.878I8U8`8*989f:q:", ">2>K>d>}>", "EIntError", "WriteAnsiString", "DefaultGroupName", "6@6H6d6t6x6|6", "ITDictionary.TKeyEnumerator", ";TDictionary.TValueEnumerator", "AEncoding", "FWaiters", ">^>l>", "VWideString", "HTArray>", "5-555=5]5r5", "H$hnn", "Systemh", "The Setup program accepts optional command line parameters.", "?1?L?\\?`?d?l?t?x?|?", "FActive", "6'7|7", "VarI4FromStr", "Uh{~`", "FParamList", "?333333", "?'?;?C?T?b?j?x?", "> >0>8>@>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "<(1D1n1", "<&<;>", "VTable", ":(:Q:z:", "cnRemoved", "TManagedField", "cp1257", "2'222", "EHeapException,", "<.<<>B>", "April", "$ZXw<", "_DGWeeeee", "PWideCharL", "Finalize", "CreateSuspended", "0$0,0K0", "Exception3", "kkk_|||", "AsSet", "opRemove", "MaxValue", "ddddd", "EPropReadOnly", "GetType", "HeapAlloc", "< <0<", "HTDictionary.TKeyCollection", "TMonitor.TWaitingThread", "2$2,2:2H2s2w2", "9,9:9J9\\9y9", "T$,#D$8#T$<3", ":-:c:n:", "VSmallInt", "List0", "VTEnumerator>(", "pfReference", "YZXtm1", "AsInstance", "iso8859-8", "AConstant", "FLockCount", " TList&", "8M9[9m9", "Invalid variant type", ">$>,>4><>@>D>H>L>P>T>X>\\>`>d>h>l>p>", "DimCount", "DTDictionary.TValueEnumerator", "4&444B4V4^4o4}4", ".TArray>", "First", "csshiftjis", "i2;;k", "TBoundArray", "0*0@0N0^0p0", ";%;-;;;J;`;u;", "opaque_Code", "MTDictionary.TKeyCollection", "3$393S3k3", "r1A50L", "606v6z6~6", "machebrew", "TListEnumerator<", "TIntToIdentK", "RtlCompareUnicodeString", "TTypeData", ":,:@:S:b:t:", "e|5JB", "UhG:Z", "SO122bI", "P+]VW", "; ;$;(;,;0;4;A&", "$TPair", "4$;t$", "RandomXorFirstSlice", "AppComments", ";!.TEnumerator5", "6-656F6V6^6o6", "2 2$2(2,2024282<2@2D2H2L2P2T2a2r2", "< <(<0<8<<<@'", "PArrayPropInfod!Z", ">\\?v?", "u#3x=\\64M", "VString", "3$3,3<3K3_3p3x3", "_^[YY]", "Expand", " true", ":Shared.CommonFunc", "ETDictionary.TItemArray", ":(:v:", "FullHash", "cp1361", "vaSingle", "7-7@7H7V7d7x7", "RawByteString", "EndReferences", "comctl32.dll", "7#7;7C7K7S7[7c7k7s7{7", "Seconds", "*TEnumerableH", "hEdv4", ";_^[]", "tkEnumeration", "Uh|]`", "T$$#D$(#T$,RP", "WriteComponent", "3.4D4", "VarRec", "EWriteError", "?)?5?=?K?Y?g?o?}?", "HRESULT", "4Y\\\\ddd", "UhTD`", "tkMethod", "Uh_\\`", "QSVW3", "1,2c2{2", ">,><>@>D>L>T>X>\\>`>d>h>l>p>t>x>|>", "5$595A5", "3)303B3F3J3N3R3V3", "2$242<2R2X2{2", "WakeConditionVariable", "cspc775baltic", "FindComponent", "Uhq9Z", "0=0O0X0o0", "csunicode11utf7", "TSetupCompressMethod", "StackTrace", "7@7P7X7`7h7l7p7t7x7|7", "X\\\\DUU", "TCustomMemoryStreamC", "Bytes", ">Q>U>|>", "wine_get_version", "!TList.TEnumeratorX", "System.Generics.Collections8", "ExceptionAddress", "EInvocationError", "ShortString", "FFreeNotifies", "SetFilePointerEx", "TPropSetK", "SafeArrayGetLBound", "939D9T9\\9m9}9", "TypeCount", "QueryPerformanceCounter", "7\"7*787F7Z7b7s7", "; <0<4<8<@&", "9<9L9T9\\9d9h9l9p9t9x9|9", "LastIndexOf", "ifHasRtti", "7<7F7h7x7", "cmZip", "LongDayNames", ",$YXZ", "TFormatSettings.TEraInfo", "&op_LessThanOrEqual", "SystemhO_", "4N5c5q5", ",,,l|", "TEnumerable", "ifUnused1", "TComponent.Create@$ActRec\\", "SVWQf", "Close", "csFreeNotification", "System.SysConst", ";-;5;Q;t;", "LMNrr", "9!:N:", ">,><>D>L>T>X>\\>`>d>h>l>p>t>x>|>", "FRootName", "Leave", "GetVersionExW", "021?1Q1n1", "PJwA $J", "ParentD", "WVV>2", "7&747", "ParamList", "H~~vaa", "afIgnored", "FComponent", "Y>", "%?gbb", "tkSet", "5 5$5(50585<5@5D5H5L5P5T5X5\\5`5d5h5l5y5", "3*3;3P3^3w3", "+TList.TEnumeratorhU_", "9!9V9", "c0g0k0o0s0w0{0", ",]_^[", "<#>", "AHasSelf", "H0b0v0", "3 3(3034383<3@3D3H3L3P3T3X3\\3`3h3p3x3", "TProcParam", "ComponentName", "TRttiPointerType", "25393=3A3E3I3M3Q3U3Y3]3a3e3i3m3q3u3y3}3", "4,4>4c4k4", "CurrentMajorVersionNumber", "FShutdown", "PList01_", "3 3$3(3,3034383@3H3_3t3", "<\"<(<0<8<@4D4l4w4", "EAssertionFailed0", "PushEBP_55", "GroupWith", "TObservers&", "iu-Cans-CA", "TEnumerator", "SlicesPerDisk", "2%272G2O2]2p2", "GetIndexedProperty", "Module", "ExtractRawDataNoCopy", "Synchronize", " Invalid floating point operation", "!:x=B", "%TCollectionNotifyEvent", "TListHelper.TInternalNotifyProc{", "Cardinal", ")TList.TEnumerator5", "1 1P1T1", "Decimal", "2TList.TEnumerator5", "TEnumeratordx_", "utf-7", "2 2(2024282<2@2D2H2L2P2T2X2\\2`2d2l2", "UTF8String", "7;?E{r", "mkSafeFunction", "4+4A4R4j4{4", "TCollectionNotification", "%TEnumerator", "^&''YZZ\"", "5 5$5(5,5054585<5@5M5d5y5", "SignFlag", "1 1+161A1k1v1", "PResStringHashItem", "AsInt64", "TStreamCapability", "tkMRecord", "8\"8*888J8`8n8}8", "828z9", "Windows Server 2008 R2", "opaque_TempDictionary", "macarabic", ":TSetupHeader.:2", "IsStandardEncoding", "IOffset", "ReadSingle", "ExitThread", "WinVersion", "6 6$6(6,6064686<6@6D6H6L6P6T6X6\\6`6d6h6l6p6t6x6|6", "iso-ir-226", "=(=6=H=e=s=", "System.Generics.CollectionshO_", "GetSingleCastObserver", "TryIsObserving", "csisolatin2", "FOnKeyNotify", "))),...C...M+++B***+", "EEncodingError", "cp850", "Reserved", "1,141<1D1H1L1P1T1X1\\1`1d1h1l1p1t1x1", "iso8859-7", "oleaut32.dll", "S,Z^[", "utf-16be", "8]9w9", "8!9=9d9", "VarBstrFromDate", "4'4?4G4O4W4_4g4o4w4", "9TDictionary.TKeyCollectionTv_", "ExtractItem", ",IEnumerable", "cp1258", "FState", "FOnFindMethodName", "^o@^AWV", "ResName", "VTEnumerable>'", "7#7-777B7L7W7a7g7y7", "TRttiStringKind", "TStrongRandom: BCryptGenRandom failed (0x%x)", "tkChar", "TryEnter", "vaDate" ], "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" }, "executed_tools": [ "msi_extract", "overlay", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 8, "cape_type": "Unpacked PE Image: 32-bit executable", "process_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe", "process_name": "uninstalltool_setup.exe", "module_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe", "pid": 4848, "virtual_address": "0x00570000" } ], "configs": [] }, "info": { "version": "2.5", "started": "2026-06-30 15:34:53", "ended": "2026-06-30 15:35:55", "duration": 62, "id": 109, "category": "file", "custom": "", "machine": { "id": 109, "status": "stopping", "name": "win10", "label": "win10", "platform": "windows", "manager": "KVM", "started_on": "2026-06-30 15:34:53", "shutdown_on": "2026-06-30 15:35:55" }, "package": "exe", "timeout": true, "tlp": null, "parent_sample": null, "options": { "vnc_port": "5900" }, "source_url": null, "route": "internet", "user_id": 0, "CAPE_current_commit": "394455c2cd85889fb0782bfcf1f8c5c2f7f77b46" }, "behavior": { "processes": [ { "process_id": 4848, "process_name": "uninstalltool_setup.exe", "parent_id": 2604, "module_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe", "first_seen": "2026-06-30 22:35:11,850", "calls": [ { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x77018c37", "parentcaller": "0x770173e7", "category": "misc", "api": "HeapCreate", "status": true, "return": "0x04400000", "arguments": [ { "name": "Options", "value": "0" }, { "name": "InitialSize", "value": "0x00001000" }, { "name": "MaximumSize", "value": "0x00000000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x7724f11f", "parentcaller": "0x770184e1", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNELBASE.DLL" }, { "name": "ModuleHandle", "value": "0x77140000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77140000" }, { "name": "FunctionName", "value": "FlsAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77268fd0" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77140000" }, { "name": "FunctionName", "value": "FlsGetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77252e80" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77140000" }, { "name": "FunctionName", "value": "FlsSetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7725b4a0" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x77140000" }, { "name": "FunctionName", "value": "FlsFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7726bfd0" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x77017407", "parentcaller": "0x770175e2", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x00f924e8", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" " } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x775c0787", "parentcaller": "0x775c048f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04401000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x775c0787", "parentcaller": "0x775c048f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04402000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x7724f11f", "parentcaller": "0x76fce285", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "LPK.DLL" }, { "name": "ModuleHandle", "value": "0x76fb0000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x7724f11f", "parentcaller": "0x76fce294", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "ProcessIdToSessionId" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773e0b90" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x76fb6cbc", "parentcaller": "0x76fce2dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000068" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x775d38d9", "parentcaller": "0x775ad794", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb4\\xf1\\xcf\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\xf1\\xcf\\x00~\\xf3%w\\xec\\xf1\\xcf\\x00\\x00\\x00\\x00\\x005\\x00\\x00\\x00&\\x00'\\x00DB=v\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00^\\x88\\x01\\x018\\xf2\\xcf\\x00" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x775ad7c7", "parentcaller": "0x7726a0e7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x76fb6dfb", "parentcaller": "0x76fce2dc", "category": "misc", "api": "GetSystemMetrics", "status": true, "return": "0x00000400", "arguments": [ { "name": "SystemMetricIndex", "value": "0" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x76fb6e08", "parentcaller": "0x76fce2dc", "category": "misc", "api": "GetSystemMetrics", "status": true, "return": "0x00000300", "arguments": [ { "name": "SystemMetricIndex", "value": "1" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x76fb6e3e", "parentcaller": "0x76fce2dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000029" }, { "name": "uiParam", "value": "0x000001f4" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x76fb6eaf", "parentcaller": "0x76fce2dc", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000066" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x76fb6ec6", "parentcaller": "0x76fce2dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x77250766", "parentcaller": "0x7726b811", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "imm32.dll" }, { "name": "BaseAddress", "value": "0x75440000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmCreateContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75447770" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmDestroyContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x754477e0" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmNotifyIME" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7544bc30" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmAssociateContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x754450e0" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmReleaseContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75444e80" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmGetContext" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75443b30" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmGetCompositionStringA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x754484b0" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmSetCompositionStringA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75449050" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmGetCompositionStringW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75448550" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmSetCompositionStringW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75449080" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "ModuleHandle", "value": "0x75440000" }, { "name": "FunctionName", "value": "ImmSetCandidateWindow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75448d60" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x772580ad", "parentcaller": "0x773df564", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\comctl32" }, { "name": "BaseAddress", "value": "0x76fb0000" }, { "name": "InitRoutine", "value": "0x77017340" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 33 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4684", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "1384", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 35 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "1384", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "1408", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 37 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "1408", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4592", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 39 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4592", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4716", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 41 }, { "timestamp": "2026-06-30 22:35:12,054", "thread_id": "4716", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057e103", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057e109", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "wine_get_version" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x005756ff", "parentcaller": "0x005778b0", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00575582", "parentcaller": "0x00575746", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00575588", "parentcaller": "0x00575746", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetLogicalProcessorInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d91c0" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057e85a", "parentcaller": "0x0057391a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x773c0000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057e959", "parentcaller": "0x0057391a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetLogicalProcessorInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d91c0" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f03c", "parentcaller": "0x005778b0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": ";\\xb0\\x0e\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f03c", "parentcaller": "0x005778b0", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f03c", "parentcaller": "0x005778b0", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f03c", "parentcaller": "0x005778b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f03c", "parentcaller": "0x005778b0", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f03c", "parentcaller": "0x005778b0", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f03c", "parentcaller": "0x005778b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057b82f", "parentcaller": "0x005778b0", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057b835", "parentcaller": "0x005778b0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetThreadPreferredUILanguages" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773e0760" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057b849", "parentcaller": "0x005778b0", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057b84f", "parentcaller": "0x005778b0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SetThreadPreferredUILanguages" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773e0bb0" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057b863", "parentcaller": "0x005778b0", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057b869", "parentcaller": "0x005778b0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetThreadUILanguage" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d7530" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057df65", "parentcaller": "0x005778b0", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 63 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f0a1", "parentcaller": "0x005778b0", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x00f9102e", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" " } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f124", "parentcaller": "0x0057791c", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f131", "parentcaller": "0x0057791c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SetDefaultDllDirectories" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x772f06a0" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f147", "parentcaller": "0x0057791c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SetSearchPathMode" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773f2450" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f15d", "parentcaller": "0x0057791c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SetProcessDEPPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d8920" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f165", "parentcaller": "0x0057791c", "category": "process", "api": "NtSetInformationProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessInformationClass", "value": "34", "pretty_value": "ProcessExecuteFlags" }, { "name": "ProcessInformation", "value": "9" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00573bb4", "parentcaller": "0x0057b574", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x053a0000" }, { "name": "RegionSize", "value": "0x00140000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c161", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Embarcadero\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Embarcadero\\Locales" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c183", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Embarcadero\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Embarcadero\\Locales" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c1a1", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\CodeGear\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\CodeGear\\Locales" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c1bf", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\CodeGear\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\CodeGear\\Locales" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c1dd", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Borland\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Borland\\Locales" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c1fb", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Borland\\Delphi\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c4f0", "parentcaller": "0x0057c5bc", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.en-US" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c4f0", "parentcaller": "0x0057c5bc", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.en" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c4f0", "parentcaller": "0x0057c670", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.ENU" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c4f0", "parentcaller": "0x0057c69e", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.EN" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f271", "parentcaller": "0x005778b0", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057e85a", "parentcaller": "0x0057f812", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x773c0000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057e959", "parentcaller": "0x0057f812", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetNativeSystemInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773e1eb0" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f32f", "parentcaller": "0x005778b0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x00000238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f35d", "parentcaller": "0x005778b0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "CurrentMajorVersionNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f381", "parentcaller": "0x005778b0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "CurrentMajorVersionNumber" }, { "name": "Data", "value": "10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f3a3", "parentcaller": "0x005778b0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "CurrentMinorVersionNumber" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMinorVersionNumber" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f4dd", "parentcaller": "0x005778b0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "CurrentBuild" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f533", "parentcaller": "0x005778b0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "CurrentBuild" }, { "name": "Data", "value": "19044" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0061f5e2", "parentcaller": "0x005778b0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x005960c8", "parentcaller": "0x0061f62c", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c161", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Embarcadero\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Embarcadero\\Locales" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c183", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Embarcadero\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Embarcadero\\Locales" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c1a1", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\CodeGear\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\CodeGear\\Locales" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c1bf", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\CodeGear\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\CodeGear\\Locales" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c1dd", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Borland\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Borland\\Locales" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057c1fb", "parentcaller": "0x0057c420", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Borland\\Delphi\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00593823", "parentcaller": "0x005778b0", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057f97b", "parentcaller": "0x00593829", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "CompareStringOrdinal" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d6210" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057686a", "parentcaller": "0x0057697e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00576870", "parentcaller": "0x0057697e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetLogicalProcessorInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d91c0" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x005917c4", "parentcaller": "0x00590f30", "category": "misc", "api": "EnumCalendarInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "CalInfoEnumProc", "value": "0x00591570" }, { "name": "Locale", "value": "0x00000409" }, { "name": "Calendar", "value": "0x00000002" }, { "name": "CalType", "value": "0x00000004" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00591800", "parentcaller": "0x00590f30", "category": "misc", "api": "EnumCalendarInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "CalInfoEnumProc", "value": "0x00591618" }, { "name": "Locale", "value": "0x00000409" }, { "name": "Calendar", "value": "0x00000002" }, { "name": "CalType", "value": "0x00000003" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000c0" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x773c0000" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773de880" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d97e0" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000238" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x054e0000" }, { "name": "SectionOffset", "value": "0x00cff754" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00595011", "parentcaller": "0x005939eb", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000238" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0059753e", "parentcaller": "0x0061fa82", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597551", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VariantChangeTypeEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e2d430" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597567", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarNeg" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e72220" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x0059757d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarNot" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e734a0" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597593", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarAdd" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e4a520" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x005975a9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarSub" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e4b6b0" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x005975bf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarMul" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e4ade0" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x005975d5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarDiv" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e72740" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x005975eb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarIdiv" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e730e0" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597601", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarMod" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e73340" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597617", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarAnd" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e40870" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x0059762d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarOr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e73550" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597643", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarXor" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e736f0" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597659", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarCmp" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e24830" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x0059766f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarI4FromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e2a8b0" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597685", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarR4FromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e40510" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x0059769b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarR8FromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e27180" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x005976b1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarDateFromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e3dd50" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x005976c7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarCyFromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e74b10" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x005976dd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarBoolFromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e2a690" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x005976f3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarBstrFromCy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e3d000" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x00597709", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarBstrFromDate" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e3db30" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x00597522", "parentcaller": "0x0059771f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarBstrFromBool" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e40cc0" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x005a15d6", "parentcaller": "0x0061fb2a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e9d000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x005a15d6", "parentcaller": "0x0061fb2a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e9d000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x005ac26b", "parentcaller": "0x0057791c", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057f97b", "parentcaller": "0x005ac278", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "InitializeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775e4d50" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057f97b", "parentcaller": "0x005ac2bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "WakeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775f1bd0" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057f97b", "parentcaller": "0x005ac2cb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "WakeAllConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775ea4b0" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-06-30 22:35:12,069", "thread_id": "4684", "caller": "0x0057f97b", "parentcaller": "0x005ac2db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SleepConditionVariableCS" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x772f3860" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-06-30 22:35:12,085", "thread_id": "4684", "caller": "0x006199c8", "parentcaller": "0x00000000", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 146 }, { "timestamp": "2026-06-30 22:35:12,132", "thread_id": "4684", "caller": "0x00619a1f", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00570000" }, { "name": "ModuleName", "value": "uninstalltool_setup.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-06-30 22:35:12,132", "thread_id": "4684", "caller": "0x00619a5b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00570000" }, { "name": "ModuleName", "value": "uninstalltool_setup.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-06-30 22:35:12,147", "thread_id": "4684", "caller": "0x00619a1f", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00571000" }, { "name": "ModuleName", "value": "uninstalltool_setup.exe" }, { "name": "NumberOfBytesProtected", "value": "0x000b0000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000020", "pretty_value": "PAGE_EXECUTE_READ" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-06-30 22:35:12,163", "thread_id": "4684", "caller": "0x00619a5b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00571000" }, { "name": "ModuleName", "value": "uninstalltool_setup.exe" }, { "name": "NumberOfBytesProtected", "value": "0x000b0000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000020", "pretty_value": "PAGE_EXECUTE_READ" }, { "name": "OldAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-06-30 22:35:12,179", "thread_id": "4684", "caller": "0x00619a1f", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00630000" }, { "name": "ModuleName", "value": "uninstalltool_setup.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-06-30 22:35:12,194", "thread_id": "4684", "caller": "0x00619a5b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00630000" }, { "name": "ModuleName", "value": "uninstalltool_setup.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-06-30 22:35:12,194", "thread_id": "4684", "caller": "0x00619a1f", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00632000" }, { "name": "ModuleName", "value": "uninstalltool_setup.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00028000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-06-30 22:35:12,194", "thread_id": "4684", "caller": "0x00619a5b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00632000" }, { "name": "ModuleName", "value": "uninstalltool_setup.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00028000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000040", "pretty_value": "PAGE_EXECUTE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-06-30 22:35:12,194", "thread_id": "4684", "caller": "0x00613082", "parentcaller": "0x006193cf", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x00f9102e", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" " } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-06-30 22:35:12,194", "thread_id": "4684", "caller": "0x006149a6", "parentcaller": "0x006148f5", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x00619aa6", "parentcaller": "0x00000000", "category": "misc", "api": "SizeofResource", "status": true, "return": "0x00000040", "arguments": [ { "name": "ModuleHandle", "value": "0x00000000" }, { "name": "ResourceInfo", "value": "0x00645480" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x00619ab8", "parentcaller": "0x00000000", "category": "misc", "api": "LoadResource", "status": true, "return": "0x00658964", "arguments": [ { "name": "Module", "value": "0x00000000" }, { "name": "ResourceInfo", "value": "0x00645480" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x00619ac9", "parentcaller": "0x00000000", "category": "misc", "api": "LockResource", "status": true, "return": "0x00658964", "arguments": [ { "name": "ResourceData", "value": "0x00658964" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x006149ec", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xa0j\\x00\\x00\\x00\\x00\\x00\\xc8\\x98j\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x00614a5d", "parentcaller": "0x0061ff69", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "X\\xd4O\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x00614a20", "parentcaller": "0x00620058", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "Buffer", "value": "Inno Setup Setup Data (6.6.0)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "126" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x006149c6", "parentcaller": "0x00620058", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xd6\\xd4O\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 163 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x006149ec", "parentcaller": "0x00620058", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xa0j\\x00\\x00\\x00\\x00\\x00\\xc8\\x98j\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x00614a20", "parentcaller": "0x0546a0f0", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "Buffer", "value": "\\xafP;#" }, { "name": "Length", "value": "4100" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-06-30 22:35:12,210", "thread_id": "4684", "caller": "0x00617583", "parentcaller": "0x0062009a", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05820000" }, { "name": "RegionSize", "value": "0x02004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x00614a20", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "Buffer", "value": "\\x19\\xb7\\x9c\\xd1" }, { "name": "Length", "value": "131200" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x006174b0", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05820000" }, { "name": "RegionSize", "value": "0x02004000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x006149c6", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "Z\\xe5Q\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 169 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x00614a5d", "parentcaller": "0x00616c7a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xaa\\xf4U\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x006139a8", "parentcaller": "0x00619146", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x0057f97b", "parentcaller": "0x006139ae", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetUserDefaultUILanguage" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773e1f60" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x00573bb4", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05820000" }, { "name": "RegionSize", "value": "0x00140000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x006137a3", "parentcaller": "0x0061397a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "advapi32.dll" }, { "name": "ModuleHandle", "value": "0x75a20000" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x0057f97b", "parentcaller": "0x006137a9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75a20000" }, { "name": "FunctionName", "value": "CheckTokenMembership" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75a3ee50" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x006137bb", "parentcaller": "0x0061397a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x006137bb", "parentcaller": "0x0061397a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x006132d8", "parentcaller": "0x00618eaf", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x006132de", "parentcaller": "0x00618eaf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetTempPath2W" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x00612ee2", "parentcaller": "0x00612f11", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x00613d50", "parentcaller": "0x00613c1a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcrypt.dll" }, { "name": "BaseAddress", "value": "0x77550000" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x00613d75", "parentcaller": "0x00613c1a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcrypt.dll" }, { "name": "ModuleHandle", "value": "0x77550000" }, { "name": "FunctionName", "value": "BCryptGenRandom" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77557c30" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-06-30 22:35:12,257", "thread_id": "4684", "caller": "0x00613c35", "parentcaller": "0x00618ebc", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001dc" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xff\\xff\\xff\\xffP\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffR\\x00N\\x00G\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00613c35", "parentcaller": "0x00618ebc", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001dc" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xa5\\x01Vw0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00R\\x00N\\x00G\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00G\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffR\\x00N\\x00G\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00613c35", "parentcaller": "0x00618ebc", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x75bb0000" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00613c35", "parentcaller": "0x00618ebc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x75bb0000" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00613c35", "parentcaller": "0x00618ebc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x75bb0000" }, { "name": "FunctionName", "value": "GetRngInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75bdadf0" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00612ee2", "parentcaller": "0x00612f2a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00618891", "parentcaller": "0x00618eca", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00618891", "parentcaller": "0x00618eca", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000258" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00618891", "parentcaller": "0x00618eca", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000258" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00618891", "parentcaller": "0x00618eca", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x00000258" }, { "name": "VolumeName", "value": "" }, { "name": "VolumeSerial", "value": "0x00000000" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00618891", "parentcaller": "0x00618eca", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00618b09", "parentcaller": "0x00618eca", "category": "filesystem", "api": "CreateDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-06-30 22:35:12,319", "thread_id": "4684", "caller": "0x00614a5d", "parentcaller": "0x00620232", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x14\\xfeU\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-06-30 22:35:12,335", "thread_id": "4684", "caller": "0x006149a6", "parentcaller": "0x006148f5", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000258" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-06-30 22:35:12,335", "thread_id": "4684", "caller": "0x00573c85", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7eaf0000" }, { "name": "RegionSize", "value": "0x00430000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-06-30 22:35:12,335", "thread_id": "4684", "caller": "0x00614a20", "parentcaller": "0x006202be", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "Buffer", "value": "\\x284Od" }, { "name": "Length", "value": "9" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-06-30 22:35:12,335", "thread_id": "4684", "caller": "0x006149c6", "parentcaller": "0x006202be", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1d\\xfeU\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 199 }, { "timestamp": "2026-06-30 22:35:12,335", "thread_id": "4684", "caller": "0x006149ec", "parentcaller": "0x006202be", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xa0j\\x00\\x00\\x00\\x00\\x00\\xc8\\x98j\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-06-30 22:35:12,335", "thread_id": "4684", "caller": "0x00614a20", "parentcaller": "0x00cffc68", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "Buffer", "value": "\\xfeg\\x07i" }, { "name": "Length", "value": "4100" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-06-30 22:35:12,335", "thread_id": "4684", "caller": "0x00617583", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05960000" }, { "name": "RegionSize", "value": "0x02004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-06-30 22:35:12,975", "thread_id": "4684", "caller": "0x00614a20", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "Buffer", "value": "d\\xf2{t" }, { "name": "Length", "value": "1325835" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-06-30 22:35:12,975", "thread_id": "4684", "caller": "0x006174b0", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05960000" }, { "name": "RegionSize", "value": "0x02004000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-06-30 22:35:12,975", "thread_id": "4684", "caller": "0x006149c6", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": ",Ij\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 205 }, { "timestamp": "2026-06-30 22:35:13,007", "thread_id": "4684", "caller": "0x00614a5d", "parentcaller": "0x0062037e", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000258" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x98\\xb7B\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 206 }, { "timestamp": "2026-06-30 22:35:13,007", "thread_id": "4684", "caller": "0x00614a7c", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000258" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "\\x98\\xb7B\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-06-30 22:35:13,007", "thread_id": "4684", "caller": "0x00614a7c", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000258" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "\\x98\\xb7B\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-06-30 22:35:13,007", "thread_id": "4684", "caller": "0x00614a5d", "parentcaller": "0x00620396", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000258" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-06-30 22:35:13,007", "thread_id": "4684", "caller": "0x00614aa8", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000258" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" }, { "name": "Buffer", "value": "MZP\\x00\\x02\\x00\\x00\\x00\\x04\\x00\\x0f\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00InUn\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\xba\\x10\\x00\\x0e\\x1f\\xb4\t\\xcd!\\xb8\\x01L\\xcd!