{ "statistics": { "processing": [ { "name": "CAPE", "time": 2.993 }, { "name": "AnalysisInfo", "time": 0.04 }, { "name": "BehaviorAnalysis", "time": 0.527 }, { "name": "Debug", "time": 0.002 }, { "name": "NetworkAnalysis", "time": 2.737 }, { "name": "UrlAnalysis", "time": 0.0 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.001 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "hardware_id_profiling", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "amsi_enumeration", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "suspicious_ntdll_disk_load", "time": 0.0 }, { "name": "direct_syscall_evasion", "time": 0.0 }, { "name": "unbacked_syscall_execution", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "privilege_elevation_check", "time": 0.0 }, { "name": "dotnet_code_compile", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "query_fips_reconnaissance", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "debugs_self", "time": 0.0 }, { "name": "decoy_document", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_self", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "dllload_suspicious_directory", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "install_kernel_driver_service", "time": 0.0 }, { "name": "malformed_dll_loading", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "encrypted_ioc", "time": 0.0 }, { "name": "registers_vectored_exception_handler", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_module_stomping_probing", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "injection_rwx", "time": 0.0 }, { "name": "section_mapping_injection", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "apc_injection", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "interprocess_comms_mutex", "time": 0.0 }, { "name": "interprocess_comms_named_pipe", "time": 0.0 }, { "name": "interprocess_comms_shared_memory", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "unbacked_exception_filter", "time": 0.0 }, { "name": "unbacked_process_mitigation_alteration", "time": 0.0 }, { "name": "thread_unbacked_memory", "time": 0.0 }, { "name": "unbacked_api_resolution", "time": 0.0 }, { "name": "unbacked_dotnet_execution", "time": 0.0 }, { "name": "unbacked_library_load", "time": 0.0 }, { "name": "unbacked_memory_apc_execution", "time": 0.0 }, { "name": "unbacked_memory_protection_alteration", "time": 0.0 }, { "name": "unbacked_mutex_creation", "time": 0.0 }, { "name": "unbacked_process_creation", "time": 0.0 }, { "name": "unbacked_veh_registration", "time": 0.0 }, { "name": "unbacked_com_instantiation", "time": 0.0 }, { "name": "unbacked_crypto_operations", "time": 0.0 }, { "name": "unbacked_delay_execution", "time": 0.0 }, { "name": "unbacked_file_dropping", "time": 0.0 }, { "name": "unbacked_process_enumeration", "time": 0.0 }, { "name": "unbacked_registry_modification", "time": 0.0 }, { "name": "unbacked_service_manipulation", "time": 0.0 }, { "name": "unbacked_token_manipulation", "time": 0.0 }, { "name": "unbacked_wmi_execution", "time": 0.0 }, { "name": "unbacked_bind_shell", "time": 0.0 }, { "name": "unbacked_dns_resolution", "time": 0.0 }, { "name": "unbacked_memory_network_connection", "time": 0.0 }, { "name": "unbacked_named_pipe_creation", "time": 0.0 }, { "name": "unbacked_useragent_retrieval", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "etherhiding_smart_contract_call", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "network_document_http", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "office_write_exe", "time": 0.0 }, { "name": "decompress_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_network_connection", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "ransomware_iocp_asynchronous_encryption", "time": 0.0 }, { "name": "kernel_crypto_driver_abuse", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_extension_hijack", "time": 0.0 }, { "name": "mass_file_modification_access", "time": 