\\x90\\x90This program must be run under Win32\r\n$7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "4372376" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-06-30 22:35:13,007", "thread_id": "4684", "caller": "0x00573cf8", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7eaf0000" }, { "name": "RegionSize", "value": "0x00430000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-06-30 22:35:13,007", "thread_id": "4684", "caller": "0x0061494a", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-06-30 22:35:13,007", "thread_id": "4684", "caller": "0x0061494a", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x74990000" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x74990000" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x74990000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x749c4330" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 217 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xf5\\xcf\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0>\\x9ctRn\\x00\\xa8" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000258" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000258" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSCTF.dll" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000268" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x762f0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000d3000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x763b7000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x776a9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x776a9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x763b3000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x763b3000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00R\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x00t\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00a\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00m\\x00p\\x00" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x762f0000" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\msctf" }, { "name": "BaseAddress", "value": "0x762f0000" }, { "name": "InitRoutine", "value": "0x7633dfc0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7545d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7545d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7545d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7545d000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-06-30 22:35:13,022", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\ThemeSection" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000260" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ab0000" }, { "name": "SectionOffset", "value": "0x00cfeccc" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000025c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Windows\\Theme3651770119" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000274" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\Theme4139210966" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ab0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000025c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05a20000" }, { "name": "SectionOffset", "value": "0x00cff358" }, { "name": "ViewSize", "value": "0x000e2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000274" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ab0000" }, { "name": "SectionOffset", "value": "0x00cff358" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775b2430" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775f4000" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775b06b0" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775ec1e0" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775e5220" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "MutexName", "value": "Local\\SM0:4848:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x0057fbf4", "parentcaller": "0x00620445", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-06-30 22:35:13,038", "thread_id": "4684", "caller": "0x00613033", "parentcaller": "0x006204b7", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x00f9102e", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" " } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-06-30 22:35:13,054", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000280" }, { "name": "ThreadHandle", "value": "0x0000027c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" }, { "name": "CommandLine", "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp\" /SL5=\"$601B4,5231704,895488,C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" " }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "1404" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-06-30 22:35:13,054", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Wldp" }, { "name": "DllBase", "value": "0x74d30000" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-06-30 22:35:13,054", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x74d60000" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-06-30 22:35:13,054", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SHCORE" }, { "name": "DllBase", "value": "0x774c0000" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-06-30 22:35:13,069", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 267 }, { "timestamp": "2026-06-30 22:35:13,100", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77580000" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-06-30 22:35:13,100", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\apphelp" }, { "name": "DllBase", "value": "0x748f0000" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-06-30 22:35:13,100", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77580000" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-06-30 22:35:13,100", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\apphelp.dll" }, { "name": "BaseAddress", "value": "0x748f0000" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-06-30 22:35:13,100", "thread_id": "4684", "caller": "0x00619831", "parentcaller": "0x006204d9", "category": "process", "api": "CreateProcessW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp\" /SL5=\"$601B4,5231704,895488,C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" " }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ProcessId", "value": "1404" }, { "name": "ThreadId", "value": "1644" }, { "name": "ProcessHandle", "value": "0x00000280" }, { "name": "ThreadHandle", "value": "0x0000027c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-06-30 22:35:13,100", "thread_id": "4684", "caller": "0x00619847", "parentcaller": "0x006204d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-06-30 22:35:42,522", "thread_id": "1384", "caller": "0x775eb4e6", "parentcaller": "0x773dfa30", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "1384" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-06-30 22:35:42,522", "thread_id": "1384", "caller": "0x775eb509", "parentcaller": "0x773dfa30", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-06-30 22:35:44,663", "thread_id": "4684", "caller": "0x0061987d", "parentcaller": "0x006204d9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x00619095", "parentcaller": "0x00620525", "category": "filesystem", "api": "DeleteFileW", "status": true, "return": "0x00000001", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x0062053e", "parentcaller": "0x00000000", "category": "filesystem", "api": "RemoveDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x76316815", "parentcaller": "0x76316102", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49237" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x7631683b", "parentcaller": "0x76316102", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49238" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x7725f5a5", "parentcaller": "0x749bae44", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05a20000" }, { "name": "RegionSize", "value": "0x000e2000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x7725106a", "parentcaller": "0x749bae52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x7725f5a5", "parentcaller": "0x749bae60", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ab0000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x7725106a", "parentcaller": "0x749bae6e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x0059418e", "parentcaller": "0x0057ca53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x00594197", "parentcaller": "0x0057ca53", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x00607ae1", "parentcaller": "0x00577844", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-06-30 22:35:44,725", "thread_id": "4684", "caller": "0x0058e401", "parentcaller": "0x005933c2", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 63, "id": 288 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x005752bf", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05820000" }, { "name": "RegionSize", "value": "0x00140000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x005752bf", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x053a0000" }, { "name": "RegionSize", "value": "0x00140000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00feb000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00fbb000" }, { "name": "RegionSize", "value": "0x0002e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02ae0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f0" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ec" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e4" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c4" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c8" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c0" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a8" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ac" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b0" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001bc" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76be2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76be2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a0" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a4" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000019c" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000017c" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000184" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000188" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000198" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000194" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000014c" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000150" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000148" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000144" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000140" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000012c" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000118" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000128" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000134" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000130" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000108" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000010c" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000bc" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000cc" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d0" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000d0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000d0" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d0" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000d0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000d0" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d0" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b4" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b0" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000c8" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000c4" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000088" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000008c" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000094" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-06-30 22:35:44,741", "thread_id": "4684", "caller": "0x00577cce", "parentcaller": "0x00000000", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 398 } ], "threads": [ "4684", "1384", "1408", "4592", "4716" ], "environ": { "UserName": "Rajesh", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00570000", "MainExeSize": "0x000ea000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 1404, "process_name": "uninstalltool_setup.tmp", "parent_id": 4848, "module_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp", "first_seen": "2026-06-30 22:35:13,153", "calls": [ { "timestamp": "2026-06-30 22:35:13,340", "thread_id": "1644", "caller": "0x773daaa5", "parentcaller": "0x773d9db4", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Windows\\WindowsShell.Manifest" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-06-30 22:35:13,340", "thread_id": "1644", "caller": "0x773dab14", "parentcaller": "0x773d9db4", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00000004", "pretty_value": "SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000240" }, { "name": "FileName", "value": "C:\\Windows\\WindowsShell.Manifest" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-06-30 22:35:13,340", "thread_id": "1644", "caller": "0x773dab4a", "parentcaller": "0x773d9db4", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000023c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047c0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-06-30 22:35:13,340", "thread_id": "1644", "caller": "0x773daebc", "parentcaller": "0x773dada2", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-06-30 22:35:13,340", "thread_id": "1644", "caller": "0x773daeee", "parentcaller": "0x773dada2", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000234" }, { "name": "ValueName", "value": "PreferExternalManifest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-06-30 22:35:13,340", "thread_id": "1644", "caller": "0x773daf11", "parentcaller": "0x773dada2", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-06-30 22:35:13,340", "thread_id": "1644", "caller": "0x773db11a", "parentcaller": "0x773dae1f", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "HandleName", "value": "C:\\Windows\\WindowsShell.Manifest" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-06-30 22:35:13,340", "thread_id": "1644", "caller": "0x773db11a", "parentcaller": "0x773dae1f", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "1644" }, { "name": "Module", "value": "KERNEL32.DLL" }, { "name": "Return Address", "value": "0x773e24ac" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x773dad65", "parentcaller": "0x773d9db4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x773dad6f", "parentcaller": "0x773d9db4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x773dad7b", "parentcaller": "0x773d9db4", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x773db9a2", "parentcaller": "0x773db783", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "ThemePropScrollBarCtl" }, { "name": "Atom", "value": "0x0000c01b" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x773db9a2", "parentcaller": "0x773db783", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MicrosoftTabletPenServiceProperty" }, { "name": "Atom", "value": "0x0000c01c" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x74736cbd", "parentcaller": "0x74746869", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001022" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x7724f11f", "parentcaller": "0x74736c84", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "LPK" }, { "name": "ModuleHandle", "value": "0x0049414e" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x7724f11f", "parentcaller": "0x74736c93", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "GDI32" }, { "name": "ModuleHandle", "value": "0x75470000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x7725800a", "parentcaller": "0x74736ca3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x75470000" }, { "name": "FunctionName", "value": "LpkEditControl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7548d440" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x7725800a", "parentcaller": "0x74736ca3", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\\comctl32" }, { "name": "BaseAddress", "value": "0x746c0000" }, { "name": "InitRoutine", "value": "0x747454e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x76eea6d8", "parentcaller": "0x76ef28fd", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\comdlg32" }, { "name": "BaseAddress", "value": "0x76eb0000" }, { "name": "InitRoutine", "value": "0x76ef27c0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 19 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1644", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "3792", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "3792", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "3768", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 23 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "3768", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "3612", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "3612", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1636", "caller": "0x775e6416", "parentcaller": "0x775e6321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 27 }, { "timestamp": "2026-06-30 22:35:13,356", "thread_id": "1636", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dd1b07", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dd1b0d", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "wine_get_version" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dc7403", "parentcaller": "0x00dca26c", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dc7286", "parentcaller": "0x00dc744a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dc728c", "parentcaller": "0x00dc744a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetLogicalProcessorInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d91c0" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dd225e", "parentcaller": "0x00dc54b6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x773c0000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dd235d", "parentcaller": "0x00dc54b6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetLogicalProcessorInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d91c0" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e03c", "parentcaller": "0x00dca26c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xef\\xc6\\x0e\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e03c", "parentcaller": "0x00dca26c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e03c", "parentcaller": "0x00dca26c", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e03c", "parentcaller": "0x00dca26c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e03c", "parentcaller": "0x00dca26c", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e03c", "parentcaller": "0x00dca26c", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e03c", "parentcaller": "0x00dca26c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dceff3", "parentcaller": "0x00dca26c", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dceff9", "parentcaller": "0x00dca26c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetThreadPreferredUILanguages" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773e0760" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf00d", "parentcaller": "0x00dca26c", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf013", "parentcaller": "0x00dca26c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SetThreadPreferredUILanguages" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773e0bb0" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf027", "parentcaller": "0x00dca26c", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf02d", "parentcaller": "0x00dca26c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetThreadUILanguage" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d7530" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dd18a5", "parentcaller": "0x00dca26c", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 49 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e0a1", "parentcaller": "0x00dca26c", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x012b1cea", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp\" /SL5=\"$601B4,5231704,895488,C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" " } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e124", "parentcaller": "0x00dca2d8", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e131", "parentcaller": "0x00dca2d8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SetDefaultDllDirectories" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x772f06a0" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e147", "parentcaller": "0x00dca2d8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SetSearchPathMode" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773f2450" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e15d", "parentcaller": "0x00dca2d8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SetProcessDEPPolicy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d8920" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e165", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtSetInformationProcess", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "ProcessInformationClass", "value": "34", "pretty_value": "ProcessExecuteFlags" }, { "name": "ProcessInformation", "value": "9" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dc5750", "parentcaller": "0x00dced38", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04940000" }, { "name": "RegionSize", "value": "0x00140000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf925", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Embarcadero\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Embarcadero\\Locales" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf947", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Embarcadero\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Embarcadero\\Locales" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf965", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\CodeGear\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\CodeGear\\Locales" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf983", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\CodeGear\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\CodeGear\\Locales" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf9a1", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Borland\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Borland\\Locales" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf9bf", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Borland\\Delphi\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcfcb4", "parentcaller": "0x00dcfd80", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.en-US" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcfcb4", "parentcaller": "0x00dcfd80", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.en" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcfcb4", "parentcaller": "0x00dcfe34", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.ENU" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcfcb4", "parentcaller": "0x00dcfe62", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.EN" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e271", "parentcaller": "0x00dca26c", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dd225e", "parentcaller": "0x00dd5a52", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x773c0000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dd235d", "parentcaller": "0x00dd5a52", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetNativeSystemInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773e1eb0" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e32f", "parentcaller": "0x00dca26c", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x0000023c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e35d", "parentcaller": "0x00dca26c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" }, { "name": "ValueName", "value": "CurrentMajorVersionNumber" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e381", "parentcaller": "0x00dca26c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" }, { "name": "ValueName", "value": "CurrentMajorVersionNumber" }, { "name": "Data", "value": "10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e3a3", "parentcaller": "0x00dca26c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" }, { "name": "ValueName", "value": "CurrentMinorVersionNumber" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMinorVersionNumber" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e4dd", "parentcaller": "0x00dca26c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" }, { "name": "ValueName", "value": "CurrentBuild" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e533", "parentcaller": "0x00dca26c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" }, { "name": "ValueName", "value": "CurrentBuild" }, { "name": "Data", "value": "19044" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x0112e5e2", "parentcaller": "0x00dca26c", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df37e4", "parentcaller": "0x0112e62c", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf925", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Embarcadero\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Embarcadero\\Locales" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf947", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Embarcadero\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Embarcadero\\Locales" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf965", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\CodeGear\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\CodeGear\\Locales" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf983", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\CodeGear\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\CodeGear\\Locales" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf9a1", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Borland\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Borland\\Locales" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dcf9bf", "parentcaller": "0x00dcfbe4", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Borland\\Delphi\\Locales" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00deef7f", "parentcaller": "0x00dca26c", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00deef85", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "CompareStringOrdinal" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d6210" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dc9226", "parentcaller": "0x00dc933a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dc922c", "parentcaller": "0x00dc933a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "GetLogicalProcessorInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d91c0" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dec95c", "parentcaller": "0x00deb998", "category": "misc", "api": "EnumCalendarInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "CalInfoEnumProc", "value": "0x00dec708" }, { "name": "Locale", "value": "0x00000409" }, { "name": "Calendar", "value": "0x00000002" }, { "name": "CalType", "value": "0x00000004" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00dec998", "parentcaller": "0x00deb998", "category": "misc", "api": "EnumCalendarInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "CalInfoEnumProc", "value": "0x00dec7b0" }, { "name": "Locale", "value": "0x00000409" }, { "name": "Calendar", "value": "0x00000002" }, { "name": "CalType", "value": "0x00000003" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000b0" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x773c0000" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773de880" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x773d97e0" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000023c" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000240" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04a80000" }, { "name": "SectionOffset", "value": "0x00b5f2d4" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df1a5d", "parentcaller": "0x00def14f", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df444a", "parentcaller": "0x0112ea82", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df445d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VariantChangeTypeEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e2d430" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df4473", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarNeg" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e72220" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df4489", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarNot" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e734a0" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df449f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarAdd" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e4a520" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df44b5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarSub" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e4b6b0" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df44cb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarMul" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e4ade0" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df44e1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarDiv" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e72740" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df44f7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarIdiv" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e730e0" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df450d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarMod" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e73340" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df4523", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarAnd" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e40870" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df4539", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarOr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e73550" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df454f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarXor" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e736f0" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df4565", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarCmp" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e24830" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df457b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarI4FromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e2a8b0" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df4591", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarR4FromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e40510" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-06-30 22:35:13,403", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df45a7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarR8FromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e27180" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df45bd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarDateFromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e3dd50" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df45d3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarCyFromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e74b10" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df45e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarBoolFromStr" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e2a690" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df45ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarBstrFromCy" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e3d000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df4615", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarBstrFromDate" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e3db30" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00df442e", "parentcaller": "0x00df462b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" }, { "name": "FunctionName", "value": "VarBstrFromBool" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76e40cc0" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00e00a1e", "parentcaller": "0x0112eb2a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e9d000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00e00a1e", "parentcaller": "0x0112eb2a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76e9d000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00e08a07", "parentcaller": "0x00dca2d8", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x773c0000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00e08a14", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "InitializeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775e4d50" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00e08a57", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "WakeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775f1bd0" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00e08a67", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "WakeAllConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775ea4b0" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00e08a77", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x773c0000" }, { "name": "FunctionName", "value": "SleepConditionVariableCS" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x772f3860" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlGetSystemTimeAndBias" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77606f90" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\tzres.dll" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000027c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\tzres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000280" }, { "name": "DesiredAccess", "value": "0x00000005", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000027c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\tzres.dll" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000280" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047c0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\StateSeparation\\RedirectionMap\\Keys" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\StateSeparation\\RedirectionMap\\Keys" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000027c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000280" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000027c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000280" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047e0000" }, { "name": "SectionOffset", "value": "0x00b5e4b8" }, { "name": "ViewSize", "value": "0x0000b000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047e0000" }, { "name": "RegionSize", "value": "0x0000b000" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047c0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\tzres.dll" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000027c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\tzres.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000280" }, { "name": "DesiredAccess", "value": "0x00000005", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000027c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\tzres.dll" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000280" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047c0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00003000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000027c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000280" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000027c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000280" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047e0000" }, { "name": "SectionOffset", "value": "0x00b5e4b8" }, { "name": "ViewSize", "value": "0x0000b000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047e0000" }, { "name": "RegionSize", "value": "0x0000b000" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00ea2f90", "parentcaller": "0x00dca2d8", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047c0000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-06-30 22:35:13,419", "thread_id": "1644", "caller": "0x00df038a", "parentcaller": "0x00ec6018", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Msctf" }, { "name": "DllBase", "value": "0x762f0000" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00df038a", "parentcaller": "0x00ec6018", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "Msctf.dll" }, { "name": "BaseAddress", "value": "0x762f0000" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00ec6b7b", "parentcaller": "0x00dca2d8", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x76b20000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00ec6b8c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x76b20000" }, { "name": "FunctionName", "value": "CoCreateInstanceEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x756dc2b0" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00ec6b9c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x76b20000" }, { "name": "FunctionName", "value": "CoInitializeEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x756c7f20" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00ec6bac", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x76b20000" }, { "name": "FunctionName", "value": "CoAddRefServerProcess" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75742d30" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00ec6bbc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x76b20000" }, { "name": "FunctionName", "value": "CoReleaseServerProcess" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75742c70" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00ec6bcc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x76b20000" }, { "name": "FunctionName", "value": "CoResumeClassObjects" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7572b7b0" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dd5ca3", "parentcaller": "0x00ec6bdc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ole32.dll" }, { "name": "ModuleHandle", "value": "0x76b20000" }, { "name": "FunctionName", "value": "CoSuspendClassObjects" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75742c50" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00ef5b65", "parentcaller": "0x0112f6a5", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "Delphi0000057C" }, { "name": "Atom", "value": "0x0000c0c0" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00ef5bb6", "parentcaller": "0x0112f6a5", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "ControlOfs00DC00000000066C" }, { "name": "Atom", "value": "0x0000c0bf" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00df038a", "parentcaller": "0x00ef590f", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "imm32.dll" }, { "name": "BaseAddress", "value": "0x75440000" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dee7b8", "parentcaller": "0x00dee9a0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x00000280" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dee7e6", "parentcaller": "0x00dee9a0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" }, { "name": "ValueName", "value": "DisplayVersion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dee828", "parentcaller": "0x00dee9a0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" }, { "name": "ValueName", "value": "DisplayVersion" }, { "name": "Data", "value": "21H2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dee8a6", "parentcaller": "0x00dee9a0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" }, { "name": "ValueName", "value": "UBR" }, { "name": "Data", "value": "1288" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00dee8c7", "parentcaller": "0x00dee9a0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00ef5776", "parentcaller": "0x0112f6a5", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x74990000" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00ef5776", "parentcaller": "0x0112f6a5", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x74990000" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00ef580b", "parentcaller": "0x0112f6a5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000201c" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00ef57ab", "parentcaller": "0x0112f6a5", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000068" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-06-30 22:35:13,434", "thread_id": "1644", "caller": "0x00f86d83", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75490000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f86886", "parentcaller": "0x00ef5c00", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8750d", "parentcaller": "0x00f86985", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000001f" }, { "name": "uiParam", "value": "0x0000005c" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f87562", "parentcaller": "0x00f86985", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000029" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x0000001e" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x012d5000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002a8" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\kernel.appcore.dll" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75370000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7537c000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x776a9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x776a9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75379000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75379000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x75370000" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x5e1f6601", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x75370000" }, { "name": "InitRoutine", "value": "0x753747e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75868000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75868000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002ac" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75bb0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0005f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x776a9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x776a9000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c0a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75c0a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x75bb0000" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-06-30 22:35:13,450", "thread_id": "1644", "caller": "0x00f8828a", "parentcaller": "0x00ef5c20", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000002b8" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "h\\x88\\x8bp\tv}\\xce\\x85\\xb6\\xfa\\xa1\\xe2\\xfe\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\x00\\x00p\\x05\\x00\\x00\\x00\\x00\\x10\\xffedo\\x05/\\xffde\\xffa7t\\xffe8\\xfff7o\\x054\\xff82tu\\xffd8\\xffbc\\xffc9tY\\x19ou\\xff88\\xffedo\\x05\\xffa6\\xffe4\\xffa7t\\xffd8%\\xffc7ty\\xff8a^?\\xffb0\\xffe8o\\x05\\xffd8\\xffbc\\xffc9t\\xffe8\\xfff7o\\x05\\x10\\xfff4\\xffbct\\xff89\\xff80\\xfff9N\\xfffe\\xffff\\xffff\\xffff\\xffd4\\xffedo\\x05\\xffdfj\\xffa9t\\x18\\x00\\x00\\x00\\xffa8\\xffac\\xffc7t\\xffa0\\xffb2\\xffc7t\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff99\\xffb2\\xffc7t\\xffbc\\xffb1\\xffc7t\\x10\\xff80/\\x01\\xffd8h\\xffc7t\\x19\\x01\\x02\\x00d\\xffb2\\xffc7tt\\x04\\x00\\x00L\\xffb2\\xffc7t(\\xffeeo\\x05}\\xffc0\\xffc5\\x1e\\xffd0`/\\x01t\\x04\\x00\\x00\\x10\\xff80/\\x01\\x10\\xff80\\x00\\x00\\xffb0\\xffedo\\x05\\xffd0`/\\x01\\xffe8\\xfff7o\\x05@\\xffad_w\t\\xffe8\\xffc2l\\xfffe\\xffff\\xffff\\xffff\\x0c\\xffeeo\\x05;\\xff82tu\\x00\\x00\\x00\\x00t\\x04\\x00\\x00\\xfff0\\x170\\x01\\x18\\x00\\x00\\x00t\\x04\\x00\\x00(\\xffeeo\\x05@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0btu@\\xffeeo\\x05Y\\x19ou\\x19\\x01\\x02\\x00\\x10\\xff80/\\x01\\x00ctu\\x08\\xff80/\\x01\\xffd8\\x160\\x01$\\x00&\\x00\\xffe8`/\\x01\\\\xffeeo\\x05@\\xffa0nu\\x00Buu\\xffe8\\x170\\x01T\\xffeeo\\x05\\x1cctu" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Server" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245d04", "parentcaller": "0x77245885", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000047c" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x772459d1", "parentcaller": "0x7724583c", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 684 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245d04", "parentcaller": "0x77245885", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000f4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x75748234", "parentcaller": "0x756f1959", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000474" }, { "name": "ObjectAttributesName", "value": "Server" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x757417d7", "parentcaller": "0x756f1999", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x75741887", "parentcaller": "0x75741832", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd9-\\x018\\x100\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\xffcc\\x01\\x7f\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\xffdc\n\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\xffd8\n\\x7f\\x00H\\xffeao\\x05\\xffbc\\xffe9o\\x05\\xffde]\\wD,/\\x01\\xffde]\\w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00(]/\\x01(]/\\x01\\xff90\\x150\\x01(]/\\x01\\xffad[}uH\\xffebo\\x05\\xff93\\x0cou\\xffa8|/\\x01`\tou0,/\\x01\\xfff4\\x0cou4\\xffeao\\x05\\xffda6\\xffb0t0,/\\x010\\xffeao\\x05\\xff84\\x00\\xffa8t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009\\xff8d^?4\\xff82tu\\x00\\x00\\x00\\x00Y\\x19ou9\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\x00\\x00p\\x05\\x00\\x00\\x00\\x00\\xfff8\\xffe9o\\x05/\\xffde\\xffa7t\\xffe8\\xfff7o\\x054\\xff82tu\\xffd8\\xffbc\\xffc9tY\\x19oup\\xffeao\\x05\\xffa6\\xffe4\\xffa7t\\xffd8%\\xffc7tQ\\xff8d^?\\xff98\\xffe5o\\x05\\xffd8\\xffbc\\xffc9t\\xffe8\\xfff7o\\x05\\x10\\xfff4\\xffbct\\xff89\\xff80\\xfff9N\\xfffe\\xffff\\xffff\\xffff\\xffbc\\xffeao\\x05\\xffdfj\\xffa9t\\x18\\x00\\x00\\x00\\xffa8\\xffac\\xffc7t\\xffa0\\xffb2\\xffc7t\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff99\\xffb2\\xffc7t\\xffbc\\xffb1\\xffc7t\\xffb0|/\\x01\\xffd8h\\xffc7t\\x19\\x01\\x02\\x00d\\xffb2\\xffc7tt\\x04\\x00\\x00L\\xffb2\\xffc7t\\x10\\xffebo\\x05e\\xffc7\\xffc5\\x1e({/\\x01t\\x04\\x00\\x00\\xffb0|/\\x01\\xffb0|\\x00\\x00\\xff98\\xffeao\\x05({/\\x01\\xffe8\\xfff7o\\x05@\\xffad_w\t\\xffe8\\xffc2l\\xfffe\\xffff\\xffff\\xffff\\xfff4\\xffeao\\x05;\\xff82tu\\x00\\x00\\x00\\x00t\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00t\\x04\\x00\\x00\\x10\\xffebo\\x05@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\xffebo\\x05(\\xffebo\\x05Y\\x19ou\\x19\\x01\\x02\\x00\\xffb0|/\\x01\\x00ctu\\xffa8|/\\x01\\xff98\\x150\\x01\\x0c\\x00\\x0e\\x00@{/\\x01xCbu(\\xff80.\\x01\\xffd0\\x17ou\\x0c\\x18\\xff86u<\\xffebo\\x05\\x1cctu" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-06-30 22:35:13,840", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 1, "id": 692 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724561e", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "Identity" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000484" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245d04", "parentcaller": "0x77245885", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000484" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756eb908", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000484" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756eb908", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775c0787", "parentcaller": "0x775c048f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x01318000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725fd84", "parentcaller": "0x7626a7ea", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000488" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775c0787", "parentcaller": "0x775c048f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x01319000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7625b942", "parentcaller": "0x7625b8d6", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 706 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724f11f", "parentcaller": "0x756d7b2e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756d7b40", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x756d1580" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756d7b51", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75705790" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756d7b62", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75704230" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756d7b73", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x756d8970" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775c0787", "parentcaller": "0x775c048f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0131b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725fd84", "parentcaller": "0x757125c3", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000490" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7726b09e", "parentcaller": "0x7725491b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05710000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724fb07", "parentcaller": "0x7726bec1", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77254155", "parentcaller": "0x772544d3", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 716 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x772540c6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7726b09e", "parentcaller": "0x77254234", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05720000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77254290", "parentcaller": "0x77254270", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x75749b35", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75705790" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x75749b53", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75704230" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x75749b71", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7568b600" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x75749b8b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75726660" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x75749ba5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75726b20" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x75749bbf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x756fc970" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x75749bd9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x75620000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x756d8970" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x757499e4", "parentcaller": "0x775b101f", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x757049c7", "parentcaller": "0x7570d2e3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000035e" }, { "name": "ObjectAttributesName", "value": "Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xd7o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xd7|\\xd7p\\xd7\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x18\\xdao\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x18\\xd7o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xa4\\xd7T\\xd7H\\xd7\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf0\\xd9o\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756cfd35", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049e" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756cfd41", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000346" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xcbo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00L\\xcc\\xfc\\xcb\\xf0\\xcb\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x98\\xceo\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x756bcbd0", "parentcaller": "0x756bcb80", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 1, "id": 754 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa8\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xcb\\xe4\\xca\\xd8\\xca\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x80\\xcdo\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xcb\\xbc\\xca\\xb0\\xca\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02X\\xcdo\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xcb\\xbc\\xca\\xb0\\xca\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02X\\xcdo\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xcbo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x9c\\xcbL\\xcb@\\xcb\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xe8\\xcdo\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xcad\\xcaX\\xca\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xcdo\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xca\\x8c\\xca\\x80\\xca\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02(\\xcdo\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xca\\x8c\\xca\\x80\\xca\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02(\\xcdo\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x08\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x94\\xcaD\\xca8\\xca\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xe0\\xcco\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756bd74c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049e" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa8\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xcb\\xe4\\xca\\xd8\\xca\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x80\\xcdo\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa8\\xcao\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xcb\\xe4\\xca\\xd8\\xca\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x80\\xcdo\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756bc97c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 806 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000346" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "h\\xc7o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xf4\\xc7\\xa4\\xc7\\x98\\xc7\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00@\\xcao\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x756bcbd0", "parentcaller": "0x756bcb80", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 1, "id": 817 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xc6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xc6\\x8c\\xc6\\x80\\xc6\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02(\\xc9o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xc6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xc6d\\xc6X\\xc6\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xc9o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xc6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xc6d\\xc6X\\xc6\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xc9o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xc6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xc7\\xf4\\xc6\\xe8\\xc6\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x90\\xc9o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xc5o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xc6\\x0c\\xc6\\x00\\xc6\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xc8o\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xc5o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xc64\\xc6(\\xc6\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xc8o\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xc5o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xc64\\xc6(\\xc6\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xc8o\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xc5o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00<\\xc6\\xec\\xc5\\xe0\\xc5\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x88\\xc8o\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756bd74c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049e" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xc6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xc6\\x8c\\xc6\\x80\\xc6\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00(\\xc9o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xc6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xc6\\x8c\\xc6\\x80\\xc6\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00(\\xc9o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x8c\\xc6<\\xc60\\xc6\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd8\\xc8o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xc5o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xc6\\xbc\\xc5\\xb0\\xc5\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02X\\xc8o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xc5o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xc6\\xf4\\xc5\\xe8\\xc5\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x90\\xc8o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000346" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb8\\xc6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00D\\xc7\\xf4\\xc6\\xe8\\xc6\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x90\\xc9o\\x05\\xbc^$w\\x9e\\x04\\x00\\x00" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000049e" }, { "name": "ObjectAttributesName", "value": "Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x7573cad3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049e" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756bc97c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000035e" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xd4o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00l\\xd5\\x1c\\xd5\\x10\\xd5\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xb8\\xd7o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756d17e8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 904 }, { "timestamp": "2026-06-30 22:35:13,856", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-06-30 22:35:13,872", "thread_id": "4632", "caller": "0x77250766", "parentcaller": "0x756e6163", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x743d0000" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-06-30 22:35:13,872", "thread_id": "4632", "caller": "0x77250766", "parentcaller": "0x756e6163", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\Windows.StateRepositoryPS.dll" }, { "name": "BaseAddress", "value": "0x743d0000" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-06-30 22:35:13,872", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756e6101", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x743d0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7444c840" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-06-30 22:35:13,872", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756e6113", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x743d0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-06-30 22:35:13,872", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756e6130", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x743d0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7444c820" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000035e" }, { "name": "ObjectAttributesName", "value": "Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xd7o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x8c\\xd7<\\xd70\\xd7\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd8\\xd9o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a2" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xd6o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00d\\xd7\\x14\\xd7\\x08\\xd7\\xa2\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xb0\\xd9o\\x05\\xbc^$w\\xa2\\x04\\x00\\x00" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a2" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756cfd35", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a2" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756cfd41", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x756f83c5", "parentcaller": "0x756f8242", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 927 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775d61ea", "parentcaller": "0x77269549", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775d6211", "parentcaller": "0x77269549", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7625b942", "parentcaller": "0x7625b8d6", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 930 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775e79e9", "parentcaller": "0x7625dc27", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000035e" }, { "name": "ObjectAttributesName", "value": "Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000049a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xdeo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xdf\\xbc\\xde\\xb0\\xde\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00X\\xe1o\\x05\\xbc^$w\\x9a\\x04\\x00\\x00" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000049a" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a6" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xdeo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xe4\\xde\\x94\\xde\\x88\\xde\\xa6\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x020\\xe1o\\x05\\xbc^$w\\xa6\\x04\\x00\\x00" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a6" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756cfd35", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a6" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756cfd41", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049a" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 948 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x77264eeb", "parentcaller": "0x774dd75f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00@\\x96\\x00|\\x05\\x00\\x00\\x18\\x12\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4632" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775cfe9f", "parentcaller": "0x775cfd94", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7753c000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-06-30 22:35:13,887", "thread_id": "4632", "caller": "0x775cfed4", "parentcaller": "0x775cfd94", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7753c000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-06-30 22:35:13,903", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\iertutil" }, { "name": "DllBase", "value": "0x73ff0000" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-06-30 22:35:13,919", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\srvcli" }, { "name": "DllBase", "value": "0x73fd0000" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-06-30 22:35:13,919", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\netutils" }, { "name": "DllBase", "value": "0x73fc0000" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-06-30 22:35:13,919", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\urlmon" }, { "name": "DllBase", "value": "0x74220000" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-06-30 22:35:13,919", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32.dll" }, { "name": "BaseAddress", "value": "0x763d0000" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-06-30 22:35:13,934", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CDC82860-468D-4D4E-B7E7-C298FF23AB2C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "5632B1A4-E38A-400A-928A-D4CD63230295" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-06-30 22:35:13,950", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wintypes" }, { "name": "DllBase", "value": "0x73ee0000" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-06-30 22:35:13,965", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\WinTypes.dll" }, { "name": "BaseAddress", "value": "0x73ee0000" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-06-30 22:35:13,965", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8A43ED9F-F4E6-4421-ACF9-1DAB2986820C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-06-30 22:35:13,965", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "BaseAddress", "value": "0x73ee0000" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-06-30 22:35:13,981", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x75c10000" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-06-30 22:35:14,012", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Bcp47Langs" }, { "name": "DllBase", "value": "0x73e10000" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-06-30 22:35:14,012", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\sppc" }, { "name": "DllBase", "value": "0x73da0000" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-06-30 22:35:14,012", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SLC" }, { "name": "DllBase", "value": "0x73df0000" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-06-30 22:35:14,012", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\USERENV" }, { "name": "DllBase", "value": "0x73dc0000" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-06-30 22:35:14,012", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\appresolver" }, { "name": "DllBase", "value": "0x73e60000" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-06-30 22:35:14,028", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\appresolver.dll" }, { "name": "BaseAddress", "value": "0x73e60000" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-06-30 22:35:14,028", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 970 }, { "timestamp": "2026-06-30 22:35:14,028", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "21CBC515-2DDE-4D66-8292-BA34BD25094A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-06-30 22:35:14,028", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-06-30 22:35:14,044", "thread_id": "4632", "caller": "0x775cfe9f", "parentcaller": "0x775cfd94", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7753c000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-06-30 22:35:14,044", "thread_id": "4632", "caller": "0x775cfed4", "parentcaller": "0x775cfd94", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7753c000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-06-30 22:35:14,044", "thread_id": "4632", "caller": "0x77264eeb", "parentcaller": "0x7750f035", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00@\\x96\\x00|\\x05\\x00\\x00\\x18\\x12\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4632" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-06-30 22:35:14,044", "thread_id": "4632", "caller": "0x757049c7", "parentcaller": "0x7570d2e3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77250766", "parentcaller": "0x756e6163", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x73d60000" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77250766", "parentcaller": "0x756e6163", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\OneCoreCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x73d60000" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x74f52746", "parentcaller": "0x74f52d81", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7625b942", "parentcaller": "0x7625b8d6", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 980 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775cfe9f", "parentcaller": "0x775cfd94", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x762e2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775cfed4", "parentcaller": "0x775cfd94", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x762e2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7625bd8a", "parentcaller": "0x7625b912", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 983 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775e79e9", "parentcaller": "0x7625dc27", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000035e" }, { "name": "ObjectAttributesName", "value": "Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xdfo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xec\\xdf\\x9c\\xdf\\x90\\xdf6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x008\\xe2o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000538" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\xdfo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xc4\\xdft\\xdfh\\xdf:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x10\\xe2o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32" } ], "repeated": 0, "id": 997 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756cfd35", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756cfd41", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000536" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000346" }, { "name": "ObjectAttributesName", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xd3o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00l\\xd4\\x1c\\xd4\\x10\\xd46\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb8\\xd6o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x756bcbd0", "parentcaller": "0x756bcb80", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 1, "id": 1010 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc8\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00T\\xd3\\x04\\xd3\\xf8\\xd26\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa0\\xd5o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd3\\xdc\\xd2\\xd0\\xd26\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xd5o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1021 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xd3\\xdc\\xd2\\xd0\\xd26\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xd5o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xd3o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xbc\\xd3l\\xd3`\\xd36\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x08\\xd6o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000538" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd2\\x84\\xd2x\\xd2:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xd5o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd2\\xac\\xd2\\xa0\\xd2:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xd5o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1041 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xd2\\xac\\xd2\\xa0\\xd2:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xd5o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "(\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xb4\\xd2d\\xd2X\\xd2:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\xd5o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756bd74c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc8\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00T\\xd3\\x04\\xd3\\xf8\\xd26\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xa0\\xd5o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-06-30 22:35:14,059", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1057 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc8\\xd2o\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00T\\xd3\\x04\\xd3\\xf8\\xd26\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xa0\\xd5o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1059 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756bc97c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000536" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1062 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000346" }, { "name": "ObjectAttributesName", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x88\\xcfo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x14\\xd0\\xc4\\xcf\\xb8\\xcf6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00`\\xd2o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x756bcbd0", "parentcaller": "0x756bcb80", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 1, "id": 1073 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xce\\xac\\xce\\xa0\\xce6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xd1o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xce\\x84\\xcex\\xce6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xd1o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xce\\x84\\xcex\\xce6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xd1o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00d\\xcf\\x14\\xcf\\x08\\xcf6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xb0\\xd1o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000538" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcdo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00|\\xce,\\xce \\xce:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xc8\\xd0o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x18\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xa4\\xceT\\xceH\\xce:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf0\\xd0o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x18\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xa4\\xceT\\xceH\\xce:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf0\\xd0o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xcdo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\\\xce\\x0c\\xce\\x00\\xce:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa8\\xd0o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756bd74c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xce\\xac\\xce\\xa0\\xce6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00H\\xd1o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xce\\xac\\xce\\xa0\\xce6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00H\\xd1o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xce\\\\xceP\\xce6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xf8\\xd0o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x77242213", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x77242249", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xcdo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xce\\xdc\\xcd\\xd0\\xcd6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02x\\xd0o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x77242249", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xcdo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00d\\xce\\x14\\xce\\x08\\xce6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb0\\xd0o\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000346" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1140 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000346" }, { "name": "ObjectAttributesName", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000538" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000053a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd8\\xceo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00d\\xcf\\x14\\xcf\\x08\\xcf:\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xb0\\xd1o\\x05\\xbc^$w:\\x05\\x00\\x00" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000053a" }, { "name": "ObjectAttributesName", "value": "Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x7573cad3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053a" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756bc97c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000536" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000035e" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000035e" }, { "name": "ObjectAttributesName", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724623b", "parentcaller": "0x7723ad0e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245ebc", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000536" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x775d38d9", "parentcaller": "0x77246104", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xddo\\x05\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x8c\\xdd<\\xdd0\\xdd6\\x05\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd8\\xdfo\\x05\\xbc^$w6\\x05\\x00\\x00" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245f55", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77246068", "parentcaller": "0x7723ad2b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000536" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756d17e8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000536" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1160 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x772511a9", "parentcaller": "0x77251102", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77250766", "parentcaller": "0x756e6163", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x739b0000" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77250766", "parentcaller": "0x756e6163", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x739b0000" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756e6101", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x739b0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73ccaa10" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756e6113", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x739b0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7725800a", "parentcaller": "0x756e6130", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x739b0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x73ccaa80" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x757417d7", "parentcaller": "0x756f1999", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000478" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataWriter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x75741887", "parentcaller": "0x75741832", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "KeyInformation", "value": "?\t(\\xffce}\\x07\\xffdd\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00W\\x00r\\x00i\\x00t\\x00e\\x00r\\x00\\x00\\x00\\x7f\\x00\\xffcc\\x01\\x7f\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\xffdc\n\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\xffd8\n\\x7f\\x00\\x00\\x00\\x00\\x00\\x0c\\xffebo\\x05\\xffde]\\wT5/\\x01\\xffde]\\w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff88\\x010\\x01\\xff88\\x010\\x01\\x00\\x00\\x00\\x00\\xff98\\xffeco\\x05#\\x0cou\\x02\\x00\\x00\\x00\\xff93\\x0couT\\x18\\xff86u`\tou@5/\\x01\\xfff4\\x0cou\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@5/\\x01\\x01\\x00\\x00\\x00T\\x18\\xff86u\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\tou\\xfff0\\xff86uu\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa8\\xff80.\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff88\\x010\\x01\\x00\\x00\\x00\\x008\\xfffb\\xff85u\\xffe8\t\\x7f\\x00\\xffe0\\xfff01\\x01\\xffc8Ojw\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x1b\\x00-\\x008\\xffeco\\x05\\xff8cx.\\x01 \\x00\\x00\\x00\\x08\\x00\"\\x00H\\xffeco\\x054*/\\x01@\\xffeco\\x05\\x7fb\\wy\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\x00\\x00\\x00\\x00\\xffe8\t\\x7f\\x00@\\x00\\x00\\x00\\xffd0\\x07\\x7f\\x00d\\x00\\x00\\x00\\xffac?,\\x01P\\x00\\x00\\x00\\xffd0\\x07\\x7f\\x00d\\x00\\x00\\x00xx.\\x01P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffd8-\\x01 */\\x01\\x00\\x00\\x00\\x00\\xffa8\\xff80.\\x01\\xffa8\\xff80.\\x01\\x00\\x00\\x00\\x00\\xff88\\x010\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\xffe0\\x01\\x7f\\x00\\x00\\x00\\x00\\x00D\\x00\\x00\\x00|\\x0c\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01x\\x0c\\x7f\\x00\\xffde]\\w`\\xffeco\\x05\\xffde]\\w\\xffa8\\xff80.\\x01\\xffde]\\w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff88\\x010\\x01\\xffa8\\xff80.\\x01@5/\\x01\\xff88\\x010\\x01\\xff94\\xffeco\\x05@\\xffa0nuX5/\\x01\\xffa8\\xff80.\\x010\\xff9fnu\\xffa8\\xff80.\\x01" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "Threading" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245d04", "parentcaller": "0x77245885", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000534" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-06-30 22:35:14,075", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756eb908", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000534" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-06-30 22:35:16,544", "thread_id": "4632", "caller": "0x73f51acc", "parentcaller": "0x73f3d105", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-06-30 22:35:16,544", "thread_id": "4632", "caller": "0x756f83c5", "parentcaller": "0x756f43ce", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 5, "id": 1183 }, { "timestamp": "2026-06-30 22:35:16,544", "thread_id": "4632", "caller": "0x77264eeb", "parentcaller": "0x774dd75f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00@\\x96\\x00|\\x05\\x00\\x00\\x18\\x12\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4632" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-06-30 22:35:16,559", "thread_id": "1112", "caller": "0x775c0787", "parentcaller": "0x775c048f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0132a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-06-30 22:35:16,559", "thread_id": "1112", "caller": "0x775e79e9", "parentcaller": "0x7625dc27", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-06-30 22:35:16,559", "thread_id": "2388", "caller": "0x7725fd84", "parentcaller": "0x7626a7ea", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000052c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-06-30 22:35:16,778", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\pcacli" }, { "name": "DllBase", "value": "0x73990000" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-06-30 22:35:16,778", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77580000" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-06-30 22:35:16,794", "thread_id": "1644", "caller": "0x010ace44", "parentcaller": "0x010b8934", "category": "process", "api": "ShellExecuteExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "FilePath", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" }, { "name": "Parameters", "value": "/SPAWNWND=$70216 /NOTIFYWND=$601B4 " }, { "name": "Show", "value": "1", "pretty_value": "SW_SHOWNORMAL" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "1644", "caller": "0x00de6b50", "parentcaller": "0x010ad4f0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000418" }, { "name": "DesiredAccess", "value": "0x00100020", "pretty_value": "FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "1644", "caller": "0x00de6b50", "parentcaller": "0x010ad4f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000084" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1193 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "4632", "caller": "0x77264eeb", "parentcaller": "0x7750f035", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00@\\x96\\x00|\\x05\\x00\\x00\\x18\\x12\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4632" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "4632", "caller": "0x757417d7", "parentcaller": "0x756f1999", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000478" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.FileTypeAssociation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "4632", "caller": "0x75741887", "parentcaller": "0x75741832", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00h\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00F\\x00i\\x00l\\x00e\\x00T\\x00y\\x00p\\x00e\\x00A\\x00s\\x00s\\x00o\\x00c\\x00i\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\xffd4\\xffeco\\x05\\xffde]\\w\\xffd47/\\x01\\xffde]\\w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff98\\xffe5,\\x01\\xff98\\xffe5,\\x01\\x14\\xffeeo\\x05`\\xffeeo\\x05#\\x0cou\\x02\\x00\\x00\\x00\\xff93\\x0couT\\x18\\xff86u`\tou\\xffc07/\\x01\\xfff4\\x0cou\\x00\\x00\\x00\\x00\\xffd8\\xffc90\\x01\\xffc07/\\x01\\x01\\x00\\x00\\x00T\\x18\\xff86u\\xffe4\\xffeco\\x05\\x00\\x00\\x00\\x00\\xffb0Ojw`\tou\\xfff0\\xff86uu\\xfffe\\xffff\\xffff\\xffff\\xffa8\\xffedo\\x05f\\xffc2$vh}.\\x01\\xffa15<9X\\xffc80\\x01\\x00\\x00\\x00\\x00\\xffc0\\xffedo\\x05\\xff98\\xffe5,\\x01\\x12\\x00\r\\x008\\xfffb\\xff85uT\\xffb14\\x03\\xfff0\\xffef1\\x01\\x7fb\\w\\x19\\x00\\x00\\x00 \\x00\\x00\\x00 \\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\xffeeo\\x05\\xff8cx.\\x01 \\x00\\x00\\x00\\x14\\x000\\x00\\x10\\xffeeo\\x054*/\\x01\\x08\\xffeeo\\x05\\x7fb\\wK\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xffd0\\x07\\x7f\\x00d\\x00\\x00\\x00d\\xffa12\\x01P\\x00\\x00\\x00\\xffd0\\x07\\x7f\\x00d\\x00\\x00\\x00xx.\\x01P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffd8-\\x01 */\\x01\\x00\\x00\\x00\\x00h}.\\x01h}.\\x01\\x00\\x00\\x00\\x00\\xff98\\xffe5,\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\xffe0\\x01\\x7f\\x00\\x00\\x00\\x00\\x00D\\x00\\x00\\x00|\\x0c\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01x\\x0c\\x7f\\x00\\xffde]\\w(\\xffeeo\\x05\\xffde]\\wh}.\\x01\\xffde]\\w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff98\\xffe5,\\x01h}.\\x01\\xffc07/\\x01\\xff98\\xffe5,\\x01\\\\xffeeo\\x05@\\xffa0nu\\xffd87/\\x01h}.\\x010\\xff9fnuh}.\\x01" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Server" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-06-30 22:35:41,794", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245d04", "parentcaller": "0x77245885", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000041c" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000041c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x757417d7", "parentcaller": "0x756f1999", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000480" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x75741887", "parentcaller": "0x75741832", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xff87/\\x01\\xffa0\\xffec1\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\xffcc\\x01\\x7f\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\xffdc\n\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\xffd8\n\\x7f\\x00H\\xffeao\\x05\\xffbc\\xffe9o\\x05\\xffde]\\wd9/\\x01\\xffde]\\w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffa92\\x01\\xfff0\\xffa92\\x01\\x7fp\\xffa9tH\\xffebo\\x05#\\x0cou\\x02\\x00\\x00\\x00\\xff93\\x0cou\\xff94\\x17\\xff86u`\touP9/\\x01\\xfff4\\x0cou\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P9/\\x01\\x01\\x00\\x00\\x00\\xff94\\x17\\xff86u\\x19\\x00\\x00\\x00\\x00\\x00+\\x01\\x1c\\x00\\x00\\x00`\tou\\xfff0\\xff86uu \\x00\\x00\\x00\\x17\\x00\\x13\\x00\\xffa8\\xffeao\\x05\\xffe8}.\\x01\\xffa0\\xffeao\\x05\\x7fb\\wO\\x00\\x00\\x00 \\x00\\x00\\x00\\xfff0\\xffa92\\x01\\x00\\x00+\\x018\\xfffb\\xff85u\\x00\\x00\\x00\\x00\\xff98\\xffed1\\x01\\x1c\\x00\\x00\\x00\\x08\\x03+\\x01\\x01\\x00\\x00\\x00@\\x00\\x00\\x00\\xffd0\\x07\\x7f\\x00d\\x00\\x00\\x00\\xff80\\xffdf,\\x01 \\x00\\x00\\x00\\x13\\x00+\\x00\\xfff8\\xffeao\\x054*/\\x01\\xfff0\\xffeao\\x05\\x7fb\\wi\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\x00\\x00\\x7f\\x00\\xffd8\\x01\\x7f\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\x14\\x0c\\x7f\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\xffd0\\x07\\x7f\\x00d\\x00\\x00\\x00\\xffe8}.\\x01P\\x00\\x00\\x007\\xffadnu`\\xffd8-\\x01 */\\x01\\x00\\x00\\x00\\x00\\xffe8}.\\x01\\xffe8}.\\x01\\x00\\x00\\x00\\x00\\xfff0\\xffa92\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\xffe0\\x01\\x7f\\x00\\x00\\x00\\x00\\x00D\\x00\\x00\\x00|\\x0c\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\x00~.\\x01P9/\\x01\\x0c\\xffebo\\x057\\xffadnuh9/\\x01\\x00\\x00\\x00\\x00P9/\\x01\\xffe8}.\\x01P9/\\x014\\xffebo\\x05\\x1b(nuP\\xff932\\x01xCbu\\xffe8}.\\x01\\xffd0'nuH(nu\\xffe8}.\\x01\\xffe8}.\\x01" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 1, "id": 1215 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x7724561e", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "Identity" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000548" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x77245d04", "parentcaller": "0x77245885", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000548" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756eb908", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756eb908", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x757049c7", "parentcaller": "0x7570d2e3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x756f83c5", "parentcaller": "0x756f8242", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1227 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x775d61ea", "parentcaller": "0x77269549", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "4632", "caller": "0x775d6211", "parentcaller": "0x77269549", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" } ], "repeated": 0, "id": 1229 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\urlmon.dll" }, { "name": "BaseAddress", "value": "0x74220000" } ], "repeated": 0, "id": 1230 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1231 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "API-MS-WIN-CORE-URL-L1-1-0.DLL" }, { "name": "BaseAddress", "value": "0x77140000" } ], "repeated": 0, "id": 1232 }, { "timestamp": "2026-06-30 22:35:41,809", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1233 }, { "timestamp": "2026-06-30 22:35:41,825", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CDC82860-468D-4D4E-B7E7-C298FF23AB2C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "5632B1A4-E38A-400A-928A-D4CD63230295" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1234 }, { "timestamp": "2026-06-30 22:35:41,825", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8A43ED9F-F4E6-4421-ACF9-1DAB2986820C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1235 }, { "timestamp": "2026-06-30 22:35:41,825", "thread_id": "4632", "caller": "0x77264eeb", "parentcaller": "0x774dd75f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00@\\x96\\x00|\\x05\\x00\\x00\\x18\\x12\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4632" } ], "repeated": 0, "id": 1236 }, { "timestamp": "2026-06-30 22:35:41,840", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x75c10000" } ], "repeated": 0, "id": 1237 }, { "timestamp": "2026-06-30 22:35:41,840", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B" }, { "name": "ClsContext", "value": "0x00000003", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER" }, { "name": "riid", "value": "21CBC515-2DDE-4D66-8292-BA34BD25094A" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1238 }, { "timestamp": "2026-06-30 22:35:41,840", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1239 }, { "timestamp": "2026-06-30 22:35:41,840", "thread_id": "4632", "caller": "0x77264eeb", "parentcaller": "0x7750f035", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00@\\x96\\x00|\\x05\\x00\\x00\\x18\\x12\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4632" } ], "repeated": 0, "id": 1240 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x757049c7", "parentcaller": "0x7570d2e3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1241 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x74f52746", "parentcaller": "0x74f52d81", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1242 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x757417d7", "parentcaller": "0x756f1999", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000478" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataWriter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter" } ], "repeated": 0, "id": 1243 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x75741887", "parentcaller": "0x75741832", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "KeyInformation", "value": "?\t(\\xffce}\\x07\\xffdd\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00W\\x00r\\x00i\\x00t\\x00e\\x00r\\x00\\x00\\x00\\x7f\\x00\\xffcc\\x01\\x7f\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\xffdc\n\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\xffd8\n\\x7f\\x00\\x00\\x00\\x00\\x00\\x0c\\xffebo\\x05\\xffde]\\w\\xff946/\\x01\\xffde]\\w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x020\\x01X\\x020\\x01\\x0080\\x01\\xff98\\xffeco\\x05#\\x0cou\\x02\\x00\\x00\\x00\\xff93\\x0couT\\x18\\xff86u`\tou\\xff806/\\x01\\xfff4\\x0cou\\x13\\xffdfpu@\\xffeeo\\x05\\xff806/\\x01\\x01\\x00\\x00\\x00T\\x18\\xff86u\\x10(2\\x01@\\x00\\x00\\x00\\x0080\\x01`\tou\\xfff0\\xff86uu\\x06\\x00\\x00\\x00\\xffd8\\xffa62\\x01\\xffde]\\w(\\xff84.\\x01\\x00\\x00\\x00\\x00\\x10$0\\x01Zk\\xffb6c\\x00\\x00\\x00\\x00X\\x020\\x01\\xff90\\xffe3pu8\\xfffb\\xff85u\\xfff0$1\\x01\\xffb0\\xffee1\\x01@\\xffeeo\\x05\\x08\\xffe4pu\\x10(2\\x01 \\x00\\x00\\x00\r\\x006\\x008\\xffeco\\x05\\xff8cx.\\x01 \\x00\\x00\\x00\r\\x000\\x00H\\xffeco\\x054*/\\x01@\\xffeco\\x05\\x7fb\\w\\x1d\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\xffd0\\x07\\x7f\\x00d\\x00\\x00\\x00d\\xffa12\\x01P\\x00\\x00\\x00\\xffd0\\x07\\x7f\\x00d\\x00\\x00\\x00xx.\\x01P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffd8-\\x01 */\\x01\\x00\\x00\\x00\\x00(\\xff84.\\x01(\\xff84.\\x01\\x00\\x00\\x00\\x00X\\x020\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x7f\\x00\\xffe0\\x01\\x7f\\x00\\x00\\x00\\x00\\x00D\\x00\\x00\\x00|\\x0c\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x01x\\x0c\\x7f\\x00\\xffde]\\w`\\xffeco\\x05\\xffde]\\w(\\xff84.\\x01\\xffde]\\w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x020\\x01(\\xff84.\\x01\\xff806/\\x01X\\x020\\x01\\xff94\\xffeco\\x05@\\xffa0nu\\xff986/\\x01(\\xff84.\\x010\\xff9fnu(\\xff84.\\x01" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1244 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType" } ], "repeated": 0, "id": 1245 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server" } ], "repeated": 0, "id": 1246 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath" } ], "repeated": 0, "id": 1247 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "Threading" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading" } ], "repeated": 0, "id": 1248 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel" } ], "repeated": 0, "id": 1249 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245d04", "parentcaller": "0x77245885", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000520" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes" } ], "repeated": 0, "id": 1250 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer" } ], "repeated": 0, "id": 1251 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser" } ], "repeated": 0, "id": 1252 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 1253 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 1254 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions" } ], "repeated": 0, "id": 1255 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77245453", "parentcaller": "0x77245243", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000520" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1256 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x7724696b", "parentcaller": "0x756eb908", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000520" } ], "repeated": 0, "id": 1257 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x756f83c5", "parentcaller": "0x756f43ce", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 5, "id": 1258 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "4632", "caller": "0x77264eeb", "parentcaller": "0x774dd75f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00@\\x96\\x00|\\x05\\x00\\x00\\x18\\x12\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4632" } ], "repeated": 0, "id": 1259 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000056c" }, { "name": "ThreadHandle", "value": "0x00000574" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" " }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "4056" } ], "repeated": 0, "id": 1260 }, { "timestamp": "2026-06-30 22:35:41,856", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1261 }, { "timestamp": "2026-06-30 22:35:43,309", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77580000" } ], "repeated": 0, "id": 1262 }, { "timestamp": "2026-06-30 22:35:43,325", "thread_id": "1644", "caller": "0x00ff56cd", "parentcaller": "0x010ad3c5", "category": "process", "api": "ShellExecuteExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "FilePath", "value": "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe" }, { "name": "Parameters", "value": "" }, { "name": "Show", "value": "1", "pretty_value": "SW_SHOWNORMAL" } ], "repeated": 0, "id": 1263 }, { "timestamp": "2026-06-30 22:35:44,372", "thread_id": "1644", "caller": "0x00ff535e", "parentcaller": "0x00ff56fc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000570" } ], "repeated": 0, "id": 1264 }, { "timestamp": "2026-06-30 22:35:44,372", "thread_id": "1644", "caller": "0x00de6b50", "parentcaller": "0x010ad4f0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000570" }, { "name": "DesiredAccess", "value": "0x00100020", "pretty_value": "FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 1265 }, { "timestamp": "2026-06-30 22:35:44,372", "thread_id": "1644", "caller": "0x00de6b50", "parentcaller": "0x010ad4f0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000418" } ], "repeated": 0, "id": 1266 }, { "timestamp": "2026-06-30 22:35:44,559", "thread_id": "1644", "caller": "0x010acee4", "parentcaller": "0x010b8934", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000540" } ], "repeated": 0, "id": 1267 }, { "timestamp": "2026-06-30 22:35:44,559", "thread_id": "1644", "caller": "0x00f56b9c", "parentcaller": "0x00dca625", "category": "hooking", "api": "UnhookWindowsHookEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "HookHandle", "value": "0x00130349" } ], "repeated": 0, "id": 1268 }, { "timestamp": "2026-06-30 22:35:44,559", "thread_id": "1644", "caller": "0x00f25ddc", "parentcaller": "0x00dca200", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c0be" } ], "repeated": 0, "id": 1269 }, { "timestamp": "2026-06-30 22:35:44,559", "thread_id": "1644", "caller": "0x00f885d6", "parentcaller": "0x00dca200", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1270 }, { "timestamp": "2026-06-30 22:35:44,559", "thread_id": "1644", "caller": "0x00f885d6", "parentcaller": "0x00dca200", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 1271 }, { "timestamp": "2026-06-30 22:35:44,559", "thread_id": "1644", "caller": "0x00f885d6", "parentcaller": "0x00dca200", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1272 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00f885d6", "parentcaller": "0x00dca200", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 1273 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00dd235d", "parentcaller": "0x00ec422e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x74990000" }, { "name": "FunctionName", "value": "BufferedPaintUnInit" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x749b3970" } ], "repeated": 0, "id": 1274 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00dca200", "parentcaller": "0x00dca625", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49237" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 1275 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00dca200", "parentcaller": "0x00dca625", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49238" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 1276 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00ef5ad6", "parentcaller": "0x00dca200", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c0bf" } ], "repeated": 0, "id": 1277 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00ef5aed", "parentcaller": "0x00dca200", "category": "synchronization", "api": "NtDeleteAtom", "status": true, "return": "0x00000000", "arguments": [ { "name": "Atom", "value": "0x0000c0c0" } ], "repeated": 0, "id": 1278 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00ec76b6", "parentcaller": "0x00dca625", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003a8" } ], "repeated": 0, "id": 1279 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00ec76b6", "parentcaller": "0x00dca625", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76e10000" } ], "repeated": 0, "id": 1280 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00deffa2", "parentcaller": "0x00dd0247", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 1281 }, { "timestamp": "2026-06-30 22:35:44,575", "thread_id": "1644", "caller": "0x00deffab", "parentcaller": "0x00dd0247", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 1282 }, { "timestamp": "2026-06-30 22:35:44,606", "thread_id": "1644", "caller": "0x00e7acd1", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04820000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1283 }, { "timestamp": "2026-06-30 22:35:44,606", "thread_id": "1644", "caller": "0x00e770a5", "parentcaller": "0x00dca200", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 1284 }, { "timestamp": "2026-06-30 22:35:44,606", "thread_id": "1644", "caller": "0x00de8e49", "parentcaller": "0x00dee736", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 63, "id": 1285 }, { "timestamp": "2026-06-30 22:35:44,606", "thread_id": "1644", "caller": "0x00dc6e5b", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07070000" }, { "name": "RegionSize", "value": "0x00140000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1286 }, { "timestamp": "2026-06-30 22:35:44,606", "thread_id": "1644", "caller": "0x00dc6e5b", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04940000" }, { "name": "RegionSize", "value": "0x00140000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1287 }, { "timestamp": "2026-06-30 22:35:44,606", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 1288 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000538" } ], "repeated": 0, "id": 1289 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000524" } ], "repeated": 0, "id": 1290 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 1291 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" } ], "repeated": 0, "id": 1292 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 1293 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 1294 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1295 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 1296 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1297 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1298 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 1299 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000510" } ], "repeated": 0, "id": 1300 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050c" } ], "repeated": 0, "id": 1301 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 1302 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" } ], "repeated": 0, "id": 1303 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1304 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1305 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 1306 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 1307 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1308 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1309 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 1310 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" } ], "repeated": 0, "id": 1311 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 1312 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" } ], "repeated": 0, "id": 1313 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05740000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1314 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055c" } ], "repeated": 0, "id": 1315 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1316 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1317 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" } ], "repeated": 0, "id": 1318 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000041c" } ], "repeated": 0, "id": 1319 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" } ], "repeated": 0, "id": 1320 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000550" } ], "repeated": 0, "id": 1321 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 1322 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 1323 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1324 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1325 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 1326 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" } ], "repeated": 0, "id": 1327 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 1328 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d4" } ], "repeated": 0, "id": 1329 }, { "timestamp": "2026-06-30 22:35:44,622", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 1330 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 1331 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e0" } ], "repeated": 0, "id": 1332 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 1333 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 1334 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000408" } ], "repeated": 0, "id": 1335 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 1336 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05080000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1337 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 1338 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1339 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1340 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1341 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 1342 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "NtUpdateWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775f46b0" } ], "repeated": 0, "id": 1343 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 1344 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 1345 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 1346 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 1347 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 1348 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000310" } ], "repeated": 0, "id": 1349 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1350 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 1351 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1352 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1353 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000428" } ], "repeated": 0, "id": 1354 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x051c0000" }, { "name": "RegionSize", "value": "0x00028000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1355 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 1356 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1357 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1358 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1359 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1360 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 1361 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 1362 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 1363 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 1364 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 1365 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 1366 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 1367 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 1368 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 1369 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 1370 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1371 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1372 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 1373 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 1374 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1375 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1376 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x047d0000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 1377 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 1378 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1379 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1380 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1381 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1382 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 1383 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1384 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x05060000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1385 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 1386 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x051f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1387 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 1388 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1389 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 1390 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 1391 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f0" } ], "repeated": 0, "id": 1392 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e8" } ], "repeated": 0, "id": 1393 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001cc" } ], "repeated": 0, "id": 1394 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d0" } ], "repeated": 0, "id": 1395 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c8" } ], "repeated": 0, "id": 1396 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b0" } ], "repeated": 0, "id": 1397 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" } ], "repeated": 0, "id": 1398 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 1399 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001bc" } ], "repeated": 0, "id": 1400 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c0" } ], "repeated": 0, "id": 1401 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c4" } ], "repeated": 0, "id": 1402 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76be2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1403 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76be2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1404 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a8" } ], "repeated": 0, "id": 1405 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ac" } ], "repeated": 0, "id": 1406 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a4" } ], "repeated": 