0.0 }, { "name": "ransomware_attribute_stripping", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "mass_ransom_note_drop", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "reads_self", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "removes_zoneid_ads", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_file", "time": 0.0 }, { "name": "stealth_system_procname", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "binary_yara", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "byod_loldrivers_match", "time": 0.0 }, { "name": "byod_novel_driver", "time": 0.0 }, { "name": "byod_post_load_exploitation", "time": 0.0 }, { "name": "byod_driver_service_install", "time": 0.0 }, { "name": "com_spawned_process", "time": 0.0 }, { "name": "phishing_kit_detected", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_country_distribution", "time": 0.0 }, { "name": "network_cnc_http", "time": 0.0 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.003 }, { "name": "network_excessive_udp", "time": 0.0 }, { "name": "network_http", "time": 0.0 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_questionable_http_path", "time": 0.0 }, { "name": "network_questionable_https_path", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.001 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "pe_deep_entrypoint", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pdf_annot_urls_checker", "time": 0.0 }, { "name": "pe_cert_invalid_signature", "time": 0.0 }, { "name": "pe_cert_self_signed", "time": 0.0 }, { "name": "pe_cert_suspicious_issuer", "time": 0.0 }, { "name": "polymorphic", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.0 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "browser_credential_theft_headless", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "suspicious_html_body", "time": 0.0 }, { "name": "suspicious_html_name", "time": 0.0 }, { "name": "suspicious_html_title", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.001 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.001 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.006 }, { "name": "antianalysis_detectreg", "time": 0.145 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.012 }, { "name": "antiav_detectreg", "time": 0.659 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.002 }, { "name": "antiemu_windefend", "time": 0.001 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.011 }, { "name": "antivm_generic_bios", "time": 0.007 }, { "name": "antivm_generic_diskreg", "time": 0.024 }, { "name": "antivm_hyperv_keys", "time": 0.011 }, { "name": "antivm_parallels_keys", "time": 0.034 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.001 }, { "name": "antivm_vbox_files", "time": 0.005 }, { "name": "antivm_vbox_keys", "time": 0.071 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.002 }, { "name": "antivm_vmware_keys", "time": 0.05 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.022 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.033 }, { "name": "ketrican_regkeys", "time": 0.005 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.001 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "executes_headless_browser", "time": 0.0 }, { "name": "suspicious_browser_arguments", "time": 0.001 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.0 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.011 }, { "name": "checks_uac_status", "time": 0.002 }, { "name": "uac_bypass_cmstpcom", "time": 0.0 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "clears_logs", "time": 0.001 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.001 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_credential_store_access", "time": 0.002 }, { "name": "registry_lsa_secrets_access", "time": 0.001 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.001 }, { "name": "disables_browser_warn", "time": 0.001 