0, "id": 1407 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1408 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1409 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" } ], "repeated": 0, "id": 1410 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000184" } ], "repeated": 0, "id": 1411 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 1412 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 1413 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000194" } ], "repeated": 0, "id": 1414 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000198" } ], "repeated": 0, "id": 1415 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a0" } ], "repeated": 0, "id": 1416 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000019c" } ], "repeated": 0, "id": 1417 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 1418 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 1419 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 1420 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 1421 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 1422 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 1423 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 1424 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 1425 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000150" } ], "repeated": 0, "id": 1426 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000014c" } ], "repeated": 0, "id": 1427 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000148" } ], "repeated": 0, "id": 1428 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000346" } ], "repeated": 0, "id": 1429 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 1430 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 1431 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000474" } ], "repeated": 0, "id": 1432 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000134" } ], "repeated": 0, "id": 1433 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 1434 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 1435 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 1436 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000128" } ], "repeated": 0, "id": 1437 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000012c" } ], "repeated": 0, "id": 1438 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000130" } ], "repeated": 0, "id": 1439 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000013c" } ], "repeated": 0, "id": 1440 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000138" } ], "repeated": 0, "id": 1441 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 1442 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 1443 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000118" } ], "repeated": 0, "id": 1444 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 1445 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 1446 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000fc" } ], "repeated": 0, "id": 1447 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000100" } ], "repeated": 0, "id": 1448 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000bc" } ], "repeated": 0, "id": 1449 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000c8" } ], "repeated": 0, "id": 1450 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d8" } ], "repeated": 0, "id": 1451 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 1452 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000d8" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 1453 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d8" } ], "repeated": 0, "id": 1454 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000d8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 1455 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000d8" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 1456 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d8" } ], "repeated": 0, "id": 1457 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1458 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1459 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000cc" } ], "repeated": 0, "id": 1460 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d4" } ], "repeated": 0, "id": 1461 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000c0" } ], "repeated": 0, "id": 1462 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" } ], "repeated": 0, "id": 1463 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77580000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x775df4e0" } ], "repeated": 0, "id": 1464 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 1465 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d0" } ], "repeated": 0, "id": 1466 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000088" } ], "repeated": 0, "id": 1467 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000008c" } ], "repeated": 0, "id": 1468 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000094" } ], "repeated": 0, "id": 1469 }, { "timestamp": "2026-06-30 22:35:44,637", "thread_id": "1644", "caller": "0x00dca68a", "parentcaller": "0x010bac76", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 1470 } ], "threads": [ "1644", "3792", "3768", "3612", "1636", "1112", "2388", "4628", "4632" ], "environ": { "UserName": "Rajesh", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp\" /SL5=\"$601B4,5231704,895488,C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00dc0000", "MainExeSize": "0x00452000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 764, "process_name": "svchost.exe", "parent_id": 644, "module_path": "C:\\Windows\\System32\\svchost.exe", "first_seen": "2026-06-30 22:35:14,414", "calls": [ { "timestamp": "2026-06-30 22:35:18,351", "thread_id": "852", "caller": "0x7ff82b0da030", "parentcaller": "0x7ff82b0d9d56", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ea8" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-06-30 22:35:22,351", "thread_id": "856", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82b0e32e1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\rsaenh.dll" }, { "name": "BaseAddress", "value": "0x7ff829d50000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-06-30 22:35:28,351", "thread_id": "852", "caller": "0x7ff82b0da030", "parentcaller": "0x7ff82b0d9d56", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000ea4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-06-30 22:35:36,867", "thread_id": "852", "caller": "0x7ff82b0b8e73", "parentcaller": "0x7ff82b0b63c3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000d60" }, { "name": "ThreadHandle", "value": "0x00000e6c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\DllHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140703128621308" } ], "repeated": 0, "id": 3 } ], "threads": [ "852", "856" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7be6e0000", "MainExeSize": "0x00011000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 4348, "process_name": "dllhost.exe", "parent_id": 764, "module_path": "C:\\Windows\\System32\\dllhost.exe", "first_seen": "2026-06-30 22:35:37,370", "calls": [ { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 0 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff7e3c214e0" }, { "name": "Parameter", "value": "0x8d5d5b9000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c212f2", "parentcaller": "0x7ff7e3c213bb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f48000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21349", "parentcaller": "0x7ff7e3c213dc", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff7e3c21b60" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000206" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4396" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001f4" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001f0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000001f4" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c10000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c1f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c15000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c15000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c15000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-06-30 22:35:37,542", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c15000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c15000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "5016", "caller": "0x7ff82d62ea52", "parentcaller": "0x7ff82d5e77c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 19 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f0" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c15000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7ff828c10000" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4808", "caller": "0x7ff82d62ea52", "parentcaller": "0x7ff82d5e77c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 2, "id": 24 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7ff828c10000" }, { "name": "InitRoutine", "value": "0x7ff828c13f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001f0" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000001f0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82b380000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00083000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82b3e8000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82b3e8000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82b3e8000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82b3e8000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82b3e8000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f0" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82b3e8000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7ff82b380000" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "5016", "caller": "0x7ff82d62ea52", "parentcaller": "0x7ff82d5e77c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000208" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000204" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000208" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000208" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\xa3?C\nx\\x97\\x10\\xc8}\\x8d\\x18\\x1c\\xb3\\xe6\\xc1m\\xbe3;\\xf7(\\x8402\\x89\\x15\\x848\\x0f\\x80w\\xc2\\xb0\\xe2\\xe0\\xfd\\xa2m\\x9f\\x14\\x15\\xdfz=\\x03\\x0f\\xf5\\xe3" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7ff82b380000" }, { "name": "InitRoutine", "value": "0x7ff82b3b8cc0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82d0e2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82d0e2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c21153", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f4a000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CLSIDFromOle1Class" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c5880a0" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000220" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "26" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xf7o]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x80\\xf7o]\\x8d\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x14\\xa3\\x01" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000224" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "MutexName", "value": "Local\\SM0:4348:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000234" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed5840000" }, { "name": "SectionOffset", "value": "0x8d5d6ff7c0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x00000238" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" }, { "name": "ValueName", "value": "Com+Enabled" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000238" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "clbcatq.dll" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000238" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c2a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000a9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c344000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c319000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c319000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c319000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c319000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c318000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c318000" }, { "name": "ModuleName", "value": "clbcatq.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7ff82c2a0000" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4808", "caller": "0x7ff82d62ea52", "parentcaller": "0x7ff82d5e77c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "synchronization", "api": "NtOpenEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" }, { "name": "EventName", "value": "\\KernelObjects\\MaximumCommitCondition" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-06-30 22:35:37,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq" }, { "name": "BaseAddress", "value": "0x7ff82c2a0000" }, { "name": "InitRoutine", "value": "0x7ff82c2bd990" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\__ComCatalogCache__" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000240" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed5850000" }, { "name": "SectionOffset", "value": "0x8d5d6ff510" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000246" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000246" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "LocalService" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "RunAs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "ActivateAtStorage" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x0000024a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024a" }, { "name": "ValueName", "value": "ROTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024a" }, { "name": "ValueName", "value": "AppIDFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024a" }, { "name": "ValueName", "value": "MGOTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000024a" }, { "name": "ValueName", "value": "ProcessMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024a" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "LaunchPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x00000248" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "ValueName", "value": "LegacyAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "ValueName", "value": "LegacyImpersonationLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "RemoteServerName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "SRPTrustLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "PreferredServerBitness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "LoadUserSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xf0o]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\xf0\\xf9o]\\x8d\\x00\\x00\\x00\\x90`},\\xf8\\x7f\\x00\\x00" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000248" }, { "name": "SubKey", "value": "Software\\Classes" }, { "name": "Handle", "value": "0x0000024c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\" }, { "name": "NotifyFilter", "value": "0x10000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000246" }, { "name": "ValueName", "value": "ProtectionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "992", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 124 }, { "timestamp": "2026-06-30 22:35:37,573", "thread_id": "992", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff801842e50" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-06-30 22:35:37,588", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000246" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-06-30 22:35:37,588", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-06-30 22:35:37,604", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-06-30 22:35:37,604", "thread_id": "3144", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f50000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-06-30 22:35:37,604", "thread_id": "3144", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 130 }, { "timestamp": "2026-06-30 22:35:37,604", "thread_id": "3144", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff801842a40" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-06-30 22:35:37,620", "thread_id": "5016", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 132 }, { "timestamp": "2026-06-30 22:35:37,620", "thread_id": "5016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff801842f10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-06-30 22:35:37,620", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-06-30 22:35:37,620", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f51000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-06-30 22:35:37,620", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f53000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4808", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 137 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4808", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff801843070" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\StateSeparation\\RedirectionMap\\Keys" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\StateSeparation\\RedirectionMap\\Keys" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-06-30 22:35:37,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f55000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f57000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000254" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000254" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "26" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xefo]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x90\\xefo]\\x8d\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x14\\xa3\\x01" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-06-30 22:35:37,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-06-30 22:35:37,667", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x0000025a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-06-30 22:35:37,667", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000025a" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-06-30 22:35:37,667", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000254" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "RaiseDefaultAuthnLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000025a" }, { "name": "ValueName", "value": "AccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025a" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x0000025c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000025c" }, { "name": "ValueName", "value": "DefaultAccessPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000258" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@v\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00o\\x00g\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-06-30 22:35:37,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-06-30 22:35:37,698", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00002100" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-06-30 22:35:37,698", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-06-30 22:35:37,698", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-06-30 22:35:37,698", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xf4o]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x0e+\\xf8\\x7f\\x00\\x00\n\\xd8\\x88U\\x9a\\x90\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f58000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x000010fc" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.4348" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-06-30 22:35:37,745", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f59000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-06-30 22:35:37,760", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000256" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-06-30 22:35:37,760", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000256" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000026a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-06-30 22:35:37,760", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-06-30 22:35:37,760", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026a" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-06-30 22:35:37,760", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000256" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-06-30 22:35:37,760", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Rpc\\Extensions" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "ValueName", "value": "NdrOleExtDLL" }, { "name": "Type", "value": "2", "pretty_value": "REG_EXPAND_SZ" }, { "name": "Information", "value": "combase.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "NdrOleInitializeExtension" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c5a50f0" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c508d00" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c5067a0" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c567c50" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c588bb0" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c587040" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c4fc030" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c52b8c0" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000268" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X.\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0.\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98p\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\xc6\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\\x9a\\xd6\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00p\\xeao]\\x8d\\x00\\x00\\x00h\\xeao]\\x8d\\x00\\x00\\x008\\xeao]\\x8d\\x00\\x00\\x00X\\xeao]" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xc6\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xe8o]\\x8d\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f5b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8#\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@*\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\xadU?\\xac\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00 \\x00F\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8p\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xc4\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00:\\xe9\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xd0\\xe6o]\\x8d\\x00\\x00\\x00\\xc8\\xe6o]\\x8d\\x00\\x00\\x00\\x98\\xe6o]\\x8d\\x00\\x00\\x00\\xb8\\xe6o]" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xc4\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xe4o]\\x8d\\x00\\x00\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f5d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 229 }, { "timestamp": "2026-06-30 22:35:37,776", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-06-30 22:35:37,792", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000026c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ff82c59adb0" }, { "name": "Parameter", "value": "0x27ed3f48040" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "3348" }, { "name": "ProcessId", "value": "4348" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-06-30 22:35:37,792", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000026c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ff82c59adb0" }, { "name": "Parameter", "value": "0x27ed3f48040" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "3348" }, { "name": "ProcessId", "value": "4348" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-06-30 22:35:37,792", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-06-30 22:35:37,792", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-06-30 22:35:37,792", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000026c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000280" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8$\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@*\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\xadU?\\xac\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00 \\x00F\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98s\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xc2\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\\xaa\\xd2\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00@\\xeeo]\\x8d\\x00\\x00\\x008\\xeeo]\\x8d\\x00\\x00\\x00\\x08\\xeeo]\\x8d\\x00\\x00\\x00(\\xeeo]" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xc2\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xeco]\\x8d\\x00\\x00\\x00\\x80\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X+\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`.\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00v\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8p\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h\\xc4\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00J\\xd5\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xa0\\xeao]\\x8d\\x00\\x00\\x00\\x98\\xeao]\\x8d\\x00\\x00\\x00h\\xeao]\\x8d\\x00\\x00\\x00\\x88\\xeao]" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xc4\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe8o]\\x8d\\x00\\x00\\x00\\x80\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000280" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000026c" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8!\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`.\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00v\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8p\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x08\\xc7\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\\xaa\\xd2\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00@\\xeeo]\\x8d\\x00\\x00\\x008\\xeeo]\\x8d\\x00\\x00\\x00\\x08\\xeeo]\\x8d\\x00\\x00\\x00(\\xeeo]" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xeco]\\x8d\\x00\\x00\\x00l\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8$\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@*\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\xadU?\\xac\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00 \\x00F\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8p\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xc2\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00J\\xd5\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xa0\\xeao]\\x8d\\x00\\x00\\x00\\x98\\xeao]\\x8d\\x00\\x00\\x00h\\xeao]\\x8d\\x00\\x00\\x00\\x88\\xeao]" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xc2\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe8o]\\x8d\\x00\\x00\\x00l\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000026c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000280" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X+\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@!\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00v\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8p\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "(\\xc6\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\\xaa\\xd2\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00@\\xeeo]\\x8d\\x00\\x00\\x008\\xeeo]\\x8d\\x00\\x00\\x00\\x08\\xeeo]\\x8d\\x00\\x00\\x00(\\xeeo]" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xc6\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xeco]\\x8d\\x00\\x00\\x00\\x80\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8$\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`.\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00v\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8p\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h\\xc4\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00J\\xd5\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xa0\\xeao]\\x8d\\x00\\x00\\x00\\x98\\xeao]\\x8d\\x00\\x00\\x00h\\xeao]\\x8d\\x00\\x00\\x00\\x88\\xeao]" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xc4\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe8o]\\x8d\\x00\\x00\\x00\\x80\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f5f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000280" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000026c" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X+\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`.\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00v\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "Hr\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "(\\xc6\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\\xaa\\xd2\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00@\\xeeo]\\x8d\\x00\\x00\\x008\\xeeo]\\x8d\\x00\\x00\\x00\\x08\\xeeo]\\x8d\\x00\\x00\\x00(\\xeeo]" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xc6\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xeco]\\x8d\\x00\\x00\\x00l\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8*\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00 \\x00F\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0.\\xf4\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "hs\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xc2\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00J\\xd5\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xa0\\xeao]\\x8d\\x00\\x00\\x00\\x98\\xeao]\\x8d\\x00\\x00\\x00h\\xeao]\\x8d\\x00\\x00\\x00\\x88\\xeao]" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xc2\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe8o]\\x8d\\x00\\x00\\x00l\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-06-30 22:35:38,026", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-06-30 22:35:38,104", "thread_id": "2692", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 328 }, { "timestamp": "2026-06-30 22:35:38,104", "thread_id": "2692", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff82d622ad0" }, { "name": "Parameter", "value": "0x27ed3f20b50" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-06-30 22:35:38,104", "thread_id": "2692", "caller": "0x7ff82b1001fc", "parentcaller": "0x7ff82cff4a33", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000280" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-06-30 22:35:38,104", "thread_id": "2692", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f60000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000290" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ff82c59adb0" }, { "name": "Parameter", "value": "0x27ed3f48380" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "1136" }, { "name": "ProcessId", "value": "4348" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000290", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ff82c59adb0" }, { "name": "Parameter", "value": "0x27ed3f48380" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "1136" }, { "name": "ProcessId", "value": "4348" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "3752", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 337 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "3752", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff82d622ad0" }, { "name": "Parameter", "value": "0x27ed3f20b50" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "1136", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f62000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "1136", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 340 }, { "timestamp": "2026-06-30 22:35:38,135", "thread_id": "1136", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff82c59adb0" }, { "name": "Parameter", "value": "0x27ed3f48380" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-06-30 22:35:38,151", "thread_id": "1136", "caller": "0x7ff82d617820", "parentcaller": "0x7ff82d6020f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-06-30 22:35:38,151", "thread_id": "1136", "caller": "0x7ff82d617871", "parentcaller": "0x7ff82d6020f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-06-30 22:35:38,151", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c852e57", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7ff828730000" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c852e57", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7ff828730000" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c852e57", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff828730000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c852ebb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff828737ce0" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff828737d20", "parentcaller": "0x7ff82c85308c", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 348 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82d5e67b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xed\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82d5e67ec", "parentcaller": "0x7ff82b1315f0", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0df960", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82b0df984", "parentcaller": "0x7ff82b0deb81", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002a4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82b0de5d4", "parentcaller": "0x7ff82876e309", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82b0de608", "parentcaller": "0x7ff82876e309", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-06-30 22:35:38,417", "thread_id": "1136", "caller": "0x7ff82873889c", "parentcaller": "0x7ff8287380dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82b1001fc", "parentcaller": "0x7ff82cff4a33", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002ac" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f66000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d613f6a", "parentcaller": "0x7ff82cfcf557", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82cfcf351", "parentcaller": "0x7ff82cfcd90f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82b0eb0fb", "parentcaller": "0x7ff82cfcf42f", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b4" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d608cde", "parentcaller": "0x7ff82d649b6e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636d66", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636dbb", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`Y\\xf6\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636de0", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636e2e", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88q\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636e57", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636eaf", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x08\\xc7\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636f68", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00*\\xd0\\xe8V\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xc0\\xef\\x0f^\\x8d\\x00\\x00\\x00\\xb8\\xef\\x0f^\\x8d\\x00\\x00\\x00\\x88\\xef\\x0f^\\x8d\\x00\\x00\\x00\\xa8\\xef\\x0f^" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636f9b", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc7\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xed\\x0f^\\x8d\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d608cde", "parentcaller": "0x7ff82d60953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636d66", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8V\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636dbb", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0X\\xf6\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636de0", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636e2e", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8r\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636e57", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636eaf", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xc7\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636f68", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\\xca\\xd4\\xe8V\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00 \\xec\\x0f^\\x8d\\x00\\x00\\x00\\x18\\xec\\x0f^\\x8d\\x00\\x00\\x00\\xe8\\xeb\\x0f^\\x8d\\x00\\x00\\x00\\x08\\xec\\x0f^" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d636f9b", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xc7\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xea\\x0f^\\x8d\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82cfcf4a7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82cfcf4c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "1136", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f67000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b0" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18Q\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`V\\xf6\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88q\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xc3\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00z\\xd4\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\x90\\xebo]\\x8d\\x00\\x00\\x00\\x88\\xebo]\\x8d\\x00\\x00\\x00X\\xebo]\\x8d\\x00\\x00\\x00x\\xebo]" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc3\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe9o]\\x8d\\x00\\x00\\x00\\xb0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8X\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0Y\\xf6\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8s\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\xc1\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\\x1a\\xe8\\x88U\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xf0\\xe7o]\\x8d\\x00\\x00\\x00\\xe8\\xe7o]\\x8d\\x00\\x00\\x00\\xb8\\xe7o]\\x8d\\x00\\x00\\x00\\xd8\\xe7o]" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc1\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xe5o]\\x8d\\x00\\x00\\x00\\xb0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ff82c5b8aa0" }, { "name": "Parameter", "value": "0x27ed3f4ed80" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "4740" }, { "name": "ProcessId", "value": "4348" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002b8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ff82c5b8aa0" }, { "name": "Parameter", "value": "0x27ed3f4ed80" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "4740" }, { "name": "ProcessId", "value": "4348" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 407 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" }, { "name": "Milliseconds", "value": "20000" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4740", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed59e7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4740", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 410 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4740", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff82c5b8aa0" }, { "name": "Parameter", "value": "0x27ed3f4ed80" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4740", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c5b8ab9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 412 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4740", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c5b8ab9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "Milliseconds", "value": "30000" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4740", "caller": "0x7ff82d62461e", "parentcaller": "0x7ff82bef703d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "4740" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4740", "caller": "0x7ff82d62463e", "parentcaller": "0x7ff82bef703d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-06-30 22:35:38,432", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "3752", "caller": "0x7ff82b1001fc", "parentcaller": "0x7ff82cff4a33", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002bc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c4fa750", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "+\\x91\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82c4fa6fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "4580", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 421 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c575d3f", "parentcaller": "0x7ff82c4f57c2", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x27ed3f223d8", "arguments": [ { "name": "CommandLine", "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "4580", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff82d622ad0" }, { "name": "Parameter", "value": "0x27ed3f20b50" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "4580", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f69000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c5a516f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c508d00" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c5a5199", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c5067a0" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c5a51c3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c567c50" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c5a51ed", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c588bb0" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c5a5217", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c587040" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c5a5241", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c4fc030" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c5a526b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c52b8c0" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c5a507f", "parentcaller": "0x7ff82d6138b0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c5495e4", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002d2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc0\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x00\\xc1\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c5940e1", "parentcaller": "0x7ff82c54968d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c549c65", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c549ef5", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002d2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002d6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54ac16", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c549fcf", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d6" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x90\\xbf\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x90\\xbf\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c549a80", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d2" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c58c0de", "parentcaller": "0x7ff82c58b5d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c58c116", "parentcaller": "0x7ff82c58b5d4", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "ValueName", "value": "MaxSxSHashCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c58c12f", "parentcaller": "0x7ff82c58b5d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c574528", "parentcaller": "0x7ff82c534d1b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\COM3" }, { "name": "Handle", "value": "0x000002d0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c574564", "parentcaller": "0x7ff82c534d1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "ValueName", "value": "GipActivityBypass" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c57457d", "parentcaller": "0x7ff82c534d1b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "1136", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f6c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "1136", "caller": "0x7ff82d613f6a", "parentcaller": "0x7ff82cfcf557", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-06-30 22:35:38,448", "thread_id": "1136", "caller": "0x7ff82cfcf351", "parentcaller": "0x7ff82cfcd90f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0eb0fb", "parentcaller": "0x7ff82cfcf42f", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002dc" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d608cde", "parentcaller": "0x7ff82d649b6e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636d66", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8[\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636dbb", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0R\\xf6\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636de0", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636e2e", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "hs\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636e57", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636eaf", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "h\\xc4\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636f68", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\\x9a\\xe6\\xe8V\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00p\\xda\\x0f^\\x8d\\x00\\x00\\x00h\\xda\\x0f^\\x8d\\x00\\x00\\x008\\xda\\x0f^\\x8d\\x00\\x00\\x00X\\xda\\x0f^" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636f9b", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xc4\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xd8\\x0f^\\x8d\\x00\\x00\\x00\\xdc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d608cde", "parentcaller": "0x7ff82d60953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636d66", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "xZ\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636dbb", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0P\\xf6\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636de0", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636e2e", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98s\\xf4\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636e57", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636eaf", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xc8\\xc1\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636f68", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00:\\xf9\\xe8V\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xd0\\xd6\\x0f^\\x8d\\x00\\x00\\x00\\xc8\\xd6\\x0f^\\x8d\\x00\\x00\\x00\\x98\\xd6\\x0f^\\x8d\\x00\\x00\\x00\\xb8\\xd6\\x0f^" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d636f9b", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xc1\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xd4\\x0f^\\x8d\\x00\\x00\\x00\\xdc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82cfcf4a7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82cfcf4c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "2692", "caller": "0x7ff82b12518d", "parentcaller": "0x7ff82b0e46e4", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed5870000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "2692", "caller": "0x7ff82b0e2338", "parentcaller": "0x7ff82b129215", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "2692", "caller": "0x7ff82b0e4b01", "parentcaller": "0x7ff82b0e42d1", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 498 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82b0e4cf6", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "2692", "caller": "0x7ff82b12518d", "parentcaller": "0x7ff82b0e4c2a", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed5880000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "2692", "caller": "0x7ff82b0e4cad", "parentcaller": "0x7ff82b0e4c5d", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5495e4", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xc8\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00`\\xc9\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5940e1", "parentcaller": "0x7ff82c54968d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c549c65", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c549ef5", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54ac16", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c549fcf", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xc6\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\xf0\\xc7\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xc6\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\xf0\\xc7\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c54ae1c", "parentcaller": "0x7ff82c548039", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer32" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c548085", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" }, { "name": "ValueName", "value": "AppID" }, { "name": "Data", "value": "{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5a5fb3", "parentcaller": "0x7ff82c54b4dc", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5940e1", "parentcaller": "0x7ff82c54b507", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "LocalService" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "DllSurrogate" }, { "name": "Data", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c548527", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "RunAs" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c548642", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ActivateAtStorage" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548761", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5487b5", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "ROTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548808", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "AppIDFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548858", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "MGOTFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5488ac", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "ProcessMitigationPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5488cf", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5476e8", "parentcaller": "0x7ff82c5488f3", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "LaunchPermission" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548938", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002e8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c54897a", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LegacyAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5489cd", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" }, { "name": "ValueName", "value": "LegacyImpersonationLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548a06", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548a4b", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "RemoteServerName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548af0", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "SRPTrustLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548b4f", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "PreferredServerBitness" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548bb2", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "LoadUserSettings" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c548c40", "parentcaller": "0x7ff82c54b6d5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ProtectionLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c54b72a", "parentcaller": "0x7ff82c54821a", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5a6f8c", "parentcaller": "0x7ff82c5482f0", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5a6fa9", "parentcaller": "0x7ff82c5482f0", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0e4d40", "parentcaller": "0x7ff82c5a74a9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0e4d60", "parentcaller": "0x7ff82c5a74a9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc6\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x000\\xc7\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e2" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c54b02a", "parentcaller": "0x7ff82c549e28", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c54b061", "parentcaller": "0x7ff82c549e28", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Elevation" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c54b0c5", "parentcaller": "0x7ff82c549e28", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c549a80", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c5292aa", "parentcaller": "0x7ff82c5290af", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x000002e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-06-30 22:35:38,463", "thread_id": "1136", "caller": "0x7ff82c52953c", "parentcaller": "0x7ff82c52806b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e2" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82c528090", "parentcaller": "0x7ff82c4face7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e2" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c54d475", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ff82c9e0000" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82d637be6", "parentcaller": "0x7ff82d60dde7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 580 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82d637be6", "parentcaller": "0x7ff82d60dde7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7ff815110000" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c54d475", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "BaseAddress", "value": "0x7ff815110000" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c54d475", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff815110000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c54d3d7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7ff815110000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff81512acb0" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c54d3f0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7ff815110000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff81513c6d0" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c54d410", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "ModuleHandle", "value": "0x7ff815110000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff81512c140" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82d617820", "parentcaller": "0x7ff82d6020f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff815173000" }, { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82d617871", "parentcaller": "0x7ff82d6020f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff815173000" }, { "name": "ModuleName", "value": "thumbcache.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0e2d8a", "parentcaller": "0x7ff82c4efb64", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c4efb82", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c580fc0" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c4efb9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c508d00" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c4efbbc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c5067a0" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c4efbd9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c4d0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c52b8c0" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82c5292aa", "parentcaller": "0x7ff82c5290af", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82c588313", "parentcaller": "0x7ff82c50293b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000002ea" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82c58834e", "parentcaller": "0x7ff82c50293b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82c588377", "parentcaller": "0x7ff82c50293b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ea" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82c588388", "parentcaller": "0x7ff82c50293b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82c5495e4", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xb8\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00p\\xb9\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82c5940e1", "parentcaller": "0x7ff82c54968d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c549c65", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-06-30 22:35:38,479", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c549ef5", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002f2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b111fa9", "parentcaller": "0x7ff82b0de7b6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\propsys.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 614 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54ac16", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c549fcf", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xb7\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x00\\xb8\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xb7\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x00\\xb8\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c549a80", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 630 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c5495e4", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xb5\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x000\\xb6\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c5940e1", "parentcaller": "0x7ff82c54968d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c549c65", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c549ef5", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002f2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b111fa9", "parentcaller": "0x7ff82b0de7b6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%SystemRoot%\\system32\\propsys.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 646 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54ac16", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c549fcf", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xb3\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\xc0\\xb4\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xb3\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\xc0\\xb4\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c54ae1c", "parentcaller": "0x7ff82c548039", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer32" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c548085", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002e6" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xb3\\x0f^\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\xe6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x00\\xb4\\x0f^\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002e6" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c54b02a", "parentcaller": "0x7ff82c549e28", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002f2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c54b061", "parentcaller": "0x7ff82c549e28", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002f2" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\Elevation" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c54b0c5", "parentcaller": "0x7ff82c549e28", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f2" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c549a80", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c5292aa", "parentcaller": "0x7ff82c5290af", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000252" }, { "name": "SubKey", "value": "CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" }, { "name": "Handle", "value": "0x000002e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c52953c", "parentcaller": "0x7ff82c52806b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002e6" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82c528090", "parentcaller": "0x7ff82c4face7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e6" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 676 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-06-30 22:35:38,495", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c54d475", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\propsys" }, { "name": "DllBase", "value": "0x7ff825200000" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c54d475", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x7ff825200000" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82b0dae12", "parentcaller": "0x7ff82c54d475", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff825200000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\propsys.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c54d3d7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7ff825200000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82520b820" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c54d3f0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7ff825200000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c54d410", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "propsys.dll" }, { "name": "ModuleHandle", "value": "0x7ff825200000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff825236440" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d613f6a", "parentcaller": "0x7ff82cfcf557", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82cfcf351", "parentcaller": "0x7ff82cfcd90f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002f4" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82b0eb0fb", "parentcaller": "0x7ff82cfcf42f", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002f8" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d608cde", "parentcaller": "0x7ff82d649b6e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636d66", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8O\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636dbb", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\\\xf6\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636de0", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636e2e", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "8\\xd6\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636e57", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636eaf", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xe8\\xc7\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636f68", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00j\\xf0\\xe8V\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\x80\\xcf\\x0f^\\x8d\\x00\\x00\\x00x\\xcf\\x0f^\\x8d\\x00\\x00\\x00H\\xcf\\x0f^\\x8d\\x00\\x00\\x00h\\xcf\\x0f^" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636f9b", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xc7\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xcd\\x0f^\\x8d\\x00\\x00\\x00\\xf8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d608cde", "parentcaller": "0x7ff82d60953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x94-\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636d66", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "xW\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636dbb", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0P\\xf6\\xd3~\\x02\\x00\\x00`\\x00\\x00\\x00-\\x00w\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00e\\x00-\\x00w\\x00i\\x00n\\x003\\x002\\x00k\\x00-\\x00f\\x00u\\x00l\\x00l\\x00u\\x00s\\x00e\\x00r\\x00-\\x00l\\x001\\x00-\\x001\\x00-\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636de0", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636e2e", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8\\xdb\\xf6\\xd3~\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636e57", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636eaf", "parentcaller": "0x7ff82d608d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xc3\\xf2\\xd3~\\x02\\x00\\x00\\x02\\x00\\\\x00\\x03\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x10\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x1d\\x02\\x00" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636f68", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xa1\\xa6\\x01\\xf8\\x7f\\x00\\x00\\xfbR~\\x01\\xf8\\x7f\\x00\\x00\n\\xf4\\xe8V\\x9a\\x90\\x00\\x00\\x88\\xa1\\xa2\\x01\\xf8\\x7f\\x00\\x00\\xe0\\xcb\\x0f^\\x8d\\x00\\x00\\x00\\xd8\\xcb\\x0f^\\x8d\\x00\\x00\\x00\\xa8\\xcb\\x0f^\\x8d\\x00\\x00\\x00\\xc8\\xcb\\x0f^" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82d636f9b", "parentcaller": "0x7ff82d636ec8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xc3\\xf2\\xd3~\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xdb\\x7f\\x01\\xf8\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xc9\\x0f^\\x8d\\x00\\x00\\x00\\xf8\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00~\\xed\\xf7\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\xf6\\xa2\\x01" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82cfcf4a7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82cfcf4c9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 709 }, { "timestamp": "2026-06-30 22:35:38,510", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 713 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 720 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 724 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-06-30 22:35:38,526", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 731 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 735 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 742 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-06-30 22:35:38,542", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 746 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82b1001fc", "parentcaller": "0x7ff82cff4a33", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002fc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 754 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 758 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 765 }, { "timestamp": "2026-06-30 22:35:38,557", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 769 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 776 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 780 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-06-30 22:35:38,573", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 787 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 791 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-06-30 22:35:38,588", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 798 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4580", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 802 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 809 }, { "timestamp": "2026-06-30 22:35:38,604", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 813 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 820 }, { "timestamp": "2026-06-30 22:35:38,620", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 824 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 831 }, { "timestamp": "2026-06-30 22:35:38,635", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 835 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "2692", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 842 }, { "timestamp": "2026-06-30 22:35:38,651", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "4580", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 846 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 853 }, { "timestamp": "2026-06-30 22:35:38,667", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4580", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 857 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4580", "caller": "0x7ff82b0d1a8e", "parentcaller": "0x7ff82c586a91", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4580", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 864 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82c5495e4", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000312" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc0\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x12\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x00\\xc1\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000312" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82c5940e1", "parentcaller": "0x7ff82c54968d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c549c65", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000312" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000312" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000312" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82c549ef5", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000312" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000316" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000316" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000316" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000316" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54ac16", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000316" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82c549fcf", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000316" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x12\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x90\\xbf\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000312" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x12\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x90\\xbf\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000312" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82c549a80", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000312" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-06-30 22:35:38,682", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 903 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dac4b", "parentcaller": "0x7ff82c5584fa", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c58771d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c5495e4", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000226" }, { "name": "SubKey", "value": "CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" }, { "name": "Handle", "value": "0x00000312" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xc0\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x12\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x00\\xc1\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000312" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c5940e1", "parentcaller": "0x7ff82c54968d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c549c65", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000312" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000312" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000312" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Thumbnail Cache Class Factory for Out of Proc Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c549ef5", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000312" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000316" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000316" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a17d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000316" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54a22c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000316" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\thumbcache.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0de482", "parentcaller": "0x7ff82c54ac16", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000316" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Apartment" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c549fcf", "parentcaller": "0x7ff82c549d0e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000316" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x12\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x90\\xbf\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000312" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0e0827", "parentcaller": "0x7ff82b0dfb22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dd754", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82b0dd7e0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xbe\\xef]\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\xe8#\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x12\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10'\\xa3\\x01\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x8d\\x00\\x00\\x00\\x90\\xbf\\xef]\\x8d\\x00\\x00\\x00" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dd8e8", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dfd34", "parentcaller": "0x7ff82b0dda04", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000312" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82b0dda22", "parentcaller": "0x7ff82b0dfb59", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000312" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c549a80", "parentcaller": "0x7ff82c50ae14", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000312" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "1136", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "1136", "caller": "0x7ff8151252d4", "parentcaller": "0x7ff82c58b264", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c53b8d6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "2692", "caller": "0x7ff82c506f09", "parentcaller": "0x7ff82c5872ca", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000344-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "4580", "caller": "0x7ff82c53c698", "parentcaller": "0x7ff82c5c8e25", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x00180030" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 942 }, { "timestamp": "2026-06-30 22:35:38,698", "thread_id": "4396", "caller": "0x7ff7e3c2116a", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "4348" }, { "name": "ThreadId", "value": "1136" }, { "name": "Message", "value": "1033" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82d620434", "parentcaller": "0x7ff81513c71f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0e2d8a", "parentcaller": "0x7ff815129088", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff81512731b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff81512731b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\thumbcache" }, { "name": "DllBase", "value": "0x7ff815110000" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82d620434", "parentcaller": "0x7ff82ca1550f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0e2d8a", "parentcaller": "0x7ff82c9fca48", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c9fca0b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff82c9fca0b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ff82c9e0000" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82d640cd0", "parentcaller": "0x7ff82d600391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c9e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82d640cd0", "parentcaller": "0x7ff82d600391", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff815110000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0e2d8a", "parentcaller": "0x7ff82c52b7c6", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c140000" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82d617820", "parentcaller": "0x7ff82d6020f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82d617871", "parentcaller": "0x7ff82d6020f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82c59af45", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82c4fe87e", "parentcaller": "0x7ff82c59af54", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 966 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82c59b2b4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82d62461e", "parentcaller": "0x7ff82b1283ba", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "1136" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82caa15b8", "parentcaller": "0x7ff82d5e9a1d", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 973 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4580", "caller": "0x7ff82d00c877", "parentcaller": "0x7ff82d00c7d6", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 975 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4580", "caller": "0x7ff82cfedde1", "parentcaller": "0x7ff82cfedd54", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82d01f032", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82b0da3c5", "parentcaller": "0x7ff82d01f0f8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "1136", "caller": "0x7ff82d62463e", "parentcaller": "0x7ff82b1283ba", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f4a000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 981 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed3f58000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x27ed5840000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000226" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21176", "parentcaller": "0x7ff7e3c21466", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c140000" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-06-30 22:35:43,729", "thread_id": "4396", "caller": "0x7ff7e3c21193", "parentcaller": "0x7ff7e3c21466", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 987 } ], "threads": [ "4396", "5016", "4808", "992", "3144", "2692", "3752", "1136", "4740", "4580" ], "environ": { "UserName": "Rajesh", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7e3c20000", "MainExeSize": "0x00009000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 4056, "process_name": "UninstallTool.exe", "parent_id": 1404, "module_path": "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe", "first_seen": "2026-06-30 22:35:43,350", "calls": [ { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82d63c1e7", "parentcaller": "0x7ff82d63bf7a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msimg32" }, { "name": "BaseAddress", "value": "0x7ff81c4b0000" }, { "name": "InitRoutine", "value": "0x7ff81c4b1170" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f720f5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "218" }, { "name": "FunctionAddress", "value": "0x7ff819f7fec0" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72110", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "217" }, { "name": "FunctionAddress", "value": "0x7ff819fac960" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7212d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SetDefaultPrinterW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa9070" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7214a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetDefaultPrinterW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f76260" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72167", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetPrinterDriverPackagePathW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb3d50" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72184", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "CorePrinterDriverInstalledW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb3290" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f721a1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetCorePrinterDriversW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb3920" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f721be", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "UploadPrinterDriverPackageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb43c0" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f721db", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "InstallPrinterDriverFromPackageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb4060" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f721f6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "251" }, { "name": "FunctionAddress", "value": "0x7ff819f7fe40" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72213", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPrinterConnection2W" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb2470" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72230", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "OpenPrinter2W" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f73ef0" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7224d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrinterKeyW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa0310" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7226a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrinterDataExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9fc90" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72287", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumPrinterKeyW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa1170" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f722a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumPrinterDataExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f780c0" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f722c1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetPrinterDataExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f77750" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f722de", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SetPrinterDataExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa4590" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f722fb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrinterDataW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9fe10" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72318", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumPrinterDataW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa0f30" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72335", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SpoolerPrinterEvent" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa5010" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72352", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SetPortW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa4430" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7236f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DocumentPropertySheets" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f759b0" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7238c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DevicePropertySheets" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa58c0" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f723a9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "IsValidDevmodeW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f7f610" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f723c6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "IsValidDevmodeA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f94e20" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f723e3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPortExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9d380" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72400", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrintProvidorW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9f9d0" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7241d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPrintProvidorW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9d660" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-06-30 22:35:43,600", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7243a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrintProcessorW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9f890" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72457", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeleteMonitorW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9f620" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72474", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddMonitorW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9d120" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72491", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "StartDocDlgW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9bdf0" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f724ae", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AdvancedDocumentPropertiesW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9e530" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f724cb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AdvancedDocumentPropertiesA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f91fa0" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f724e8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DocumentPropertiesW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f77900" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72505", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeviceCapabilitiesW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f7a100" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72522", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrinterIC" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa0200" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7253f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "PlayGdiScriptOnPrinterIC" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa37c0" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7255c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "CreatePrinterIC" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9f2b0" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72579", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SetJobW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa4180" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72596", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetJobW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa1850" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f725b3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumJobsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f774c0" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f725d0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPrinterW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9e0f0" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f725ed", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SetPrinterW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa48f0" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7260a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetPrinterDriverW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f78c30" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72627", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetPrinterDriverDirectoryW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa2c50" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72644", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumPrintersW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f77330" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72661", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPrinterConnectionW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb2790" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7267e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrinterConnectionW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb2830" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7269b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPrinterDriverExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9d7f0" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f726b8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPrinterDriverExA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f91d60" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f726d5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumPrinterDriversW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f71710" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f726f2", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrinterDriverW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa00c0" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7270f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrinterDriverExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9ff70" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7272c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPrintProcessorW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9d500" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72749", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumPrintProcessorsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa0d80" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72766", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetPrintProcessorDirectoryW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa2a90" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72783", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumPrintProcessorDatatypesW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa0bf0" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7279e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "207" }, { "name": "FunctionAddress", "value": "0x7ff819f9d290" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f727b9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "209" }, { "name": "FunctionAddress", "value": "0x7ff819f9f760" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f727d4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "211" }, { "name": "FunctionAddress", "value": "0x7ff819fa0900" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f727ef", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "212" }, { "name": "FunctionAddress", "value": "0x7ff819f7fac0" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7280c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SplDriverUnloadComplete" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa4fe0" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72827", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "213" }, { "name": "FunctionAddress", "value": "0x7ff819f766a0" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72842", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "214" }, { "name": "FunctionAddress", "value": "0x7ff819f7f6a0" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7285f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "OpenPrinterW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f73720" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7287c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "OpenPrinterA" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f94e60" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72899", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "ResetPrinterW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f77120" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f728b6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "StartDocPrinterW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f751d0" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f728d3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "FlushPrinter" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa13b0" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f728f0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetPrinterDataW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f745b0" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7290d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SetPrinterDataW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa4750" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7292a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddJobW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9cce0" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72947", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "ScheduleJob" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa3a70" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72964", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "WaitForPrinterChange" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa8b80" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72981", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "FindNextPrinterChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f77e10" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f7299e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "PrinterMessageBoxW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa38f0" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f729bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "ClosePrinter" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f73d10" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f729d8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddFormW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9cb10" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f729f5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeleteFormW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9f480" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72a12", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetFormW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f7b480" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72a2f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SetFormW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa3fa0" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72a4c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumFormsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f783a0" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72a69", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumPortsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa0a30" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72a86", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumMonitorsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa0740" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72aa3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "AddPortW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9d490" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72ac0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "ConfigurePortW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9e860" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72add", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePortW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f9f820" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72afa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetPrinterW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f78630" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72b17", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeletePrinterDriverPackageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb3530" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72b32", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "234" }, { "name": "FunctionAddress", "value": "0x7ff819f98b60" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72b4f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetJobNamedPropertyValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb5390" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72b6c", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "SetJobNamedProperty" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819f7b720" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72b89", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "FreePrintPropertyValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb5300" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72ba6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "DeleteJobNamedProperty" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb4da0" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72bc3", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "EnumJobNamedProperties" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb4f50" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72be0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "FreePrintNamedPropertyArray" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fb5230" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72bfd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "GetPrintOutputInfo" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff819fa2590" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72c18", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "261" }, { "name": "FunctionAddress", "value": "0x7ff819fa2fc0" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72c33", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "365" }, { "name": "FunctionAddress", "value": "0x7ff819fa3950" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72c4e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "WINSPOOL.DRV" }, { "name": "ModuleHandle", "value": "0x7ff819f70000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "368" }, { "name": "FunctionAddress", "value": "0x7ff819f87760" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff819f72c4e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\winspool.drv" }, { "name": "BaseAddress", "value": "0x7ff819f70000" }, { "name": "InitRoutine", "value": "0x7ff819f80920" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82d5e67b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xd9\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x05Y\\x00\\x00\\x00\\x00\\x00D\\xd9\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d5e67ec", "parentcaller": "0x7ff82d63f3da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d63f05e", "parentcaller": "0x7ff82d6064f9", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000200" }, { "name": "ObjectAttributesName", "value": "Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d63f06f", "parentcaller": "0x7ff82d6064f9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60f50d", "parentcaller": "0x7ff82d63f111", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MUI\\Settings" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82d5e67b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd8\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00\\xa3\\xed\\xf7\\x7f\\x00\\x00(\\xd9\\x14\\x00\\x00\\x00\\x00\\x00$\\xa0I\\x8f\\xaa\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xbc\\\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d5e67ec", "parentcaller": "0x7ff82d63f3da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60f58f", "parentcaller": "0x7ff82d63f111", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000200" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Control Panel\\Desktop" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Control Panel\\Desktop" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60f5e0", "parentcaller": "0x7ff82d63f111", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000200" }, { "name": "ObjectAttributesName", "value": "Control Panel\\Desktop\\LanguageConfiguration" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\LanguageConfiguration" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60f623", "parentcaller": "0x7ff82d63f111", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60e7f9", "parentcaller": "0x7ff82d6085bc", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MUI\\Settings" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82d5e67b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xd6\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00\\xa3\\xed\\xf7\\x7f\\x00\\x00\\xf8\\xd7\\x14\\x00\\x00\\x00\\x00\\x00\\x14\\xa3I\\x8f\\xaa\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d5e67ec", "parentcaller": "0x7ff82d63f3da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d63ee5b", "parentcaller": "0x7ff82d60e84d", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000200" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Control Panel\\Desktop" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Control Panel\\Desktop" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60e8ad", "parentcaller": "0x7ff82d6085bc", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000200" }, { "name": "ObjectAttributesName", "value": "Control Panel\\Desktop" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60f704", "parentcaller": "0x7ff82d60e8fb", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "ValueName", "value": "PreferredUILanguages" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\PreferredUILanguages" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60ea1f", "parentcaller": "0x7ff82d6085bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60ea33", "parentcaller": "0x7ff82d6085bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60e7f9", "parentcaller": "0x7ff82d6085bc", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MUI\\Settings" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d606c8b", "parentcaller": "0x7ff82d5e67b5", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xd6\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00\\xa3\\xed\\xf7\\x7f\\x00\\x00\\xf8\\xd7\\x14\\x00\\x00\\x00\\x00\\x00\\x14\\xa3I\\x8f\\xaa\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d5e67ec", "parentcaller": "0x7ff82d63f3da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60eab0", "parentcaller": "0x7ff82d6085bc", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000200" }, { "name": "ObjectAttributesName", "value": "Control Panel\\Desktop\\MuiCached" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60f704", "parentcaller": "0x7ff82d60e8fb", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "ValueName", "value": "MachinePreferredUILanguages" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachinePreferredUILanguages" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60f704", "parentcaller": "0x7ff82d60e972", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "ValueName", "value": "MachinePreferredUILanguages" }, { "name": "Type", "value": "7", "pretty_value": "REG_MULTI_SZ" }, { "name": "Information", "value": "-" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachinePreferredUILanguages" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60ea1f", "parentcaller": "0x7ff82d6085bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-06-30 22:35:43,616", "thread_id": "2620", "caller": "0x7ff82d60ea33", "parentcaller": "0x7ff82d6085bc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef48d9", "parentcaller": "0x7ff82bef3b55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x001200a9", "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE" }, { "name": "FileName", "value": "C:\\Windows\\WindowsShell.Manifest" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef4a50", "parentcaller": "0x7ff82bef3b55", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000200" }, { "name": "DesiredAccess", "value": "0x00000004", "pretty_value": "SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000022c" }, { "name": "FileName", "value": "C:\\Windows\\WindowsShell.Manifest" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef49bd", "parentcaller": "0x7ff82bef3b55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000200" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x004d0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82beee7a0", "parentcaller": "0x7ff82bef4cfd", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82beee7f0", "parentcaller": "0x7ff82bef4cfd", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000001fc" }, { "name": "ValueName", "value": "PreferExternalManifest" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82beee818", "parentcaller": "0x7ff82bef4cfd", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef51b2", "parentcaller": "0x7ff82bef4dcf", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "HandleName", "value": "C:\\Windows\\WindowsShell.Manifest" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef4c33", "parentcaller": "0x7ff82bef462e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef4c3a", "parentcaller": "0x7ff82bef462e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef462e", "parentcaller": "0x7ff82bef3b55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x004d0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef2a0e", "parentcaller": "0x7ff816593a63", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "ThemePropScrollBarCtl" }, { "name": "Atom", "value": "0x0000c01b" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82bef2a0e", "parentcaller": "0x7ff816593a7d", "category": "synchronization", "api": "NtAddAtomEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "AtomName", "value": "MicrosoftTabletPenServiceProperty" }, { "name": "Atom", "value": "0x0000c01c" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff816593bbc", "parentcaller": "0x7ff816593aed", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001022" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82b0e2d8a", "parentcaller": "0x7ff816593afb", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "LPK" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82b0e2d8a", "parentcaller": "0x7ff816593b13", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "GDI32" }, { "name": "ModuleHandle", "value": "0x7ff82d0f0000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff816593b2e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d0f0000" }, { "name": "FunctionName", "value": "LpkEditControl" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d114720" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff816593b2e", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\\comctl32" }, { "name": "BaseAddress", "value": "0x7ff816530000" }, { "name": "InitRoutine", "value": "0x7ff8165c9e80" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82874f3f4", "parentcaller": "0x7ff8287598a9", "category": "misc", "api": "HeapCreate", "status": true, "return": "0x004d0000", "arguments": [ { "name": "Options", "value": "0" }, { "name": "InitialSize", "value": "0x00000000" }, { "name": "MaximumSize", "value": "0x00000000" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-06-30 22:35:43,632", "thread_id": "2620", "caller": "0x7ff82874f3f4", "parentcaller": "0x7ff8287598a9", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\uxtheme" }, { "name": "BaseAddress", "value": "0x7ff828730000" }, { "name": "InitRoutine", "value": "0x7ff828758c00" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff81b8c677e", "parentcaller": "0x7ff81b8b4345", "category": "registry", "api": "RegNotifyChangeKeyValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\" }, { "name": "NotifyFilter", "value": "0x00000005" }, { "name": "WatchSubtree", "value": "1" }, { "name": "Asynchronous", "value": "1" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005ce000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff82d5de715", "parentcaller": "0x7ff82d5de37b", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\oledlg" }, { "name": "BaseAddress", "value": "0x7ff81b8b0000" }, { "name": "InitRoutine", "value": "0x7ff81b8d5860" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff82d63c1e7", "parentcaller": "0x7ff82d63bf7a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.1288_none_91a663c8cc864906\\GdiPlus" }, { "name": "BaseAddress", "value": "0x7ff80dc10000" }, { "name": "InitRoutine", "value": "0x7ff80dc685d0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff82b0e2d8a", "parentcaller": "0x7ff8153e9c29", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "advapi32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c090000" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff8153e9db9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c090000" }, { "name": "FunctionName", "value": "EventWrite" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d61f1a0" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff8153e9ddf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c090000" }, { "name": "FunctionName", "value": "EventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d612e70" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff82b0f0741", "parentcaller": "0x7ff8153e9e1f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c090000" }, { "name": "FunctionName", "value": "EventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d620380" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff8153e9cd5", "parentcaller": "0x7ff8153f1440", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x004f0001", "arguments": [ { "name": "lpLibFileName", "value": "OLEACCRC.DLL" }, { "name": "dwFlags", "value": "0x00000002" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-06-30 22:35:43,741", "thread_id": "2620", "caller": "0x7ff8153e9cd5", "parentcaller": "0x7ff8153f1440", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\oleacc" }, { "name": "BaseAddress", "value": "0x7ff8153e0000" }, { "name": "InitRoutine", "value": "0x7ff8153eec30" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-06-30 22:35:43,882", "thread_id": "2620", "caller": "0x7ff82d5e9aff", "parentcaller": "0x7ff82d6a3d25", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000024", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files\\Uninstall Tool\\UninstallTool.exe" }, { "name": "BaseAddress", "value": "0x140000000" }, { "name": "InitRoutine", "value": "0x1402bce24" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "2620", "caller": "0x7ff82d5e9aff", "parentcaller": "0x7ff82d6a3d25", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x000000a8", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files\\Uninstall Tool\\UninstallTool.exe" }, { "name": "BaseAddress", "value": "0x140000000" }, { "name": "InitRoutine", "value": "0x1402bcce0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "4908", "caller": "0x7ff82d62ea52", "parentcaller": "0x7ff82d5e77c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 2, "id": 161 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "2620", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 162 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "2192", "caller": "0x7ff82d62ea52", "parentcaller": "0x7ff82d5e77c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "2620", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x1402bc7ac" }, { "name": "Parameter", "value": "0x00354000" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "4476", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 165 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "4476", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff801843070" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "4908", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 167 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "4908", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff801842f10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "4688", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 169 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "4688", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff801842e50" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "2192", "caller": "0x7ff82d644f9d", "parentcaller": "0x7ff82d644b63", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 171 }, { "timestamp": "2026-06-30 22:35:44,038", "thread_id": "2192", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff801842a40" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c938f", "parentcaller": "0x1402c95b6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "BaseAddress", "value": "0x7ff82b0b0000" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c938f", "parentcaller": "0x1402c95b6", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82b0b0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-synch-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c9441", "parentcaller": "0x1402c95b6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "InitializeCriticalSectionEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b114270" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c938f", "parentcaller": "0x1402c9479", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "BaseAddress", "value": "0x7ff82b0b0000" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c938f", "parentcaller": "0x1402c9479", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82b0b0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c9441", "parentcaller": "0x1402c9479", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "FlsAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b124030" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c9441", "parentcaller": "0x1402c955a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "FlsSetValue" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b0f9720" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0b12", "parentcaller": "0x1402fd19a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000008", "pretty_value": "PAGE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f0b53", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7ff82b0b0000" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f0b53", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82b0b0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f0b53", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "FlsGetValue2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f0b53", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f0b53", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efe0b", "parentcaller": "0x1402d8e35", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005ef000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402ebe56", "parentcaller": "0x1402fd19a", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x00593640", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" " } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402ebe63", "parentcaller": "0x1402fd19a", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x0059232c", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" " } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f06df", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7ff82b0b0000" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f06df", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82b0b0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f06df", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "LCMapStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b0cbd70" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f06df", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f06df", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x1402fcc87", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005f1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efe0b", "parentcaller": "0x1402ed623", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005f2000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c3d97", "parentcaller": "0x1402ed912", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82bee0000" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c3daa", "parentcaller": "0x1402ed912", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ff82bee0000" }, { "name": "FunctionName", "value": "GetSystemTimePreciseAsFileTime" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82bf05040" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402c3dc1", "parentcaller": "0x1402ed912", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ff82bee0000" }, { "name": "FunctionName", "value": "GetTempPath2W" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402bc625", "parentcaller": "0x1402ed8da", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x1402bd884" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f0970", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7ff82bee0000" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f0970", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82bee0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f0970", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ff82bee0000" }, { "name": "FunctionName", "value": "AreFileApisANSI" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82bf00bf0" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f0970", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f0970", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f0975", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7ff82b0b0000" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f0975", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82b0b0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f0975", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "CompareStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b0d5af0" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f0975", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f0975", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f099e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "EnumSystemLocalesEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b130540" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f099e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f099e", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f09c7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7ff82b0b0000" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f09c7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82b0b0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f09c7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "GetDateFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b11f1c0" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f09c7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f09c7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f09f0", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "GetLocaleInfoEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b0cebd0" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f09f0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f09f0", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f0a19", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "GetTimeFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b126410" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f0a19", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f0a19", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f0a42", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "GetUserDefaultLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b0ed750" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f0a42", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f0a42", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f0a6b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "IsValidLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b0c9720" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f0a6b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f0a6b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f0abd", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7ff82b0b0000" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f0abd", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82b0b0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f0abd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "LCIDToLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b0c97f0" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-06-30 22:35:44,132", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f0abd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f0abd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f0ae6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "LocaleNameToLCID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b119e80" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f0ae6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f0ae6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140293554", "parentcaller": "0x140293942", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03b00000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140293554", "parentcaller": "0x140293942", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03b00000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x14027412a", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005f4000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14027ffeb", "parentcaller": "0x14027fa21", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32" }, { "name": "BaseAddress", "value": "0x7ff82c830000" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14027ffeb", "parentcaller": "0x14027fa21", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7ff828730000" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14027ffeb", "parentcaller": "0x14027fa21", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7ff82b380000" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14027ffeb", "parentcaller": "0x14027fa21", "category": "misc", "api": "GetCursorPos", "status": true, "return": "0x00000001", "arguments": [ { "name": "x", "value": "731" }, { "name": "y", "value": "17" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e052", "parentcaller": "0x14001da84", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x0059232c", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" " } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "shcore.dll" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000023c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c9e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000ad000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82ca87000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82ca62000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82ca62000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7ff82c9e0000" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 255 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005f7000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\SHCore" }, { "name": "BaseAddress", "value": "0x7ff82c9e0000" }, { "name": "InitRoutine", "value": "0x7ff82ca1b840" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82be61000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82be61000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14025e060", "parentcaller": "0x14001da84", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x005f1420", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" " }, { "name": "NumArgs", "value": "1" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14000726d", "parentcaller": "0x14002f1cd", "category": "synchronization", "api": "NtCreateEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "EventName", "value": "Global\\UninstallToolHelper_EventSent" }, { "name": "EventType", "value": "1" }, { "name": "InitialState", "value": "0" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14000728f", "parentcaller": "0x14002f1cd", "category": "synchronization", "api": "NtCreateEvent", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" }, { "name": "EventName", "value": "Global\\UninstallToolHelper_EventComplete" }, { "name": "EventType", "value": "1" }, { "name": "InitialState", "value": "0" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140116742", "parentcaller": "0x1401149ea", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a07", "parentcaller": "0x14025f01b", "category": "filesystem", "api": "GetFileVersionInfoSizeW", "status": true, "return": "0x00000734", "arguments": [ { "name": "PathName", "value": "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a30", "parentcaller": "0x14025f01b", "category": "filesystem", "api": "GetFileVersionInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "PathName", "value": "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000008c" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7ff82bee0000" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff82bee0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ff82bee0000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82beea190" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7ff82bee0000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82beffe60" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000024c" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000250" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03c00000" }, { "name": "SectionOffset", "value": "0x0014f510" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140114a53", "parentcaller": "0x14025f01b", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140116742", "parentcaller": "0x1400322ca", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files\\Uninstall Tool\\license.dat" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140043ae4", "parentcaller": "0x140043a55", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 278 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140043b1a", "parentcaller": "0x140043a55", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\CrystalIdea Software\\Uninstall Tool" }, { "name": "Handle", "value": "0x00000254" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\CrystalIdea Software\\Uninstall Tool" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x14011e731", "parentcaller": "0x140043b33", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "LastRunDate" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\CrystalIdea Software\\Uninstall Tool\\LastRunDate" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x140043b3d", "parentcaller": "0x140043a55", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "44" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x00500002", "arguments": [ { "name": "lpLibFileName", "value": "tzres.dll" }, { "name": "dwFlags", "value": "0x00000822" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\StateSeparation\\RedirectionMap\\Keys" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\StateSeparation\\RedirectionMap\\Keys" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-06-30 22:35:44,147", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000258" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000254" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00510000" }, { "name": "SectionOffset", "value": "0x0014e380" }, { "name": "ViewSize", "value": "0x0000b000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00510000" }, { "name": "RegionSize", "value": "0x0000b000" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00500000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x00500002", "arguments": [ { "name": "lpLibFileName", "value": "tzres.dll" }, { "name": "dwFlags", "value": "0x00000822" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000258" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000254" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00510000" }, { "name": "SectionOffset", "value": "0x0014e380" }, { "name": "ViewSize", "value": "0x0000b000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00510000" }, { "name": "RegionSize", "value": "0x0000b000" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402f6dd1", "parentcaller": "0x1402f6f55", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00500000" }, { "name": "RegionSize", "value": "0x00003000" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x14011e772", "parentcaller": "0x14011ef0b", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "Handle", "value": "0x00000254" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x14011e7ab", "parentcaller": "0x14011ef0b", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x14011e7bb", "parentcaller": "0x14011ef0b", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1400010a3", "parentcaller": "0x1402ed8da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82d117000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1400010a3", "parentcaller": "0x1402ed8da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82d117000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005fa000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005fc000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140273f66", "parentcaller": "0x1402b8402", "category": "misc", "api": "FindResourceExW", "status": false, "return": "0x00000000", "arguments": [ { "name": "Module", "value": "0x140000000" }, { "name": "Type", "value": "#6" }, { "name": "Name", "value": "#3585" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 1, "id": 309 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x14027fc41", "parentcaller": "0x1402b82ed", "category": "system", "api": "SetWindowsHookExW", "status": true, "return": "0x000c02f5", "arguments": [ { "name": "HookIdentifier", "value": "18446744073709551615" }, { "name": "ProcedureAddress", "value": "0x140280744" }, { "name": "ModuleAddress", "value": "0x00000000" }, { "name": "ThreadId", "value": "2620" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fa3", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000254" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fd7", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "NoRun" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fd7", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "NoDrives" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoDrives" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fd7", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "RestrictRun" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\RestrictRun" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fd7", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "NoNetConnectDisconnect" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetConnectDisconnect" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fd7", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "NoRecentDocsHistory" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRecentDocsHistory" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fd7", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "NoClose" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140282025", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fa3", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140281fa3", "parentcaller": "0x1402812b5", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "windows.storage.dll" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000258" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000254" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828e10000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00790000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff829418000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "Wldp.dll" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files\\Uninstall Tool\\Wldp.dll" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\wldp.dll" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wldp.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000258" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000254" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wldp.dll" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82a670000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0002c000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82a698000" }, { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82a689000" }, { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff829418000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82a689000" }, { "name": "ModuleName", "value": "Wldp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-06-30 22:35:44,163", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Wldp" }, { "name": "DllBase", "value": "0x7ff82a670000" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7ff828e10000" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\wldp" }, { "name": "BaseAddress", "value": "0x7ff82a670000" }, { "name": "InitRoutine", "value": "0x7ff82a672db0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "InitializeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d639e60" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "SleepConditionVariableCS" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82b11ce10" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7ff82b0b0000" }, { "name": "FunctionName", "value": "WakeAllConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d6253d0" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\windows.storage" }, { "name": "BaseAddress", "value": "0x7ff828e10000" }, { "name": "InitRoutine", "value": "0x7ff828fc8900" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82be61000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82be61000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005fe000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "DesiredAccess", "value": "0x00000006" }, { "name": "ObjectAttributes", "value": "windows_shell_global_counters" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00520000" }, { "name": "SectionOffset", "value": "0x0014efb0" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000294" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0\\xcf\\x14\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000298" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957a000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000298" }, { "name": "SubKey", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "Handle", "value": "0x0000029c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Category" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "AppData" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Name" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParentFolder" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Description" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\RelativePath" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParsingName" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InfoTip" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalizedName" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Icon" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Security" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResource" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResourceType" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalRedirectOnly" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Roamable" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PreCreate" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Stream" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PublishExpandedPath" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\DefinitionFlags" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Attributes" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\FolderTypeID" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InitFolderHandler" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82957b000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000029c" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PropertyBag" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" }, { "name": "Handle", "value": "0x0000029c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000029c" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000298" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000298" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xcb\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf7\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf7\\x7f\\x00\\x00\\xa0\\xc3\\x14\\x00\\x00\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-06-30 22:35:44,179", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000298" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000002a0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" }, { "name": "ValueName", "value": "AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xea\\xcf\\x0f\\x00\\x00\\x00\\x00\\x00\\xdb\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x88\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xec\\x1e\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000298" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000298" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 417 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000c4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000c4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 420 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000c4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000c4" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140115523", "parentcaller": "0x14001e8eb", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 423 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140116742", "parentcaller": "0x14001e9b0", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140116742", "parentcaller": "0x14003287a", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files\\Uninstall Tool\\license.dat" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00600000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402ff834", "parentcaller": "0x1402ff178", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a0" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402f9a64", "parentcaller": "0x1402dab94", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a0" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402efe0b", "parentcaller": "0x1402faa08", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00601000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402fa85f", "parentcaller": "0x1402fa556", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a0" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "Buffer", "value": "\n\n 1\n 1\n 0\n" }, { "name": "Length", "value": "2015" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402f9a64", "parentcaller": "0x1402dab94", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a0" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xdf\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402f9a64", "parentcaller": "0x1402dab94", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a0" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xdf\\x07\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 432 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402f9a64", "parentcaller": "0x1402dab94", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a0" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402fa85f", "parentcaller": "0x1402fa556", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a0" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "Buffer", "value": "\n\n 1\n 1\n 0\n" }, { "name": "Length", "value": "2015" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00603000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00604000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00605000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00606000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00607000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1402f752c", "parentcaller": "0x1402f7335", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140025001", "parentcaller": "0x140024892", "category": "filesystem", "api": "GetFileVersionInfoSizeW", "status": true, "return": "0x00000784", "arguments": [ { "name": "PathName", "value": "uxtheme.dll" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140025065", "parentcaller": "0x140024892", "category": "filesystem", "api": "GetFileVersionInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "PathName", "value": "uxtheme.dll" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024947", "parentcaller": "0x140024c68", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7ff828730000" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024947", "parentcaller": "0x140024c68", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff828730000", "arguments": [ { "name": "lpLibFileName", "value": "uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024988", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "SetPreferredAppMode" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x14002499d", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "AllowDarkModeForWindow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1400249b2", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "ShouldAppsUseDarkMode" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1400249c7", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "IsDarkModeAllowedForWindow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1400249dc", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "IsDarkModeAllowedForApp" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x1400249f1", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "ShouldSystemUseDarkMode" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024a06", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "RefreshImmersiveColorPolicyState" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024a1b", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "GetIsImmersiveColorUsingHighContrast" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024a30", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "FlushMenuThemes" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024a41", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "user32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c830000" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024a51", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c830000" }, { "name": "FunctionName", "value": "SetWindowCompositionAttribute" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82c8592a0" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024a91", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "135" }, { "name": "FunctionAddress", "value": "0x7ff828755340" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024aaa", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "133" }, { "name": "FunctionAddress", "value": "0x7ff828755210" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024ac3", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "132" }, { "name": "FunctionAddress", "value": "0x7ff828744be0" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024adc", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "137" }, { "name": "FunctionAddress", "value": "0x7ff828754ed0" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024af5", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "139" }, { "name": "FunctionAddress", "value": "0x7ff8287324e0" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024b0e", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "138" }, { "name": "FunctionAddress", "value": "0x7ff8287380f0" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-06-30 22:35:44,194", "thread_id": "2620", "caller": "0x140024b27", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "104" }, { "name": "FunctionAddress", "value": "0x7ff8287323b0" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140024b40", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "106" }, { "name": "FunctionAddress", "value": "0x7ff828738360" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140024b59", "parentcaller": "0x140024c68", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "UxTheme.dll" }, { "name": "ModuleHandle", "value": "0x7ff828730000" }, { "name": "FunctionName", "value": "" }, { "name": "Ordinal", "value": "136" }, { "name": "FunctionAddress", "value": "0x7ff828755000" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14004af0a", "parentcaller": "0x14001eac8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14004af0a", "parentcaller": "0x14001eac8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14004bd07", "parentcaller": "0x14004afba", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x0059232c", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" " } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140116742", "parentcaller": "0x14011338d", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000033", "pretty_return": "OBJECT_NAME_INVALID", "arguments": [ { "name": "FileName", "value": "C:\\Program Files\\Uninstall Tool\\\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\"" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140113428", "parentcaller": "0x14004bd13", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x005f1420", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" " }, { "name": "NumArgs", "value": "1" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x1402efd94", "parentcaller": "0x140273844", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00608000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00590000" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002b0" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c10000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c1f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c15000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff828c15000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7ff828c10000" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7ff828c10000" }, { "name": "InitRoutine", "value": "0x7ff828c13f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82d0e2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82d0e2000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x14002144c", "parentcaller": "0x14004b029", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00629000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002a8" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0062a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x000002a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002a8" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002a8" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "26" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xf1\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\xf8\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xf8\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xd0\\xf1\\x14\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x14\\xa3\\x01" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\User\\S-1-5-21-3262678163-160926255-2192883574-1002_Classes" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000029a" }, { "name": "SubKey", "value": "AppID\\UninstallTool.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\UninstallTool.exe" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "system", "api": "LdrGetProcedureAddress", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlWow64GetCurrentMachine" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d620d80" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "system", "api": "LdrGetProcedureAddress", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlWow64IsWowGuestMachineSupported" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d64c590" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000029a" }, { "name": "SubKey", "value": "AppID\\UninstallTool.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\UninstallTool.exe" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xf6\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x0e+\\xf8\\x7f\\x00\\x00\\xc4\\x83I\\x8f\\xaa\\x1d\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-06-30 22:35:44,210", "thread_id": "2620", "caller": "0x140127610", "parentcaller": "0x14004b034", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127631", "parentcaller": "0x14004b034", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7ff82c2a0000" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127631", "parentcaller": "0x14004b034", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\taskschd" }, { "name": "DllBase", "value": "0x7ff826a20000" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127631", "parentcaller": "0x14004b034", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\taskschd.dll" }, { "name": "BaseAddress", "value": "0x7ff826a20000" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127631", "parentcaller": "0x14004b034", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85" }, { "name": "ProgID", "value": "Schedule.Service.1" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826abc000" }, { "name": "ModuleName", "value": "taskschd.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826abc000" }, { "name": "ModuleName", "value": "taskschd.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P5\\x00\\x00\\x00\\x00\\x00\\xd8\\x0f\\x00\\x00\\x00\\x00\\x00\\x00<\n\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2620" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P5\\x00\\x00\\x00\\x00\\x00\\xd8\\x0f\\x00\\x00\\x00\\x00\\x00\\x00<\n\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "2620" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "misc", "api": "GetComputerNameW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ComputerName", "value": "DESKTOP-P54VDBR" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c208000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c208000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00631000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-06-30 22:35:44,225", "thread_id": "2620", "caller": "0x140127713", "parentcaller": "0x14004b034", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140126b7b", "parentcaller": "0x14004b758", "category": "misc", "api": "GetUserNameW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Name", "value": "Rajesh" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140128181", "parentcaller": "0x14004b07e", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00632000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x02207000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 2, "id": 539 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00633000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 4, "id": 541 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "XmlLite.dll" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\xmllite.dll" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002e0" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\xmllite.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002e4" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002e0" }, { "name": "FileName", "value": "C:\\Windows\\System32\\xmllite.dll" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff825410000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00036000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff825439000" }, { "name": "ModuleName", "value": "XmlLite.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff825439000" }, { "name": "ModuleName", "value": "XmlLite.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7ff825410000" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\xmllite" }, { "name": "BaseAddress", "value": "0x7ff825410000" }, { "name": "InitRoutine", "value": "0x7ff82541f5a0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826abc000" }, { "name": "ModuleName", "value": "taskschd.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826abc000" }, { "name": "ModuleName", "value": "taskschd.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00634000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00635000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 558 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00636000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 560 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826abc000" }, { "name": "ModuleName", "value": "taskschd.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826abc000" }, { "name": "ModuleName", "value": "taskschd.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826abc000" }, { "name": "ModuleName", "value": "taskschd.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826abc000" }, { "name": "ModuleName", "value": "taskschd.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00638000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 15, "id": 566 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0063a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 7, "id": 568 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0063b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-06-30 22:35:44,241", "thread_id": "2620", "caller": "0x140129817", "parentcaller": "0x14004b0fa", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 10, "id": 570 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x14012a512", "parentcaller": "0x140129786", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00540000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025e" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\taskschd" }, { "name": "DllBase", "value": "0x7ff826a20000" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7ff825410000" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff825410000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff826a20000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7ff82c140000" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x140021285", "parentcaller": "0x14004b1dc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82c802000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x1402aed6c", "parentcaller": "0x14032db8b", "category": "hooking", "api": "UnhookWindowsHookEx", "status": true, "return": "0x00000001", "arguments": [ { "name": "HookHandle", "value": "0x000c02f5" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x1402efd0c", "parentcaller": "0x140366dc6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00602000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x1402efd0c", "parentcaller": "0x140366dc6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00623000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x1402efd0c", "parentcaller": "0x140366dc6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00632000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x1402ff834", "parentcaller": "0x1402ff178", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000025c" }, { "name": "DesiredAccess", "value": "0x40100080", "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x1402efe0b", "parentcaller": "0x1402faa08", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00632000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x1402f8f3c", "parentcaller": "0x1402f8cab", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000025c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" }, { "name": "Buffer", "value": "\n\n 1\n 1\n 0\n" }, { "name": "Length", "value": "2015" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-06-30 22:35:44,257", "thread_id": "2620", "caller": "0x1402f752c", "parentcaller": "0x1402f7335", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402efd0c", "parentcaller": "0x1402ee0b2", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00602000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402efd0c", "parentcaller": "0x1402ee0b2", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00602000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402efd0c", "parentcaller": "0x1402ee0b2", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00632000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402efd0c", "parentcaller": "0x1402ee0b2", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x005f4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402efd0c", "parentcaller": "0x1402ee0b2", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00636000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f00bc", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "BaseAddress", "value": "0x7ff828c10000" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402eff43", "parentcaller": "0x1402f00bc", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7ff828c10000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402f0074", "parentcaller": "0x1402f00bc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x7ff828c10000" }, { "name": "FunctionName", "value": "AppPolicyGetProcessTerminationMethod" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff828c130e0" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402efff3", "parentcaller": "0x1402f00bc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402f0024", "parentcaller": "0x1402f00bc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1404e4000" }, { "name": "ModuleName", "value": "UninstallTool.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402edb63", "parentcaller": "0x1402edb2c", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x0014fe90" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-06-30 22:35:44,272", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-06-30 22:35:44,319", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00550000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00520000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x004f0000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000200" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f4" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x004e0000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000228" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000220" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000214" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000020c" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 655 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000208" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a8" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a4" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000188" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000184" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000016c" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000170" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000174" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000178" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000017c" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000180" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82d560000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff82d560000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00602000" }, { "name": "RegionSize", "value": "0x0001f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00623000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-06-30 22:35:44,335", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000140" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000148" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000014c" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000150" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000118" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000010c" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000108" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000104" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00632000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00636000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d8" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000dc" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e0" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e4" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e8" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d4" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000cc" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000d0" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000078" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000007c" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a0" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a4" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000a8" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000a8" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000a8" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000009c" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000098" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000094" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7ff82d5d0000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff82d633330" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c4" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000088" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000054" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000044" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000050" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-06-30 22:35:44,350", "thread_id": "2620", "caller": "0x1402edb34", "parentcaller": "0x1402edb06", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 737 } ], "threads": [ "2620", "4908", "2192", "4476", "4688" ], "environ": { "UserName": "Rajesh", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x140000000", "MainExeSize": "0x005d0000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } } ], "anomaly": [], "processtree": [ { "name": "uninstalltool_setup.exe", "pid": 4848, "parent_id": 2604, "module_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe", "children": [ { "name": "uninstalltool_setup.tmp", "pid": 1404, "parent_id": 4848, "module_path": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp", "children": [ { "name": "UninstallTool.exe", "pid": 4056, "parent_id": 1404, "module_path": "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe", "children": [], "threads": [ "2620", "4908", "2192", "4476", "4688" ], "environ": { "UserName": "Rajesh", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\" ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x140000000", "MainExeSize": "0x005d0000", "Bitness": "64-bit" } } ], "threads": [ "1644", "3792", "3768", "3612", "1636", "1112", "2388", "4628", "4632" ], "environ": { "UserName": "Rajesh", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp\" /SL5=\"$601B4,5231704,895488,C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00dc0000", "MainExeSize": "0x00452000", "Bitness": "32-bit" } } ], "threads": [ "4684", "1384", "1408", "4592", "4716" ], "environ": { "UserName": "Rajesh", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" ", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x00570000", "MainExeSize": "0x000ea000", "Bitness": "32-bit" } }, { "name": "svchost.exe", "pid": 764, "parent_id": 644, "module_path": "C:\\Windows\\System32\\svchost.exe", "children": [ { "name": "dllhost.exe", "pid": 4348, "parent_id": 764, "module_path": "C:\\Windows\\System32\\dllhost.exe", "children": [], "threads": [ "4396", "5016", "4808", "992", "3144", "2692", "3752", "1136", "4740", "4580" ], "environ": { "UserName": "Rajesh", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7e3c20000", "MainExeSize": "0x00009000", "Bitness": "64-bit" } } ], "threads": [ "852", "856" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-P54VDBR", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "1c64-b66f", "SystemVolumeGUID": "e1e1ae7a-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7be6e0000", "MainExeSize": "0x00011000", "Bitness": "64-bit" } } ], "summary": { "files": [ "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.en-US", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.en", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.ENU", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.EN", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe", "C:\\Users\\Rajesh\\AppData\\Local\\Temp", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp", "C:\\", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp", "C:\\Windows\\WindowsShell.Manifest", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.en-US", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.en", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.ENU", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.EN", "C:\\Windows\\System32\\tzres.dll", "C:\\Windows\\System32\\en-US\\tzres.dll.mui", "C:\\Windows\\sysnative\\en-US\\tzres.dll.mui", "C:\\Windows\\System32\\kernel.appcore.dll", "\\Device\\CNG", "C:\\Windows\\System32\\winsta.dll", "C:\\Windows\\System32\\en-US\\USER32.dll.mui", "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui", "C:\\Windows\\sysnative\\en-US\\KERNELBASE.dll.mui", "C:\\Windows\\System32\\netmsg.dll", "C:\\Windows\\System32\\en-US\\netmsg.dll.mui", "C:\\Windows\\sysnative\\en-US\\netmsg.dll.mui", "C:\\Windows\\System32\\en\\netmsg.dll.mui", "C:\\Windows\\sysnative\\en\\netmsg.dll.mui", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\SystemResources\\uninstalltool_setup.tmp.mun", "\\??\\MountPointManager", "\\Device\\DeviceApi\\CMApi", "C:\\Windows\\System32", "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe", "\\??\\PhysicalDrive0", "C:\\Program Files\\Uninstall Tool\\license.dat", "C:\\Windows\\System32\\windows.storage.dll", "C:\\Program Files\\Uninstall Tool\\Wldp.dll", "C:\\Windows\\System32\\wldp.dll", "C:\\Users\\Rajesh\\AppData\\Roaming", "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\", "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml", "C:\\Program Files\\Uninstall Tool\\\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\"", "C:\\Windows\\System32\\xmllite.dll" ], "read_files": [], "write_files": [ "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp", "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" ], "delete_files": [ "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp" ], "keys": [ "HKEY_CURRENT_USER", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_CURRENT_USER\\Software\\Embarcadero\\Locales", "HKEY_LOCAL_MACHINE\\Software\\Embarcadero\\Locales", "HKEY_CURRENT_USER\\Software\\CodeGear\\Locales", "HKEY_LOCAL_MACHINE\\Software\\CodeGear\\Locales", "HKEY_CURRENT_USER\\Software\\Borland\\Locales", "HKEY_CURRENT_USER\\Software\\Borland\\Delphi\\Locales", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMinorVersionNumber", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\StateSeparation\\RedirectionMap\\Keys", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{75121952-E0D0-43E5-9380-1D80483ACF72}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\Elevation", "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MUI\\Settings", "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Control Panel\\Desktop", "HKEY_CURRENT_USER\\Control Panel\\Desktop\\LanguageConfiguration", "HKEY_CURRENT_USER\\Control Panel\\Desktop", "HKEY_CURRENT_USER\\Control Panel\\Desktop\\PreferredUILanguages", "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached", "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachinePreferredUILanguages", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest", "HKEY_CURRENT_USER\\Software\\CrystalIdea Software\\Uninstall Tool", "HKEY_CURRENT_USER\\SOFTWARE\\CrystalIdea Software\\Uninstall Tool\\LastRunDate", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoDrives", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\RestrictRun", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetConnectDisconnect", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRecentDocsHistory", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PropertyBag", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KnownFolderSettings", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\UninstallTool.exe" ], "read_keys": [ "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMinorVersionNumber", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID", "HKEY_CURRENT_USER\\Control Panel\\Desktop\\PreferredUILanguages", "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachinePreferredUILanguages", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest", "HKEY_CURRENT_USER\\SOFTWARE\\CrystalIdea Software\\Uninstall Tool\\LastRunDate", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoDrives", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\RestrictRun", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetConnectDisconnect", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRecentDocsHistory", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData" ], "write_keys": [], "delete_keys": [], "executed_commands": [ "\"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp\" /SL5=\"$601B4,5231704,895488,C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\"", "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe /SPAWNWND=$70216 /NOTIFYWND=$601B4", "\"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\"", "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe ", "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" ], "resolved_apis": [ "ntdll.dll.RtlWow64GetCurrentMachine", "ntdll.dll.RtlWow64IsWowGuestMachineSupported" ], "mutexes": [ "Local\\SM0:4848:168:WilStaging_02", "Local\\SM0:4348:304:WilStaging_02" ], "created_services": [], "started_services": [] }, "enhanced": [ { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,054", "eid": 1, "data": { "file": "KERNELBASE.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,054", "eid": 2, "data": { "file": "LPK.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,054", "eid": 3, "data": { "file": "KERNEL32", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,054", "eid": 4, "data": { "file": "imm32.dll", "pathtofile": null, "moduleaddress": "0x75440000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 5, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 6, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 7, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x773c0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 8, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 9, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 10, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 11, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 12, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 13, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 14, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x773c0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 15, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 16, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber", "content": "10" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 17, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMinorVersionNumber", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 18, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 19, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild", "content": "19044" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 20, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 21, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 22, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 23, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x773c0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 24, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:12,069", "eid": 25, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 26, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,069", "eid": 27, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:12,210", "eid": 28, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:12,210", "eid": 29, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:12,257", "eid": 30, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,257", "eid": 31, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,257", "eid": 32, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,257", "eid": 33, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,257", "eid": 34, "data": { "file": "C:\\Windows\\System32\\bcrypt.dll", "pathtofile": null, "moduleaddress": "0x77550000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:12,319", "eid": 35, "data": { "file": "C:\\Windows\\System32\\bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x75bb0000" } }, { "event": "create", "object": "dir", "timestamp": "2026-06-30 22:35:12,319", "eid": 36, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:12,335", "eid": 37, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:12,335", "eid": 38, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:12,975", "eid": 39, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "write", "object": "file", "timestamp": "2026-06-30 22:35:13,007", "eid": 40, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,022", "eid": 41, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x74990000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,022", "eid": 42, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "0" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,038", "eid": 43, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,100", "eid": 44, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77580000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,100", "eid": 45, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77580000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,100", "eid": 46, "data": { "file": "C:\\Windows\\System32\\apphelp.dll", "pathtofile": null, "moduleaddress": "0x748f0000" } }, { "event": "execute", "object": "file", "timestamp": "2026-06-30 22:35:13,100", "eid": 47, "data": { "file": null } }, { "event": "delete", "object": "file", "timestamp": "2026-06-30 22:35:44,725", "eid": 48, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" } }, { "event": "delete", "object": "dir", "timestamp": "2026-06-30 22:35:44,725", "eid": 49, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,741", "eid": 50, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,741", "eid": 51, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,741", "eid": 52, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,741", "eid": 53, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,741", "eid": 54, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,741", "eid": 55, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,741", "eid": 56, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,741", "eid": 57, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,340", "eid": 58, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,356", "eid": 59, "data": { "file": "LPK", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,356", "eid": 60, "data": { "file": "GDI32", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 61, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 62, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 63, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x773c0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 64, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 65, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 66, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 67, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 68, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 69, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 70, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x773c0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 71, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 72, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMajorVersionNumber", "content": "10" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 73, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentMinorVersionNumber", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 74, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 75, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\CurrentBuild", "content": "19044" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 76, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 77, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 78, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 79, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x773c0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 80, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,403", "eid": 81, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,403", "eid": 82, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,419", "eid": 83, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,419", "eid": 84, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,434", "eid": 85, "data": { "file": "Msctf.dll", "pathtofile": null, "moduleaddress": "0x762f0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,434", "eid": 86, "data": { "file": "ole32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,434", "eid": 87, "data": { "file": "imm32.dll", "pathtofile": null, "moduleaddress": "0x75440000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,434", "eid": 88, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,434", "eid": 89, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "content": "21H2" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,434", "eid": 90, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "content": "1288" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,434", "eid": 91, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x74990000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,450", "eid": 92, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,450", "eid": 93, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,450", "eid": 94, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,450", "eid": 95, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,450", "eid": 96, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,481", "eid": 97, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77580000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,497", "eid": 98, "data": { "file": "Winsta.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,497", "eid": 99, "data": { "file": "uxtheme.dll", "pathtofile": null, "moduleaddress": "0x74990000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,497", "eid": 100, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,497", "eid": 101, "data": { "file": "USER32", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,497", "eid": 102, "data": { "file": "comctl32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,497", "eid": 103, "data": { "file": "user32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,497", "eid": 104, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x74990000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,512", "eid": 105, "data": { "file": "user32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,512", "eid": 106, "data": { "file": "C:\\Windows\\System32\\shell32.dll", "pathtofile": null, "moduleaddress": "0x75c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,512", "eid": 107, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,512", "eid": 108, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,512", "eid": 109, "data": { "file": "C:\\Windows\\System32\\shell32.dll", "pathtofile": null, "moduleaddress": "0x75c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,528", "eid": 110, "data": { "file": "winhttp.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,528", "eid": 111, "data": { "file": "C:\\Windows\\System32\\shell32.dll", "pathtofile": null, "moduleaddress": "0x75c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,528", "eid": 112, "data": { "file": "comctl32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,528", "eid": 113, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,528", "eid": 114, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,528", "eid": 115, "data": { "file": "C:\\Windows\\System32\\shell32.dll", "pathtofile": null, "moduleaddress": "0x75c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,528", "eid": 116, "data": { "file": "uxtheme.dll", "pathtofile": null, "moduleaddress": "0x74990000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,544", "eid": 117, "data": { "file": "user32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,544", "eid": 118, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,544", "eid": 119, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:13,544", "eid": 120, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:13,544", "eid": 121, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:13,559", "eid": 122, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,559", "eid": 123, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "0" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:13,637", "eid": 124, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,637", "eid": 125, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,637", "eid": 126, "data": { "file": "user32", "pathtofile": null, "moduleaddress": "0x763d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,653", "eid": 127, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,653", "eid": 128, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,653", "eid": 129, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,715", "eid": 130, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x744b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,747", "eid": 131, "data": { "file": "C:\\Windows\\System32\\Windows.Storage.dll", "pathtofile": null, "moduleaddress": "0x74d60000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,762", "eid": 132, "data": { "file": "C:\\Windows\\System32\\windows.storage.dll", "pathtofile": null, "moduleaddress": "0x74d60000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 133, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 134, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\xc4\\xd8c\\xf2\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 135, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 136, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 137, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00o\\xb6d\\x1c\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 138, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 139, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 140, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\xd9T\\x98P\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x001\\x00c\\x001\\x009\\x002\\x00d\\x00d\\x00b\\x00-\\x007\\x003\\x007\\x001\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x009\\x00c\\x00d\\x004\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x008\\x00E\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,809", "eid": 141, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 142, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 143, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 144, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 145, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 146, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 147, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 148, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 151, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 152, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 153, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,840", "eid": 154, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 155, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 156, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 157, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 158, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 159, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 160, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 161, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 162, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 163, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,856", "eid": 164, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 165, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 166, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 167, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 168, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 169, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 170, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 171, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 172, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 173, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 174, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 175, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 176, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 177, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 178, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 179, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,856", "eid": 180, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,872", "eid": 181, "data": { "file": "C:\\Windows\\SysWOW64\\Windows.StateRepositoryPS.dll", "pathtofile": null, "moduleaddress": "0x743d0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,887", "eid": 182, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:13,887", "eid": 183, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,919", "eid": 184, "data": { "file": "user32.dll", "pathtofile": null, "moduleaddress": "0x763d0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,965", "eid": 185, "data": { "file": "C:\\Windows\\SysWOW64\\WinTypes.dll", "pathtofile": null, "moduleaddress": "0x73ee0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,965", "eid": 186, "data": { "file": "C:\\Windows\\System32\\WinTypes.dll", "pathtofile": null, "moduleaddress": "0x73ee0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:13,981", "eid": 187, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x75c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:14,028", "eid": 188, "data": { "file": "C:\\Windows\\SysWOW64\\appresolver.dll", "pathtofile": null, "moduleaddress": "0x73e60000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:14,059", "eid": 189, "data": { "file": "C:\\Windows\\SysWOW64\\OneCoreCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x73d60000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,059", "eid": 190, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,059", "eid": 191, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,059", "eid": 192, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,059", "eid": 193, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,059", "eid": 194, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,059", "eid": 195, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,059", "eid": 196, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,059", "eid": 197, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 198, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 199, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 200, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 201, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 202, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 203, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 204, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 205, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:14,075", "eid": 206, "data": { "file": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x739b0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 207, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 208, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 209, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 210, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 211, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 212, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 213, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 214, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 215, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 216, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:14,075", "eid": 217, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:16,778", "eid": 218, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77580000" } }, { "event": "execute", "object": "file", "timestamp": "2026-06-30 22:35:16,794", "eid": 219, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,794", "eid": 220, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,794", "eid": 221, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,794", "eid": 222, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,794", "eid": 223, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 224, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 225, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 226, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 227, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 228, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 229, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 230, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 231, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 232, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 233, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 234, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 235, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 236, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 237, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 238, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 239, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 240, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,809", "eid": 241, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:41,809", "eid": 242, "data": { "file": "C:\\Windows\\SysWOW64\\urlmon.dll", "pathtofile": null, "moduleaddress": "0x74220000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:41,809", "eid": 243, "data": { "file": "API-MS-WIN-CORE-URL-L1-1-0.DLL", "pathtofile": null, "moduleaddress": "0x77140000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:41,840", "eid": 244, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x75c10000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 245, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 246, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 247, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 248, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 249, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 250, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 251, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 252, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 253, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 254, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:41,856", "eid": 255, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,309", "eid": 256, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77580000" } }, { "event": "execute", "object": "file", "timestamp": "2026-06-30 22:35:43,325", "eid": 257, "data": { "file": "C:\\Program Files\\Uninstall Tool\\UninstallTool.exe" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,575", "eid": 258, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,622", "eid": 259, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,622", "eid": 260, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,622", "eid": 261, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,622", "eid": 262, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,622", "eid": 263, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,637", "eid": 264, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,637", "eid": 265, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,637", "eid": 266, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,637", "eid": 267, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,637", "eid": 268, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,637", "eid": 269, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,637", "eid": 270, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,637", "eid": 271, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,637", "eid": 272, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,637", "eid": 273, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:22,351", "eid": 274, "data": { "file": "C:\\Windows\\System32\\rsaenh.dll", "pathtofile": null, "moduleaddress": "0x7ff829d50000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:37,542", "eid": 275, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,557", "eid": 276, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,557", "eid": 277, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,557", "eid": 278, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,557", "eid": 279, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:37,557", "eid": 280, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,557", "eid": 281, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 282, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 283, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 284, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 285, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 286, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 287, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 288, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 289, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 290, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 291, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 292, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 293, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 294, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 295, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 296, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 297, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 298, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 299, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 300, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,573", "eid": 301, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,635", "eid": 302, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,635", "eid": 303, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,651", "eid": 304, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,667", "eid": 305, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,682", "eid": 306, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,682", "eid": 307, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AccessPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,682", "eid": 308, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:37,698", "eid": 309, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,760", "eid": 310, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:37,776", "eid": 311, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL", "content": "combase.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:37,776", "eid": 312, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:37,776", "eid": 313, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:38,135", "eid": 314, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:38,417", "eid": 315, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x7ff828730000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:38,417", "eid": 316, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,417", "eid": 317, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 318, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 319, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 320, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 321, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 322, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 323, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 324, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 325, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,448", "eid": 326, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\GipActivityBypass", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 327, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 328, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 329, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 330, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 331, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 332, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 333, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 334, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppID", "content": "{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 335, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 336, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 337, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LocalService", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 338, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 339, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\DllSurrogate", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 340, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RunAs", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 341, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateAtStorage", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 342, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ROTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 343, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AppIDFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 344, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\MGOTFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 345, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProcessMitigationPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 346, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LaunchPermission", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 347, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 348, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 349, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 350, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\RemoteServerName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 351, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\SRPTrustLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 352, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\PreferredServerBitness", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 353, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\LoadUserSettings", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,463", "eid": 354, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ProtectionLevel", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:38,479", "eid": 355, "data": { "file": "C:\\Windows\\System32\\thumbcache.dll", "pathtofile": null, "moduleaddress": "0x7ff815110000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:38,479", "eid": 356, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:38,479", "eid": 357, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,479", "eid": 358, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{75121952-e0d0-43e5-9380-1d80483acf72}\\ProxyStubClsid32\\(Default)", "content": "{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,479", "eid": 359, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,479", "eid": 360, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 361, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 362, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 363, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 364, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\system32\\propsys.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 365, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 366, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 367, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 368, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 369, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 370, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 371, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\system32\\propsys.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 372, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,495", "eid": 373, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:38,510", "eid": 374, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x7ff825200000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:38,510", "eid": 375, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,682", "eid": 376, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,682", "eid": 377, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,682", "eid": 378, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,682", "eid": 379, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,682", "eid": 380, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,682", "eid": 381, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,682", "eid": 382, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,698", "eid": 383, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,698", "eid": 384, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,698", "eid": 385, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\(Default)", "content": "Thumbnail Cache Class Factory for Out of Proc Server" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,698", "eid": 386, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,698", "eid": 387, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,698", "eid": 388, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\(Default)", "content": "C:\\Windows\\System32\\thumbcache.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:38,698", "eid": 389, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\\InprocServer32\\ThreadingModel", "content": "Apartment" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,729", "eid": 390, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,729", "eid": 391, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,729", "eid": 392, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,729", "eid": 393, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:43,616", "eid": 394, "data": { "regkey": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\PreferredUILanguages", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:43,616", "eid": 395, "data": { "regkey": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachinePreferredUILanguages", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:43,616", "eid": 396, "data": { "regkey": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\MuiCached\\MachinePreferredUILanguages", "content": "-" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:43,632", "eid": 397, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,632", "eid": 398, "data": { "file": "LPK", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,632", "eid": 399, "data": { "file": "GDI32", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,741", "eid": 400, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:43,741", "eid": 401, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 402, "data": { "file": "api-ms-win-core-synch-l1-2-0", "pathtofile": null, "moduleaddress": "0x7ff82b0b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 403, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 404, "data": { "file": "api-ms-win-core-fibers-l1-1-1", "pathtofile": null, "moduleaddress": "0x7ff82b0b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 405, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 406, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7ff82b0b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 407, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 408, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7ff82b0b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 409, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 410, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 411, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7ff82bee0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 412, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 413, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7ff82b0b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 414, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 415, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7ff82b0b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 416, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 417, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7ff82b0b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,132", "eid": 418, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,147", "eid": 419, "data": { "file": "user32", "pathtofile": null, "moduleaddress": "0x7ff82c830000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,147", "eid": 420, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x7ff828730000" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,147", "eid": 421, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,147", "eid": 422, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7ff82bee0000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,147", "eid": 423, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,147", "eid": 424, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\CrystalIdea Software\\Uninstall Tool\\LastRunDate", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,147", "eid": 425, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,163", "eid": 426, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,163", "eid": 427, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,163", "eid": 428, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,163", "eid": 429, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoDrives", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,163", "eid": 430, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\RestrictRun", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,163", "eid": 431, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetConnectDisconnect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,163", "eid": 432, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRecentDocsHistory", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,163", "eid": 433, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,179", "eid": 434, "data": { "file": "api-ms-win-core-synch-l1-2-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 435, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 436, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Name", "content": "AppData" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 437, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 438, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 439, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\RelativePath", "content": "AppData\\Roaming" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 440, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 441, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 442, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 443, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 444, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 445, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 446, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 447, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 448, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 449, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 450, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 451, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 452, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 453, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 454, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,179", "eid": 455, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,194", "eid": 456, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData", "content": "%USERPROFILE%\\AppData\\Roaming" } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,194", "eid": 457, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,194", "eid": 458, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,194", "eid": 459, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,194", "eid": 460, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:44,194", "eid": 461, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" } }, { "event": "read", "object": "file", "timestamp": "2026-06-30 22:35:44,194", "eid": 462, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,194", "eid": 463, "data": { "file": "uxtheme.dll", "pathtofile": null, "moduleaddress": "0x7ff828730000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,194", "eid": 464, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,194", "eid": 465, "data": { "file": "user32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,210", "eid": 466, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,210", "eid": 467, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,210", "eid": 468, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,210", "eid": 469, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,210", "eid": 470, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,225", "eid": 471, "data": { "file": "C:\\Windows\\System32\\taskschd.dll", "pathtofile": null, "moduleaddress": "0x7ff826a20000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,257", "eid": 472, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-06-30 22:35:44,257", "eid": 473, "data": { "file": "C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,272", "eid": 474, "data": { "file": "api-ms-win-appmodel-runtime-l1-1-2", "pathtofile": null, "moduleaddress": "0x7ff828c10000" } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,272", "eid": 475, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,272", "eid": 476, "data": { "file": "mscoree.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 477, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 478, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 479, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 480, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 481, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 482, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 483, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 484, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,335", "eid": 485, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,350", "eid": 486, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-06-30 22:35:44,350", "eid": 487, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,350", "eid": 488, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-06-30 22:35:44,350", "eid": 489, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } } ], "encryptedbuffers": [], "network_map": { "endpoint_map": {}, "http_host_map": {}, "dns_intents": {}, "http_requests": [], "winhttp_sessions": [], "com_activations": [] } }, "debug": { "log": "2026-06-30 06:08:42,429 [root] INFO: Date set to: 20260630T15:34:58, timeout set to: 30\n2026-06-30 15:34:58,112 [root] DEBUG: Starting analyzer from: C:\\n5g3jpk_\n2026-06-30 15:34:58,115 [root] DEBUG: Storing results at: C:\\JjJSwD\n2026-06-30 15:34:58,121 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\nyNegW\n2026-06-30 15:34:58,122 [root] DEBUG: Python path: C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314\n2026-06-30 15:34:58,124 [root] INFO: analysis running as an admin\n2026-06-30 15:34:58,127 [root] INFO: analysis package specified: \"exe\"\n2026-06-30 15:34:58,127 [root] DEBUG: importing analysis package module: \"modules.packages.exe\"...\n2026-06-30 15:34:58,164 [root] DEBUG: imported analysis package \"exe\"\n2026-06-30 15:34:58,165 [root] DEBUG: initializing analysis package \"exe\"...\n2026-06-30 15:34:58,165 [lib.common.common] INFO: no wrapping\n2026-06-30 15:34:58,165 [lib.core.compound] INFO: C:\\Users\\Rajesh\\AppData\\Local\\Temp already exists, skipping creation\n2026-06-30 15:34:58,174 [root] DEBUG: New location of moved file: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\n2026-06-30 15:34:58,175 [root] INFO: Analyzer: Package modules.packages.exe does not specify a dll option\n2026-06-30 15:34:58,175 [root] INFO: Analyzer: Package modules.packages.exe does not specify a dll_64 option\n2026-06-30 15:34:58,175 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option\n2026-06-30 15:34:58,175 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option\n2026-06-30 15:34:58,364 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-06-30 15:34:58,532 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-06-30 15:34:58,698 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-06-30 15:35:00,240 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-06-30 15:35:00,245 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-06-30 15:35:00,245 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-06-30 15:35:00,246 [root] DEBUG: attempting to configure 'Browser' from data\n2026-06-30 15:35:00,247 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-06-30 15:35:00,247 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-06-30 15:35:00,267 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-06-30 15:35:00,267 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-06-30 15:35:00,267 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-06-30 15:35:00,268 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-06-30 15:35:00,268 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-06-30 15:35:00,268 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature\n2026-06-30 15:35:00,810 [modules.auxiliary.digisig] DEBUG: File has an invalid signature\n2026-06-30 15:35:00,811 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json\n2026-06-30 15:35:00,821 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-06-30 15:35:00,821 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-06-30 15:35:00,822 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-06-30 15:35:00,822 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-06-30 15:35:00,823 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-06-30 15:35:00,826 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 2728)\n2026-06-30 15:35:00,831 [modules.auxiliary.disguise] INFO: Disguising GUID to 83d92ceb-b48b-4de5-8c04-a0c6302263a8\n2026-06-30 15:35:00,831 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-06-30 15:35:00,832 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-06-30 15:35:00,832 [root] DEBUG: attempting to configure 'Human' from data\n2026-06-30 15:35:00,833 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-06-30 15:35:00,833 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-06-30 15:35:00,835 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-06-30 15:35:00,837 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-06-30 15:35:00,838 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-06-30 15:35:00,839 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-06-30 15:35:00,840 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-06-30 15:35:00,844 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-06-30 15:35:00,844 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-06-30 15:35:07,578 [root] INFO: Restarting WMI Service\n2026-06-30 15:35:09,706 [root] DEBUG: package modules.packages.exe does not support configure, ignoring\n2026-06-30 15:35:09,708 [root] WARNING: configuration error for package modules.packages.exe: error importing data.packages.exe: No module named 'data.packages'\n2026-06-30 15:35:09,710 [lib.core.compound] INFO: C:\\Users\\Rajesh\\AppData\\Local\\Temp already exists, skipping creation\n2026-06-30 15:35:09,723 [lib.api.process] INFO: Successfully executed process from path \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\" with arguments \"\" with pid 4848\n2026-06-30 15:35:09,725 [lib.api.process] INFO: Monitor config for process 4848: C:\\n5g3jpk_\\dll\\4848.ini\n2026-06-30 15:35:09,739 [lib.api.process] INFO: 32-bit DLL to inject is C:\\n5g3jpk_\\dll\\OdNdDMOy.dll, loader C:\\n5g3jpk_\\bin\\NhFMNyv.exe\n2026-06-30 15:35:09,766 [root] DEBUG: Loader: Injecting process 4848 (thread 4684) with C:\\n5g3jpk_\\dll\\OdNdDMOy.dll.\n2026-06-30 15:35:09,772 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-30 15:35:09,774 [root] DEBUG: Successfully injected DLL C:\\n5g3jpk_\\dll\\OdNdDMOy.dll.\n2026-06-30 15:35:09,777 [lib.api.process] INFO: Injected into 32-bit \n2026-06-30 15:35:11,788 [lib.api.process] INFO: Successfully resumed process with pid 4848\n2026-06-30 15:35:11,857 [root] DEBUG: 4848: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-30 15:35:11,860 [root] DEBUG: 4848: Disabling sleep skipping.\n2026-06-30 15:35:11,862 [root] DEBUG: 4848: Dropped file limit defaulting to 100.\n2026-06-30 15:35:11,887 [root] DEBUG: 4848: YaraInit: Compiled 44 rule files\n2026-06-30 15:35:11,891 [root] DEBUG: 4848: YaraInit: Compiled rules saved to file C:\\n5g3jpk_\\data\\yara\\capemon.yac\n2026-06-30 15:35:11,892 [root] DEBUG: 4848: YaraScan: Scanning 0x00570000, size 0xe9800\n2026-06-30 15:35:11,906 [root] DEBUG: 4848: Monitor initialised: 32-bit capemon loaded in process 4848 at 0x74a50000, thread 4684, image base 0x570000, stack from 0xcf2000-0xd00000\n2026-06-30 15:35:11,907 [root] DEBUG: 4848: Commandline: \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\"\n2026-06-30 15:35:11,976 [root] DEBUG: 4848: hook_api: LdrpCallInitRoutine export address 0x775F2980 obtained via GetFunctionAddress\n2026-06-30 15:35:12,009 [root] DEBUG: 4848: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST\n2026-06-30 15:35:12,011 [root] DEBUG: 4848: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST\n2026-06-30 15:35:12,031 [root] DEBUG: 4848: Hooked 635 out of 635 functions\n2026-06-30 15:35:12,043 [root] DEBUG: 4848: Syscall hook installed, syscall logging level 1\n2026-06-30 15:35:12,052 [root] DEBUG: 4848: RestoreHeaders: Restored original import table.\n2026-06-30 15:35:12,054 [root] INFO: Loaded monitor into process with pid 4848\n2026-06-30 15:35:12,060 [root] DEBUG: 4848: caller_dispatch: Added region at 0x00570000 to tracked regions list (ntdll::LdrGetDllHandle returns to 0x0057E103, thread 4684).\n2026-06-30 15:35:12,061 [root] DEBUG: 4848: YaraScan: Scanning 0x00570000, size 0xe9800\n2026-06-30 15:35:12,071 [root] DEBUG: 4848: ProcessImageBase: Main module image at 0x00570000 unmodified (entropy change 0.000000e+00)\n2026-06-30 15:35:12,086 [root] DEBUG: 4848: YaraScan: Scanning 0x00570000, size 0xe9800\n2026-06-30 15:35:12,097 [root] DEBUG: 4848: ProcessImageBase: Modified image detected at image base 0x00570000 - new entropy 6.478485e+00 (change 5.884758e-02).\n2026-06-30 15:35:12,099 [root] DEBUG: 4848: DumpImageInCurrentProcess: Attempting to dump virtual PE image.\n2026-06-30 15:35:12,100 [root] DEBUG: 4848: DumpProcess: Instantiating PeParser with address: 0x00570000.\n2026-06-30 15:35:12,101 [root] DEBUG: 4848: DumpProcess: Module entry point VA is 0x0061FE60.\n2026-06-30 15:35:12,116 [lib.common.results] INFO: Uploading file C:\\JjJSwD\\CAPE\\4848_24440012352230262026 to CAPE\\e7947b0be16fcddb6c01896691ad29e2ecea48b2fafad36e9d6f46339f03fc29; Size is 925696; Max size: 100000000\n2026-06-30 15:35:12,136 [root] DEBUG: 4848: DumpProcess: Module image dump success - dump size 0xe2000.\n2026-06-30 15:35:12,140 [root] DEBUG: 4848: YaraScan: Scanning 0x00570000, size 0xe9800\n2026-06-30 15:35:12,158 [root] DEBUG: 4848: ProcessImageBase: Main module image at 0x00570000 unmodified (entropy change 0.000000e+00)\n2026-06-30 15:35:12,160 [root] DEBUG: 4848: YaraScan: Scanning 0x00570000, size 0xe9800\n2026-06-30 15:35:12,175 [root] DEBUG: 4848: ProcessImageBase: Main module image at 0x00570000 unmodified (entropy change 0.000000e+00)\n2026-06-30 15:35:12,177 [root] DEBUG: 4848: YaraScan: Scanning 0x00570000, size 0xe9800\n2026-06-30 15:35:12,192 [root] DEBUG: 4848: ProcessImageBase: Main module image at 0x00570000 unmodified (entropy change 0.000000e+00)\n2026-06-30 15:35:12,196 [root] DEBUG: 4848: YaraScan: Scanning 0x00570000, size 0xe9800\n2026-06-30 15:35:12,207 [root] DEBUG: 4848: ProcessImageBase: Main module image at 0x00570000 unmodified (entropy change 0.000000e+00)\n2026-06-30 15:35:12,328 [root] DEBUG: 4848: DLL loaded at 0x75BB0000: C:\\Windows\\System32\\bcryptprimitives (0x5f000 bytes).\n2026-06-30 15:35:13,010 [root] INFO: Added new file to list with pid 4848 and path C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp\n2026-06-30 15:35:13,015 [root] DEBUG: 4848: DLL loaded at 0x74990000: C:\\Windows\\system32\\uxtheme (0x74000 bytes).\n2026-06-30 15:35:13,023 [root] DEBUG: 4848: DLL loaded at 0x762F0000: C:\\Windows\\System32\\MSCTF (0xd3000 bytes).\n2026-06-30 15:35:13,056 [root] DEBUG: 4848: DLL loaded at 0x74D30000: C:\\Windows\\SYSTEM32\\Wldp (0x24000 bytes).\n2026-06-30 15:35:13,058 [root] DEBUG: 4848: DLL loaded at 0x74D60000: C:\\Windows\\SYSTEM32\\windows.storage (0x608000 bytes).\n2026-06-30 15:35:13,063 [root] DEBUG: 4848: DLL loaded at 0x774C0000: C:\\Windows\\System32\\SHCORE (0x87000 bytes).\n2026-06-30 15:35:13,065 [root] DEBUG: 4848: CreateProcessHandler: Injection info set for new process 1404: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp, ImageBase: 0x00DC0000\n2026-06-30 15:35:13,067 [root] INFO: Announced 32-bit process name: uninstalltool_setup.tmp pid: 1404\n2026-06-30 15:35:13,067 [lib.api.process] INFO: Monitor config for process 1404: C:\\n5g3jpk_\\dll\\1404.ini\n2026-06-30 15:35:13,072 [lib.api.process] INFO: 32-bit DLL to inject is C:\\n5g3jpk_\\dll\\OdNdDMOy.dll, loader C:\\n5g3jpk_\\bin\\NhFMNyv.exe\n2026-06-30 15:35:13,086 [root] DEBUG: Loader: Injecting process 1404 (thread 1644) with C:\\n5g3jpk_\\dll\\OdNdDMOy.dll.\n2026-06-30 15:35:13,088 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-30 15:35:13,089 [root] DEBUG: Successfully injected DLL C:\\n5g3jpk_\\dll\\OdNdDMOy.dll.\n2026-06-30 15:35:13,093 [lib.api.process] INFO: Injected into 32-bit \n2026-06-30 15:35:13,104 [root] DEBUG: 4848: DLL loaded at 0x748F0000: C:\\Windows\\system32\\apphelp (0x9f000 bytes).\n2026-06-30 15:35:13,149 [root] DEBUG: 1404: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-30 15:35:13,151 [root] DEBUG: 1404: Disabling sleep skipping.\n2026-06-30 15:35:13,152 [root] DEBUG: 1404: Dropped file limit defaulting to 100.\n2026-06-30 15:35:13,158 [root] DEBUG: 1404: YaraInit: Compiled rules loaded from existing file C:\\n5g3jpk_\\data\\yara\\capemon.yac\n2026-06-30 15:35:13,159 [root] DEBUG: 1404: YaraScan: Scanning 0x00DC0000, size 0x451a00\n2026-06-30 15:35:13,216 [root] DEBUG: 1404: Monitor initialised: 32-bit capemon loaded in process 1404 at 0x74a50000, thread 1644, image base 0xdc0000, stack from 0xb54000-0xb60000\n2026-06-30 15:35:13,217 [root] DEBUG: 1404: Commandline: \"C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp\" /SL5=\"$601B4,5231704,895488,C:\\Users\\Rajesh\\AppData\\Local\\Temp\\uninstalltool_setup.exe\"\n2026-06-30 15:35:13,248 [root] DEBUG: 1404: hook_api: LdrpCallInitRoutine export address 0x775F2980 obtained via GetFunctionAddress\n2026-06-30 15:35:13,277 [root] DEBUG: 1404: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST\n2026-06-30 15:35:13,279 [root] DEBUG: 1404: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST\n2026-06-30 15:35:13,295 [root] DEBUG: 1404: Hooked 635 out of 635 functions\n2026-06-30 15:35:13,337 [root] DEBUG: 1404: Syscall hook installed, syscall logging level 1\n2026-06-30 15:35:13,343 [root] DEBUG: 1404: RestoreHeaders: Restored original import table.\n2026-06-30 15:35:13,344 [root] INFO: Loaded monitor into process with pid 1404\n2026-06-30 15:35:13,355 [root] DEBUG: 1404: InstrumentationCallback: Added region at 0x773E24AC (base 0x773C0000) to tracked regions list (thread 1644).\n2026-06-30 15:35:13,357 [root] DEBUG: 1404: ProcessTrackedRegion: Region at 0x773C0000 mapped as \\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel32.dll is in known range, skipping\n2026-06-30 15:35:13,366 [root] DEBUG: 1404: caller_dispatch: Added region at 0x00DC0000 to tracked regions list (ntdll::LdrGetDllHandle returns to 0x00DD1B07, thread 1644).\n2026-06-30 15:35:13,367 [root] DEBUG: 1404: YaraScan: Scanning 0x00DC0000, size 0x451a00\n2026-06-30 15:35:13,413 [root] DEBUG: 1404: ProcessImageBase: Main module image at 0x00DC0000 unmodified (entropy change 0.000000e+00)\n2026-06-30 15:35:13,442 [root] DEBUG: 1404: DLL loaded at 0x762F0000: C:\\Windows\\System32\\Msctf (0xd3000 bytes).\n2026-06-30 15:35:13,446 [root] DEBUG: 1404: DLL loaded at 0x74990000: C:\\Windows\\system32\\uxtheme (0x74000 bytes).\n2026-06-30 15:35:13,465 [root] DEBUG: 1404: DLL loaded at 0x75370000: C:\\Windows\\SYSTEM32\\kernel.appcore (0xf000 bytes).\n2026-06-30 15:35:13,467 [root] DEBUG: 1404: DLL loaded at 0x75BB0000: C:\\Windows\\System32\\bcryptPrimitives (0x5f000 bytes).\n2026-06-30 15:35:13,475 [root] DEBUG: 1404: AllocationHandler: Adding allocation to tracked region list: 0x04820000, size: 0x1000.\n2026-06-30 15:35:13,490 [root] DEBUG: 1404: DLL loaded at 0x74580000: C:\\Windows\\SYSTEM32\\WINSTA (0x47000 bytes).\n2026-06-30 15:35:13,696 [root] DEBUG: 1404: DLL loaded at 0x74D30000: C:\\Windows\\SYSTEM32\\Wldp (0x24000 bytes).\n2026-06-30 15:35:13,698 [root] DEBUG: 1404: DLL loaded at 0x74D60000: C:\\Windows\\SYSTEM32\\windows.storage (0x608000 bytes).\n2026-06-30 15:35:13,706 [root] DEBUG: 1404: DLL loaded at 0x744B0000: C:\\Windows\\SYSTEM32\\PROPSYS (0xc2000 bytes).\n2026-06-30 15:35:13,716 [root] DEBUG: 1404: DLL loaded at 0x76C10000: C:\\Windows\\System32\\clbcatq (0x7e000 bytes).\n2026-06-30 15:35:13,737 [root] DEBUG: 1404: DLL loaded at 0x74490000: C:\\Windows\\SYSTEM32\\profapi (0x18000 bytes).\n2026-06-30 15:35:13,821 [root] DEBUG: 1404: DLL loaded at 0x770E0000: C:\\Windows\\System32\\CFGMGR32 (0x3b000 bytes).\n2026-06-30 15:35:13,827 [root] DEBUG: 1404: DLL loaded at 0x74470000: C:\\Windows\\SYSTEM32\\edputil (0x1b000 bytes).\n2026-06-30 15:35:13,879 [root] DEBUG: 1404: DLL loaded at 0x743D0000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x93000 bytes).\n2026-06-30 15:35:13,915 [root] DEBUG: 1404: DLL loaded at 0x73FF0000: C:\\Windows\\SYSTEM32\\iertutil (0x22b000 bytes).\n2026-06-30 15:35:13,917 [root] DEBUG: 1404: DLL loaded at 0x73FD0000: C:\\Windows\\SYSTEM32\\srvcli (0x1d000 bytes).\n2026-06-30 15:35:13,920 [root] DEBUG: 1404: DLL loaded at 0x73FC0000: C:\\Windows\\system32\\netutils (0xb000 bytes).\n2026-06-30 15:35:13,927 [root] DEBUG: 1404: DLL loaded at 0x74220000: C:\\Windows\\SYSTEM32\\urlmon (0x1a8000 bytes).\n2026-06-30 15:35:13,962 [root] DEBUG: 1404: DLL loaded at 0x73EE0000: C:\\Windows\\System32\\wintypes (0xdb000 bytes).\n2026-06-30 15:35:14,021 [root] DEBUG: 1404: DLL loaded at 0x73E10000: C:\\Windows\\System32\\Bcp47Langs (0x49000 bytes).\n2026-06-30 15:35:14,023 [root] DEBUG: 1404: DLL loaded at 0x73DA0000: C:\\Windows\\System32\\sppc (0x1c000 bytes).\n2026-06-30 15:35:14,025 [root] DEBUG: 1404: DLL loaded at 0x73DF0000: C:\\Windows\\System32\\SLC (0x1f000 bytes).\n2026-06-30 15:35:14,026 [root] DEBUG: 1404: DLL loaded at 0x73DC0000: C:\\Windows\\System32\\USERENV (0x25000 bytes).\n2026-06-30 15:35:14,028 [root] DEBUG: 1404: DLL loaded at 0x73E60000: C:\\Windows\\System32\\appresolver (0x71000 bytes).\n2026-06-30 15:35:14,064 [root] DEBUG: 1404: DLL loaded at 0x73D60000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x3d000 bytes).\n2026-06-30 15:35:14,080 [root] DEBUG: 1404: DLL loaded at 0x739B0000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x3a1000 bytes).\n2026-06-30 15:35:14,380 [lib.api.process] INFO: Monitor config for process 764: C:\\n5g3jpk_\\dll\\764.ini\n2026-06-30 15:35:14,386 [lib.api.process] INFO: 64-bit DLL to inject is C:\\n5g3jpk_\\dll\\mQMvNC.dll, loader C:\\n5g3jpk_\\bin\\LdtLPmgW.exe\n2026-06-30 15:35:14,407 [root] DEBUG: Loader: Injecting process 764 with C:\\n5g3jpk_\\dll\\mQMvNC.dll.\n2026-06-30 15:35:14,414 [root] DEBUG: 764: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-30 15:35:14,415 [root] DEBUG: 764: Disabling sleep skipping.\n2026-06-30 15:35:14,416 [root] DEBUG: 764: Dropped file limit defaulting to 100.\n2026-06-30 15:35:14,419 [root] DEBUG: 764: Services hook set enabled\n2026-06-30 15:35:14,423 [root] DEBUG: 764: YaraInit: Compiled rules loaded from existing file C:\\n5g3jpk_\\data\\yara\\capemon.yac\n2026-06-30 15:35:14,505 [root] DEBUG: 764: RtlInsertInvertedFunctionTable 0x00007FF82D5E090E, LdrpInvertedFunctionTableSRWLock 0x00007FF82D73B4F0\n2026-06-30 15:35:14,507 [root] DEBUG: 764: Monitor initialised: 64-bit capemon loaded in process 764 at 0x00007FF801740000, thread 4012, image base 0x00007FF7BE6E0000, stack from 0x00000026618F5000-0x0000002661900000\n2026-06-30 15:35:14,508 [root] DEBUG: 764: Commandline: C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p\n2026-06-30 15:35:14,523 [root] DEBUG: 764: Hooked 69 out of 69 functions\n2026-06-30 15:35:14,528 [root] INFO: Loaded monitor into process with pid 764\n2026-06-30 15:35:14,531 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-06-30 15:35:14,532 [root] DEBUG: Successfully injected DLL C:\\n5g3jpk_\\dll\\mQMvNC.dll.\n2026-06-30 15:35:14,536 [lib.api.process] INFO: Injected into 64-bit \n2026-06-30 15:35:16,791 [root] DEBUG: 1404: DLL loaded at 0x73990000: C:\\Windows\\SYSTEM32\\pcacli (0x11000 bytes).\n2026-06-30 15:35:19,583 [modules.auxiliary.human] INFO: Found button \"next\", clicking it\n2026-06-30 15:35:22,252 [modules.auxiliary.human] INFO: Found checkable button \"i accept the agreement\", checking it\n2026-06-30 15:35:25,194 [modules.auxiliary.human] INFO: Found button \"next\", clicking it\n2026-06-30 15:35:28,396 [modules.auxiliary.human] INFO: Found button \"next\", clicking it\n2026-06-30 15:35:31,507 [modules.auxiliary.human] INFO: Found button \"next\", clicking it\n2026-06-30 15:35:34,551 [modules.auxiliary.human] INFO: Found button \"install\", clicking it\n2026-06-30 15:35:36,914 [root] DEBUG: 764: CreateProcessHandler: Injection info set for new process 4348: C:\\Windows\\system32\\DllHost.exe, ImageBase: 0x00007FF7E3C20000\n2026-06-30 15:35:37,114 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 4348\n2026-06-30 15:35:37,115 [lib.api.process] INFO: Monitor config for process 4348: C:\\n5g3jpk_\\dll\\4348.ini\n2026-06-30 15:35:37,120 [lib.api.process] INFO: 64-bit DLL to inject is C:\\n5g3jpk_\\dll\\mQMvNC.dll, loader C:\\n5g3jpk_\\bin\\LdtLPmgW.exe\n2026-06-30 15:35:37,146 [root] DEBUG: Loader: Injecting process 4348 (thread 4396) with C:\\n5g3jpk_\\dll\\mQMvNC.dll.\n2026-06-30 15:35:37,211 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-30 15:35:37,213 [root] DEBUG: Successfully injected DLL C:\\n5g3jpk_\\dll\\mQMvNC.dll.\n2026-06-30 15:35:37,263 [lib.api.process] INFO: Injected into 64-bit \n2026-06-30 15:35:37,267 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 4348\n2026-06-30 15:35:37,300 [lib.api.process] INFO: Monitor config for process 4348: C:\\n5g3jpk_\\dll\\4348.ini\n2026-06-30 15:35:37,323 [lib.api.process] INFO: 64-bit DLL to inject is C:\\n5g3jpk_\\dll\\mQMvNC.dll, loader C:\\n5g3jpk_\\bin\\LdtLPmgW.exe\n2026-06-30 15:35:37,338 [root] DEBUG: Loader: Injecting process 4348 (thread 4396) with C:\\n5g3jpk_\\dll\\mQMvNC.dll.\n2026-06-30 15:35:37,340 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-30 15:35:37,341 [root] DEBUG: Successfully injected DLL C:\\n5g3jpk_\\dll\\mQMvNC.dll.\n2026-06-30 15:35:37,349 [lib.api.process] INFO: Injected into 64-bit \n2026-06-30 15:35:37,370 [root] DEBUG: 4348: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-30 15:35:37,376 [root] DEBUG: 4348: Dropped file limit defaulting to 100.\n2026-06-30 15:35:37,382 [root] DEBUG: 4348: Disabling sleep skipping.\n2026-06-30 15:35:37,385 [root] DEBUG: 4348: YaraInit: Compiled rules loaded from existing file C:\\n5g3jpk_\\data\\yara\\capemon.yac\n2026-06-30 15:35:37,410 [root] DEBUG: 4348: RtlInsertInvertedFunctionTable 0x00007FF82D5E090E, LdrpInvertedFunctionTableSRWLock 0x00007FF82D73B4F0\n2026-06-30 15:35:37,412 [root] DEBUG: 4348: YaraScan: Scanning 0x00007FF7E3C20000, size 0x8026\n2026-06-30 15:35:37,424 [root] DEBUG: 4348: Monitor initialised: 64-bit capemon loaded in process 4348 at 0x00007FF801740000, thread 4396, image base 0x00007FF7E3C20000, stack from 0x0000008D5D6F4000-0x0000008D5D700000\n2026-06-30 15:35:37,425 [root] DEBUG: 4348: Commandline: C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\n2026-06-30 15:35:37,437 [root] DEBUG: 4348: hook_api: LdrpCallInitRoutine export address 0x00007FF82D5E99BC obtained via GetFunctionAddress\n2026-06-30 15:35:37,506 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-06-30 15:35:37,514 [root] DEBUG: 4348: set_hooks: Unable to hook LockResource\n2026-06-30 15:35:37,530 [root] DEBUG: 4348: Hooked 630 out of 631 functions\n2026-06-30 15:35:37,533 [root] DEBUG: 4348: Syscall hook installed, syscall logging level 1\n2026-06-30 15:35:37,547 [root] DEBUG: 4348: RestoreHeaders: Restored original import table.\n2026-06-30 15:35:37,549 [root] INFO: Loaded monitor into process with pid 4348\n2026-06-30 15:35:37,550 [root] DEBUG: 4348: caller_dispatch: Added region at 0x00007FF7E3C20000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF7E3C212F2, thread 4396).\n2026-06-30 15:35:37,552 [root] DEBUG: 4348: YaraScan: Scanning 0x00007FF7E3C20000, size 0x8026\n2026-06-30 15:35:37,554 [root] DEBUG: 4348: ProcessImageBase: Main module image at 0x00007FF7E3C20000 unmodified (entropy change 0.000000e+00)\n2026-06-30 15:35:37,559 [root] DEBUG: 4348: DLL loaded at 0x00007FF828C10000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-06-30 15:35:37,561 [root] DEBUG: 4348: DLL loaded at 0x00007FF82B380000: C:\\Windows\\System32\\bcryptPrimitives (0x83000 bytes).\n2026-06-30 15:35:37,569 [root] DEBUG: 4348: DLL loaded at 0x00007FF82C2A0000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-06-30 15:35:38,425 [root] DEBUG: 4348: DLL loaded at 0x00007FF828730000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-06-30 15:35:38,487 [root] DEBUG: 4348: DLL loaded at 0x00007FF82C9E0000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-06-30 15:35:38,489 [root] DEBUG: 4348: DLL loaded at 0x00007FF815110000: C:\\Windows\\System32\\thumbcache (0x66000 bytes).\n2026-06-30 15:35:38,509 [root] DEBUG: 4348: DLL loaded at 0x00007FF825200000: C:\\Windows\\system32\\propsys (0xf6000 bytes).\n2026-06-30 15:35:40,778 [modules.auxiliary.human] INFO: Found button \"finish\", clicking it\n2026-06-30 15:35:41,874 [root] DEBUG: 1404: CreateProcessHandler: Injection info set for new process 4056: C:\\Program Files\\Uninstall Tool\\UninstallTool.exe, ImageBase: 0x00000000\n2026-06-30 15:35:41,876 [root] INFO: Announced 64-bit process name: UninstallTool.exe pid: 4056\n2026-06-30 15:35:41,876 [lib.api.process] INFO: Monitor config for process 4056: C:\\n5g3jpk_\\dll\\4056.ini\n2026-06-30 15:35:42,476 [root] INFO: Analysis timeout hit, terminating analysis\n2026-06-30 15:35:42,477 [lib.api.process] INFO: Terminate event set for process 4848\n2026-06-30 15:35:42,478 [root] DEBUG: 4848: Terminate Event: Attempting to dump process 4848\n2026-06-30 15:35:42,482 [root] DEBUG: 4848: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-06-30 15:35:42,488 [root] DEBUG: 4848: YaraScan: Scanning 0x00570000, size 0xe9800\n2026-06-30 15:35:42,500 [root] DEBUG: 4848: ProcessImageBase: Modified image detected at image base 0x00570000 - new entropy 6.496035e+00 (change 1.755026e-02).\n2026-06-30 15:35:42,502 [root] DEBUG: 4848: DumpImageInCurrentProcess: Attempting to dump virtual PE image.\n2026-06-30 15:35:42,503 [root] DEBUG: 4848: DumpProcess: Instantiating PeParser with address: 0x00570000.\n2026-06-30 15:35:42,504 [root] DEBUG: 4848: DumpProcess: Module entry point VA is 0x0061FE60.\n2026-06-30 15:35:42,517 [lib.common.results] INFO: Uploading file C:\\JjJSwD\\CAPE\\4848_936276942352230262026 to CAPE\\6162cf5441f22c3be4d56a04767aca2d885519a973bcbb9f796ab7799a92e556; Size is 926208; Max size: 100000000\n2026-06-30 15:35:42,522 [root] DEBUG: 4848: DumpProcess: Module image dump success - dump size 0xe2200.\n2026-06-30 15:35:42,525 [root] DEBUG: 4848: Terminate Event: Shutdown complete for process 4848 but failed to inform analyzer.\n2026-06-30 15:35:43,317 [lib.api.process] INFO: 64-bit DLL to inject is C:\\n5g3jpk_\\dll\\mQMvNC.dll, loader C:\\n5g3jpk_\\bin\\LdtLPmgW.exe\n2026-06-30 15:35:43,329 [root] DEBUG: Loader: Injecting process 4056 (thread 2620) with C:\\n5g3jpk_\\dll\\mQMvNC.dll.\n2026-06-30 15:35:43,330 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-06-30 15:35:43,331 [root] DEBUG: Successfully injected DLL C:\\n5g3jpk_\\dll\\mQMvNC.dll.\n2026-06-30 15:35:43,334 [lib.api.process] INFO: Injected into 64-bit \n2026-06-30 15:35:43,353 [root] DEBUG: 4056: Python path set to 'C:\\Users\\Rajesh\\AppData\\Local\\Programs\\Python\\Python314'.\n2026-06-30 15:35:43,354 [root] DEBUG: 4056: Dropped file limit defaulting to 100.\n2026-06-30 15:35:43,368 [root] DEBUG: 4056: Disabling sleep skipping.\n2026-06-30 15:35:43,372 [root] DEBUG: 4056: YaraInit: Compiled rules loaded from existing file C:\\n5g3jpk_\\data\\yara\\capemon.yac\n2026-06-30 15:35:43,395 [root] DEBUG: 4056: RtlInsertInvertedFunctionTable 0x00007FF82D5E090E, LdrpInvertedFunctionTableSRWLock 0x00007FF82D73B4F0\n2026-06-30 15:35:43,397 [root] DEBUG: 4056: YaraScan: Scanning 0x0000000140000000, size 0x5cf35f\n2026-06-30 15:35:43,461 [root] DEBUG: 4056: Monitor initialised: 64-bit capemon loaded in process 4056 at 0x00007FF801740000, thread 2620, image base 0x0000000140000000, stack from 0x0000000000144000-0x0000000000150000\n2026-06-30 15:35:43,462 [root] DEBUG: 4056: Commandline: \"C:\\Program Files\\Uninstall Tool\\UninstallTool.exe\"\n2026-06-30 15:35:43,478 [root] DEBUG: 4056: hook_api: LdrpCallInitRoutine export address 0x00007FF82D5E99BC obtained via GetFunctionAddress\n2026-06-30 15:35:43,525 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-06-30 15:35:43,526 [root] DEBUG: 4056: set_hooks: Unable to hook LockResource\n2026-06-30 15:35:43,539 [root] DEBUG: 4056: Hooked 630 out of 631 functions\n2026-06-30 15:35:43,602 [root] DEBUG: 4056: Syscall hook installed, syscall logging level 1\n2026-06-30 15:35:43,611 [root] DEBUG: 4056: RestoreHeaders: Restored original import table.\n2026-06-30 15:35:43,612 [root] INFO: Loaded monitor into process with pid 4056\n2026-06-30 15:35:43,747 [root] DEBUG: 4056: YaraScan: Scanning 0x0000000140000000, size 0x5cf35f\n2026-06-30 15:35:43,747 [root] INFO: Process with pid 4348 has terminated\n2026-06-30 15:35:43,883 [root] DEBUG: 4348: NtTerminateProcess hook: Attempting to dump process 4348\n2026-06-30 15:35:43,892 [root] DEBUG: 4348: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-06-30 15:35:43,909 [root] DEBUG: 4056: YaraScan: Scanning 0x0000000140000000, size 0x5cf35f\n2026-06-30 15:35:44,050 [root] DEBUG: 4056: caller_dispatch: Added region at 0x0000000140000000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00000001402C938F, thread 2620).\n2026-06-30 15:35:44,051 [root] DEBUG: 4056: YaraScan: Scanning 0x0000000140000000, size 0x5cf35f\n2026-06-30 15:35:44,144 [root] DEBUG: 4056: ProcessImageBase: Main module image at 0x0000000140000000 unmodified (entropy change 0.000000e+00)\n2026-06-30 15:35:44,152 [root] DEBUG: 4056: DLL loaded at 0x00007FF82B380000: C:\\Windows\\System32\\bcryptPrimitives (0x83000 bytes).\n2026-06-30 15:35:44,156 [root] DEBUG: 4056: DLL loaded at 0x00007FF82C9E0000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-06-30 15:35:44,178 [root] DEBUG: 4056: DLL loaded at 0x00007FF82A670000: C:\\Windows\\SYSTEM32\\Wldp (0x2c000 bytes).\n2026-06-30 15:35:44,181 [root] DEBUG: 4056: DLL loaded at 0x00007FF828E10000: C:\\Windows\\SYSTEM32\\windows.storage (0x790000 bytes).\n2026-06-30 15:35:44,217 [root] DEBUG: 4056: DLL loaded at 0x00007FF828C10000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-06-30 15:35:44,228 [root] DEBUG: 4056: DLL loaded at 0x00007FF82C2A0000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-06-30 15:35:44,234 [root] DEBUG: 4056: DLL loaded at 0x00007FF826A20000: C:\\Windows\\System32\\taskschd (0xac000 bytes).\n2026-06-30 15:35:44,249 [root] DEBUG: 4056: DLL loaded at 0x00007FF825410000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-06-30 15:35:44,283 [root] INFO: Added new file to list with pid 4056 and path C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml\n2026-06-30 15:35:44,316 [root] DEBUG: 4056: NtTerminateProcess hook: Attempting to dump process 4056\n2026-06-30 15:35:44,325 [root] DEBUG: 4056: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-06-30 15:35:44,384 [root] INFO: Process with pid 4056 has terminated\n2026-06-30 15:35:44,595 [root] DEBUG: 1404: FreeHandler: Address: 0x04820000.\n2026-06-30 15:35:44,596 [root] DEBUG: 1404: ProcessTrackedRegion: Entropy for tracked region at 0x04820000: 4.446254e+00\n2026-06-30 15:35:44,598 [root] DEBUG: 1404: DumpPEsInRange: Scanning range 0x04820000 - 0x04820FFC.\n2026-06-30 15:35:44,609 [root] DEBUG: 1404: ScanForDisguisedPE: No PE image located in range 0x04820000-0x04820FFC.\n2026-06-30 15:35:44,614 [lib.common.results] INFO: Uploading file C:\\JjJSwD\\CAPE\\1404_1365480044352230262026 to CAPE\\71d33a2237fe7615d02ab8ecd76eaf7172d02546453519811e1f1e90d12a2503; Size is 4092; Max size: 100000000\n2026-06-30 15:35:44,618 [root] DEBUG: 1404: DumpMemory: Payload successfully created: C:\\JjJSwD\\CAPE\\1404_1365480044352230262026 (size 4092 bytes)\n2026-06-30 15:35:44,620 [root] DEBUG: 1404: DumpRegion: Dumped entire allocation from 0x04820000, size 4096 bytes.\n2026-06-30 15:35:44,621 [root] DEBUG: 1404: ProcessTrackedRegion: Dumped region at 0x04820000.\n2026-06-30 15:35:44,622 [root] DEBUG: 1404: YaraScan: Scanning 0x04820000, size 0xffc\n2026-06-30 15:35:44,623 [root] DEBUG: 1404: FreeHandler: Dumped executable range containing 0x04820000.\n2026-06-30 15:35:44,629 [root] DEBUG: 1404: NtTerminateProcess hook: Attempting to dump process 1404\n2026-06-30 15:35:44,636 [root] DEBUG: 1404: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-06-30 15:35:44,642 [root] DEBUG: 1404: ReverseScanForNonZero: Error - Supplied size zero.\n2026-06-30 15:35:44,643 [root] DEBUG: 1404: GetPageAddress: Error - Supplied address zero.\n2026-06-30 15:35:44,662 [root] INFO: Process with pid 1404 has terminated\n2026-06-30 15:35:44,693 [lib.common.results] INFO: Uploading file C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp to files\\eb7a6ec9e86a224f0b807e79c19126ba04e60090490c0af794530efb0f2e9a68; Size is 4372376; Max size: 100000000\n2026-06-30 15:35:44,787 [root] INFO: Process with pid 4848 has terminated\n2026-06-30 15:35:47,478 [lib.api.process] INFO: Termination confirmed for process 4848\n2026-06-30 15:35:47,485 [root] INFO: Terminate event set for process 4848\n2026-06-30 15:35:47,486 [root] INFO: Created shutdown mutex\n2026-06-30 15:35:48,491 [root] INFO: Shutting down package\n2026-06-30 15:35:48,492 [root] INFO: Stopping auxiliary modules\n2026-06-30 15:35:48,493 [root] INFO: Stopping auxiliary module: Browser\n2026-06-30 15:35:48,494 [root] INFO: Stopping auxiliary module: Human\n2026-06-30 15:35:51,572 [root] INFO: Finishing auxiliary modules\n2026-06-30 15:35:51,573 [root] INFO: Shutting down pipe server and dumping dropped files\n2026-06-30 15:35:51,577 [lib.common.results] INFO: Uploading file C:\\Users\\Rajesh\\AppData\\Roaming\\CrystalIdea Software\\Uninstall Tool\\preferences.xml to files\\0237bf82b7610c21bf77e99037ba18d73c9fccec531b49f08e9b821825cbfa00; Size is 2015; Max size: 100000000\n2026-06-30 15:35:51,584 [root] WARNING: Folder at path \"C:\\JjJSwD\\debugger\" does not exist, skipping\n2026-06-30 15:35:51,584 [root] WARNING: Folder at path \"C:\\JjJSwD\\tlsdump\" does not exist, skipping\n2026-06-30 15:35:51,595 [root] INFO: Analysis completed\n", "errors": [] }, "network": { "pcap_sha256": "d73574f98509557268b22cfe4c2382dd91068e96e651bdd1d1b62411e5d3149f", "hosts": [ { "ip": "104.18.20.213", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "r13.c.lencr.org", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "173.230.144.164", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "crystalidea.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "172.66.2.5", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "104.18.22.215", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] } ], "domains": [ { "domain": "crystalidea.com", "ip": "173.230.144.164" }, { "domain": "crt.sectigo.com", "ip": "104.18.38.233" }, { "domain": "r13.c.lencr.org", "ip": "104.18.20.213" } ], "tcp": [ { "src": "192.168.122.5", "sport": 49793, "dst": "40.126.32.140", "dport": 443, "offset": 5305, "time": 0.044692039489746094 }, { "src": "192.168.122.5", "sport": 49790, "dst": "104.18.22.215", "dport": 443, "offset": 45714, "time": 1.4997889995574951 }, { "src": "192.168.122.5", "sport": 49806, "dst": "104.18.38.233", "dport": 80, "offset": 53326, "time": 44.571802854537964 }, { "src": "192.168.122.5", "sport": 49805, "dst": "173.230.144.164", "dport": 443, "offset": 59299, "time": 44.71011805534363 }, { "src": "192.168.122.5", "sport": 49808, "dst": "172.64.149.23", "dport": 80, "offset": 64473, "time": 44.834599018096924 }, { "src": "192.168.122.5", "sport": 49810, "dst": "104.18.20.213", "dport": 80, "offset": 73880, "time": 44.94711685180664 } ], "udp": [ { "src": "192.168.122.5", "sport": 60928, "dst": "192.168.122.1", "dport": 53, "offset": 24, "time": 0.0 }, { "src": "192.168.122.5", "sport": 60929, "dst": "239.255.255.250", "dport": 1900, "offset": 46275, "time": 33.00229096412659 }, { "src": "192.168.122.5", "sport": 59738, "dst": "192.168.122.1", "dport": 53, "offset": 47273, "time": 42.092483043670654 }, { "src": "192.168.122.5", "sport": 5353, "dst": "224.0.0.251", "dport": 5353, "offset": 47368, "time": 42.097044944763184 }, { "src": "192.168.122.5", "sport": 51910, "dst": "224.0.0.252", "dport": 5355, "offset": 47454, "time": 42.09861207008362 }, { "src": "192.168.122.5", "sport": 61825, "dst": "192.168.122.1", "dport": 53, "offset": 52549, "time": 44.52844285964966 }, { "src": "192.168.122.5", "sport": 54808, "dst": "192.168.122.1", "dport": 53, "offset": 52640, "time": 44.53307104110718 }, { "src": "192.168.122.5", "sport": 57123, "dst": "192.168.122.1", "dport": 53, "offset": 59055, "time": 44.678645849227905 }, { "src": "192.168.122.5", "sport": 58235, "dst": "192.168.122.1", "dport": 53, "offset": 63969, "time": 44.779370069503784 }, { "src": "192.168.122.5", "sport": 59152, "dst": "192.168.122.1", "dport": 53, "offset": 68194, "time": 44.87537598609924 }, { "src": "192.168.122.5", "sport": 55784, "dst": "192.168.122.1", "dport": 53, "offset": 73339, "time": 44.925616979599 }, { "src": "192.168.122.5", "sport": 56436, "dst": "192.168.122.1", "dport": 53, "offset": 73430, "time": 44.928191900253296 } ], "icmp": [], "http": [ { "count": 1, "host": "crt.sectigo.com", "port": 80, "data": "GET /SectigoPublicCodeSigningRootR46.p7c HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/10.0\r\nHost: crt.sectigo.com\r\n\r\n", "uri": "http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c", "body": "", "path": "/SectigoPublicCodeSigningRootR46.p7c", "user-agent": "Microsoft-CryptoAPI/10.0", "version": "1.1", "method": "GET", "first_seen": 1782833748.873304 }, { "count": 1, "host": "r13.c.lencr.org", "port": 80, "data": "GET /101.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/10.0\r\nHost: r13.c.lencr.org\r\n\r\n", "uri": "http://r13.c.lencr.org/101.crl", "body": "", "path": "/101.crl", "user-agent": "Microsoft-CryptoAPI/10.0", "version": "1.1", "method": "GET", "first_seen": 1782833749.248618 } ], "dns": [ { "request": "crystalidea.com", "type": "A", "answers": [ { "type": "A", "data": "173.230.144.164" } ], "first_seen": 1782833748.829944 }, { "request": "crt.sectigo.com", "type": "A", "answers": [ { "type": "A", "data": "104.18.38.233" }, { "type": "A", "data": "172.64.149.23" }, { "type": "CNAME", "data": "crt.comodoca.com.cdn.cloudflare.net" } ], "first_seen": 1782833748.834572 }, { "request": "r13.c.lencr.org", "type": "A", "answers": [ { "type": "A", "data": "104.18.21.213" }, { "type": "A", "data": "104.18.20.213" } ], "first_seen": 1782833749.227118 } ], "smtp": [], "irc": [], "dead_hosts": [ [ "172.66.2.5", 80 ] ] }, "url_analysis": {}, "procmemory": [], "signatures": [ { "name": "stealth_network", "description": "Network activity detected but not expressed in monitor API logs", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "ip": "104.18.20.213" }, { "ip": "173.230.144.164" }, { "ip": "172.66.2.5" }, { "ip": "104.18.22.215" }, { "domain": "crystalidea.com" }, { "domain": "crt.sectigo.com" }, { "domain": "r13.c.lencr.org" } ], "new_data": [], "alert": false, "families": [] }, { "name": "queries_computer_name", "description": "Queries computer hostname", "categories": [ "system_discovery" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 4056, "cid": 531 } ], "new_data": [], "alert": false, "families": [] }, { "name": "queries_user_name", "description": "Queries the username", "categories": [ "system_discovery" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 4056, "cid": 536 } ], "new_data": [], "alert": false, "families": [] }, { "name": "queries_keyboard_layout", "description": "Queries the keyboard layout", "categories": [ "location_discovery" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 1404, "cid": 197 }, { "type": "call", "pid": 4348, "cid": 969 } ], "new_data": [], "alert": false, "families": [] }, { "name": "queries_locale_api", "description": "Queries the computer locale (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 4056, "cid": 539 }, { "type": "call", "pid": 4056, "cid": 571 } ], "new_data": [], "alert": false, "families": [] }, { "name": "antidebug_setunhandledexceptionfilter", "description": "SetUnhandledExceptionFilter detected (possible anti-debug)", "categories": [ "anti-debug" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "type": "call", "pid": 4348, "cid": 3 } ], "new_data": [], "alert": false, "families": [] }, { "name": "stealth_timeout", "description": "Possible date expiration check, exits too soon after checking local time", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "process": "uninstalltool_setup.exe, PID 4848" }, { "type": "call", "pid": 4848, "cid": 291 } ], "new_data": [], "alert": false, "families": [] }, { "name": "language_check_registry", "description": "Checks system language via registry key (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" }, { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "new_data": [], "alert": false, "families": [] }, { "name": "privilege_elevation_check", "description": "Queries process token information to check for Administrator privileges or UAC elevation status", "categories": [ "discovery", "privilege_escalation" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 4348, "cid": 60 }, { "type": "call", "pid": 4348, "cid": 153 }, { "type": "call", "pid": 4056, "cid": 508 } ], "new_data": [], "alert": false, "families": [] }, { "name": "query_fips_reconnaissance", "description": "Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software", "categories": [ "discovery", "c2" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 1404, "cid": 227 }, { "type": "call", "pid": 1404, "cid": 228 }, { "type": "call", "pid": 1404, "cid": 231 }, { "type": "call", "pid": 1404, "cid": 233 }, { "type": "call", "pid": 1404, "cid": 234 }, { "type": "call", "pid": 4348, "cid": 40 }, { "type": "call", "pid": 4348, "cid": 41 }, { "type": "call", "pid": 4348, "cid": 44 }, { "type": "call", "pid": 4348, "cid": 46 }, { "type": "call", "pid": 4348, "cid": 47 }, { "behavioral_fips_reconnaissance": [ "dllhost.exe (PID: 4348) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "uninstalltool_setup.tmp (PID: 1404) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 4348) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "uninstalltool_setup.tmp (PID: 1404) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "uninstalltool_setup.tmp (PID: 1404) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "uninstalltool_setup.tmp (PID: 1404) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "dllhost.exe (PID: 4348) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 4348) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "uninstalltool_setup.tmp (PID: 1404) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "dllhost.exe (PID: 4348) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'" ] } ], "new_data": [], "alert": false, "families": [] }, { "name": "mountpoints_volume_discovery", "description": "Queries the mount points and then resolves volume paths to enumerate storage devices", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 20, "references": [], "data": [ { "type": "call", "pid": 1404, "cid": 579 }, { "type": "call", "pid": 1404, "cid": 587 }, { "type": "call", "pid": 1404, "cid": 595 }, { "type": "call", "pid": 1404, "cid": 598 }, { "type": "call", "pid": 1404, "cid": 605 }, { "type": "call", "pid": 1404, "cid": 613 }, { "type": "call", "pid": 1404, "cid": 617 }, { "type": "call", "pid": 1404, "cid": 624 } ], "new_data": [], "alert": false, "families": [] }, { "name": "reads_self", "description": "Reads data out of its own binary image", "categories": [ "generic" ], "severity": 2, "weight": 1, "confidence": 30, "references": [], "data": [ { "self_read": "process: uninstalltool_setup.exe, pid: 4848, offset: 0x6566785c3431785c, length: 0x00144b18" }, { "self_read": "process: uninstalltool_setup.exe, pid: 4848, offset: 0x785c4f3464785c58, length: 0x00021102" } ], "new_data": [], "alert": false, "families": [] }, { "name": "antianalysis_tls_section", "description": "Contains .tls (Thread Local Storage) section", "categories": [ "anti-analysis" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "section": { "name": ".tls", "raw_address": "0x00000000", "virtual_address": "0x000c1000", "virtual_size": "0x00000018", "size_of_data": "0x00000000", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000000", "entropy": "0.00" } } ], "new_data": [], "alert": false, "families": [] }, { "name": "network_http", "description": "Performs some HTTP requests", "categories": [ "network" ], "severity": 2, "weight": 1, "confidence": 30, "references": [], "data": [ { "url": "http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c" }, { "url": "http://r13.c.lencr.org/101.crl" } ], "new_data": [], "alert": false, "families": [] }, { "name": "packer_unknown_pe_section_name", "description": "The binary contains an unknown PE section name indicative of packing", "categories": [ "packer" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "unknown section": { "name": ".itext", "raw_address": "0x000adc00", "virtual_address": "0x000af000", "virtual_size": "0x000017f0", "size_of_data": "0x00001800", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.22" } }, { "unknown section": { "name": ".didata", "raw_address": "0x000b4600", "virtual_address": "0x000bf000", "virtual_size": "0x000001a4", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "2.75" } } ], "new_data": [], "alert": false, "families": [] }, { "name": "contains_pe_overlay", "description": "The PE file contains an overlay", "categories": [ "static" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "overlay": "Contains overlay at offset 0x000daa00 with size: 6090440 bytes" } ], "new_data": [], "alert": false, "families": [] }, { "name": "discover_registry_mount_points", "description": "Queries registry mount points to identify historical or connected removable/network drives", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 20, "references": [], "data": [ { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-300300000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-100000000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e1e1ae7a-0000-0000-0000-10e008000000}\\Generation" } ], "new_data": [], "alert": false, "families": [] }, { "name": "dropper", "description": "Drops a binary and executes it", "categories": [ "dropper" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "binary": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" } ], "new_data": [], "alert": false, "families": [] }, { "name": "injection_rwx", "description": "Creates RWX memory", "categories": [ "injection" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 4848, "cid": 147 } ], "new_data": [], "alert": false, "families": [] }, { "name": "hardware_id_profiling", "description": "Queries the Volume Serial Number or Physical Hardware ID, possibly for anti-sandbox, victim profiling or environmental keying", "categories": [ "evasion", "recon", "anti-sandbox" ], "severity": 3, "weight": 4, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 4848, "cid": 192 } ], "new_data": [], "alert": false, "families": [] }, { "name": "deletes_executed_files", "description": "Deletes executed files from disk", "categories": [ "persistence", "stealth" ], "severity": 3, "weight": 1, "confidence": 100, "references": [], "data": [ { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp\\uninstalltool_setup.tmp" }, { "file": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\is-L98WW7Q0MB.tmp" } ], "new_data": [], "alert": false, "families": [] } ], "malscore": 7.0, "ttps": [ { "signature": "stealth_network", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "hardware_id_profiling", "ttps": [ "T1082" ], "mbcs": [ "E1082", "E1480.001" ] }, { "signature": "privilege_elevation_check", "ttps": [ "T1033", "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "query_fips_reconnaissance", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "mountpoints_volume_discovery", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "reads_self", "ttps": [ "T1071" ], "mbcs": [ "OC0001", "C0051" ] }, { "signature": "antianalysis_tls_section", "ttps": [ "T1055" ], "mbcs": [ "B0002", "B0003", "E1055" ] }, { "signature": "network_http", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "packer_unknown_pe_section_name", "ttps": [ "T1027.002", "T1027" ], "mbcs": [ "OB0001", "OB0002", "OB0006", "F0001" ] }, { "signature": "contains_pe_overlay", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "deletes_executed_files", "ttps": [ "T1070" ], "mbcs": [ "F0007" ] }, { "signature": "discover_registry_mount_points", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "dropper", "ttps": [ "T1129" ], "mbcs": [ "OB0009", "B0023" ] } ], "malstatus": "Malicious" }