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.001 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.0 }, { "name": "removes_windows_defender_contextmenu", "time": 0.0 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "folder_enumeration", "time": 0.002 }, { "name": "discover_registry_mount_points", "time": 0.002 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "infostealer_bitcoin", "time": 0.006 }, { "name": "infostealer_ftp", "time": 0.223 }, { "name": "infostealer_im", "time": 0.127 }, { "name": "infostealer_mail", "time": 0.035 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.021 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "modify_certs", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.0 }, { "name": "modify_uac_prompt", "time": 0.0 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.001 }, { "name": "network_dns_paste_site", "time": 0.001 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.001 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.005 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.004 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.001 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.002 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.009 }, { "name": "ransomware_files", "time": 0.022 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "reads_password_database", "time": 0.001 }, { "name": "recon_fingerprint", "time": 0.005 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.001 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.001 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.0 }, { "name": "tampers_etw", "time": 0.001 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.211 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.002 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.002 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "target": { "category": "file", "file": { "name": "vs_Community_1_.exe", "path": "/opt/CAPEv2/storage/binaries/79c9902767596462a437e153fb1403bdfeb9b2d4ddc2f569a130649254eb27c6", "guest_paths": "", "size": 4462512, "crc32": "F30D72B9", "md5": "4ac02923d47a5c559e04312c22708174", "sha1": "0d1771aa398877d80f554f2c352c621205141dcd", "sha256": "79c9902767596462a437e153fb1403bdfeb9b2d4ddc2f569a130649254eb27c6", "sha512": "e27480067816976cfaddc92094e324da3fcd34bb28e6a6dc5258d853364bbd19da0fd6f34b1d1c1ba6bffd0b3a529c2dd762c54e3e611fe3fb010f4a963fe5f8", "rh_hash": null, "ssdeep": "98304:IEIOawEveQQgZP2A+3CWGLAllEITi9cRZPPhYPB2vyoMEmLwJ:jqv4S/kCWGOlEI29cXnhYsqCoK", "type": "PE32 executable (GUI) Intel 80386, for MS Windows", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T13226235238C8507FDD2F1635075FE6B219BAAAE07B84489F5F403A2C4D3568248B9FDB", "sha3_384": "21196cb44abde9e0c4a9ea2907ad23e1774c350b0d9d5908487b4e627ea738c3f2671945a161449e8ff2078087191ec2", "yara_hash": "68e243d1d9aeb1f1e94057af9823c58e140832514ed3e7b46b181bf94e4e12ce", "options_hash": "b7818797508282994ea72592ded64b364725c9400a38d418189579c94a89385e", "pe": { "guest_signers": { "aux_sha1": null, "aux_timestamp": null, "aux_valid": false, "aux_error": true, "aux_error_desc": "File not found: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\60\\vs_Community_1_.exe", "aux_signers": [] }, "digital_signers": [], "imagebase": "0x00400000", "entrypoint": "0x0001e090", "ep_bytes": "e8d1040000e978feffff558bec8b4508", "peid_signatures": null, "reported_checksum": "0x0044fd7a", "actual_checksum": "0x0044fd7a", "osversion": "5.1", "machine_type": "IMAGE_FILE_MACHINE_I386", "pdbpath": "D:\\a\\_work\\1\\s\\bin\\BoxStub\\Release\\Win32\\boxstub.pdb", "imports": { "ole32": { "dll": "ole32.dll", "imports": [ { "address": "0x43b28c", "name": "CoInitializeEx" } ] }, "COMCTL32": { "dll": "COMCTL32.dll", "imports": [] }, "RPCRT4": { "dll": "RPCRT4.dll", "imports": [ { "address": "0x43b224", "name": "RpcStringFreeW" }, { "address": "0x43b228", "name": "UuidToStringW" }, { "address": "0x43b22c", "name": "UuidCreate" } ] }, "SHELL32": { "dll": "SHELL32.dll", "imports": [ { "address": "0x43b234", "name": "CommandLineToArgvW" }, { "address": "0x43b238", "name": "SHBrowseForFolderW" }, { "address": "0x43b23c", "name": "SHGetPathFromIDListW" }, { "address": "0x43b240", "name": "ShellExecuteExW" } ] }, "SHLWAPI": { "dll": "SHLWAPI.dll", "imports": [ { "address": "0x43b248", "name": "PathRemoveExtensionW" } ] }, "USER32": { "dll": "USER32.dll", "imports": [ { "address": "0x43b250", "name": "PostQuitMessage" }, { "address": "0x43b254", "name": "SetWindowTextW" }, { "address": "0x43b258", "name": "GetDlgItem" }, { "address": "0x43b25c", "name": "DialogBoxParamW" }, { "address": "0x43b260", "name": "GetWindowLongW" }, { "address": "0x43b264", "name": "SendMessageW" }, { "address": "0x43b268", "name": "GetWindow" }, { "address": "0x43b26c", "name": "GetWindowThreadProcessId" }, { "address": "0x43b270", "name": "GetTopWindow" }, { "address": "0x43b274", "name": "MessageBoxW" }, { "address": "0x43b278", "name": "SetWindowLongW" }, { "address": "0x43b27c", "name": "PostMessageW" }, { "address": "0x43b280", "name": "LoadStringW" }, { "address": "0x43b284", "name": "EndDialog" } ] }, "ADVAPI32": { "dll": "ADVAPI32.dll", "imports": [ { "address": "0x43b000", "name": "RegQueryValueExW" }, { "address": "0x43b004", "name": "RegOpenKeyExW" }, { "address": "0x43b008", "name": "DecryptFileW" }, { "address": "0x43b00c", "name": "CryptReleaseContext" }, { "address": "0x43b010", "name": "CryptGenRandom" }, { "address": "0x43b014", "name": "CryptAcquireContextW" }, { "address": "0x43b018", "name": "RegCloseKey" } ] }, "KERNEL32": { "dll": "KERNEL32.dll", "imports": [ { "address": "0x43b028", "name": "GetSystemInfo" }, { "address": "0x43b02c", "name": "FileTimeToSystemTime" }, { "address": "0x43b030", "name": "VirtualProtect" }, { "address": "0x43b034", "name": "FileTimeToLocalFileTime" }, { "address": "0x43b038", "name": "MoveFileExW" }, { "address": "0x43b03c", "name": "CreateEventA" }, { "address": "0x43b040", "name": "GlobalAlloc" }, { "address": "0x43b044", "name": "SetCurrentDirectoryW" }, { "address": "0x43b048", "name": "GetCurrentDirectoryW" }, { "address": "0x43b04c", "name": "RemoveDirectoryW" }, { "address": "0x43b050", "name": "GetFileAttributesW" }, { "address": "0x43b054", "name": "DeleteFileW" }, { "address": "0x43b058", "name": "VirtualQuery" }, { "address": "0x43b05c", "name": "LoadLibraryExA" }, { "address": "0x43b060", "name": "ExitThread" }, { "address": "0x43b064", "name": "GlobalFree" }, { "address": "0x43b068", "name": "WaitForMultipleObjects" }, { "address": "0x43b06c", "name": "FileTimeToDosDateTime" }, { "address": "0x43b070", "name": "TlsSetValue" }, { "address": "0x43b074", "name": "GetModuleHandleW" }, { "address": "0x43b078", "name": "GetTickCount" }, { "address": "0x43b07c", "name": "SetEnvironmentVariableW" }, { "address": "0x43b080", "name": "GetLastError" }, { "address": "0x43b084", "name": "ExpandEnvironmentStringsW" }, { "address": "0x43b088", "name": "Sleep" }, { "address": "0x43b08c", "name": "GetProcessId" }, { "address": "0x43b090", "name": "WaitForSingleObject" }, { "address": "0x43b094", "name": "GetExitCodeProcess" }, { "address": "0x43b098", "name": "CloseHandle" }, { "address": "0x43b09c", "name": "SetFileAttributesW" }, { "address": "0x43b0a0", "name": "InitializeCriticalSection" }, { "address": "0x43b0a4", "name": "CreateEventW" }, { "address": "0x43b0a8", "name": "CreateThread" }, { "address": "0x43b0ac", "name": "DeleteCriticalSection" }, { "address": "0x43b0b0", "name": "EnterCriticalSection" }, { "address": "0x43b0b4", "name": "LeaveCriticalSection" }, { "address": "0x43b0b8", "name": "SetEvent" }, { "address": "0x43b0bc", "name": "GetCommandLineW" }, { "address": "0x43b0c0", "name": "lstrlenW" }, { "address": "0x43b0c4", "name": "CompareStringW" }, { "address": "0x43b0c8", "name": "LocalFree" }, { "address": "0x43b0cc", "name": "CreateDirectoryW" }, { "address": "0x43b0d0", "name": "LoadLibraryW" }, { "address": "0x43b0d4", "name": "GetProcAddress" }, { "address": "0x43b0d8", "name": "GetSystemDirectoryW" }, { "address": "0x43b0dc", "name": "SetDefaultDllDirectories" }, { "address": "0x43b0e0", "name": "FreeLibrary" }, { "address": "0x43b0e4", "name": "SystemTimeToTzSpecificLocalTime" }, { "address": "0x43b0e8", "name": "GetSystemTime" }, { "address": "0x43b0ec", "name": "GetTimeZoneInformation" }, { "address": "0x43b0f0", "name": "FormatMessageW" }, { "address": "0x43b0f4", "name": "GetTempPathW" }, { "address": "0x43b0f8", "name": "lstrlenA" }, { "address": "0x43b0fc", "name": "InitializeCriticalSectionAndSpinCount" }, { "address": "0x43b100", "name": "ResetEvent" }, { "address": "0x43b104", "name": "WaitForSingleObjectEx" }, { "address": "0x43b108", "name": "UnhandledExceptionFilter" }, { "address": "0x43b10c", "name": "SetUnhandledExceptionFilter" }, { "address": "0x43b110", "name": "GetCurrentProcess" }, { "address": "0x43b114", "name": "TerminateProcess" }, { "address": "0x43b118", "name": "IsProcessorFeaturePresent" }, { "address": "0x43b11c", "name": "IsDebuggerPresent" }, { "address": "0x43b120", "name": "GetStartupInfoW" }, { "address": "0x43b124", "name": "QueryPerformanceCounter" }, { "address": "0x43b128", "name": "GetCurrentProcessId" }, { "address": "0x43b12c", "name": "GetCurrentThreadId" }, { "address": "0x43b130", "name": "GetSystemTimeAsFileTime" }, { "address": "0x43b134", "name": "InitializeSListHead" }, { "address": "0x43b138", "name": "RtlUnwind" }, { "address": "0x43b13c", "name": "SetLastError" }, { "address": "0x43b140", "name": "EncodePointer" }, { "address": "0x43b144", "name": "TlsAlloc" }, { "address": "0x43b148", "name": "TlsGetValue" }, { "address": "0x43b14c", "name": "FreeLibraryAndExitThread" }, { "address": "0x43b150", "name": "TlsFree" }, { "address": "0x43b154", "name": "LoadLibraryExW" }, { "address": "0x43b158", "name": "RaiseException" }, { "address": "0x43b15c", "name": "GetStdHandle" }, { "address": "0x43b160", "name": "WriteFile" }, { "address": "0x43b164", "name": "GetModuleFileNameW" }, { "address": "0x43b168", "name": "ExitProcess" }, { "address": "0x43b16c", "name": "GetModuleHandleExW" }, { "address": "0x43b170", "name": "HeapFree" }, { "address": "0x43b174", "name": "HeapAlloc" }, { "address": "0x43b178", "name": "GetFileType" }, { "address": "0x43b17c", "name": "LCMapStringW" }, { "address": "0x43b180", "name": "FindClose" }, { "address": "0x43b184", "name": "FindFirstFileExW" }, { "address": "0x43b188", "name": "FindNextFileW" }, { "address": "0x43b18c", "name": "IsValidCodePage" }, { "address": "0x43b190", "name": "GetACP" }, { "address": "0x43b194", "name": "GetOEMCP" }, { "address": "0x43b198", "name": "GetCPInfo" }, { "address": "0x43b19c", "name": "GetCommandLineA" }, { "address": "0x43b1a0", "name": "MultiByteToWideChar" }, { "address": "0x43b1a4", "name": "WideCharToMultiByte" }, { "address": "0x43b1a8", "name": "GetEnvironmentStringsW" }, { "address": "0x43b1ac", "name": "FreeEnvironmentStringsW" }, { "address": "0x43b1b0", "name": "SetStdHandle" }, { "address": "0x43b1b4", "name": "GetStringTypeW" }, { "address": "0x43b1b8", "name": "GetProcessHeap" }, { "address": "0x43b1bc", "name": "GetFileSizeEx" }, { "address": "0x43b1c0", "name": "SetFilePointerEx" }, { "address": "0x43b1c4", "name": "FlushFileBuffers" }, { "address": "0x43b1c8", "name": "GetConsoleOutputCP" }, { "address": "0x43b1cc", "name": "GetConsoleMode" }, { "address": "0x43b1d0", "name": "HeapSize" }, { "address": "0x43b1d4", "name": "HeapReAlloc" }, { "address": "0x43b1d8", "name": "ReadFile" }, { "address": "0x43b1dc", "name": "DecodePointer" }, { "address": "0x43b1e0", "name": "CreateFileW" }, { "address": "0x43b1e4", "name": "WriteConsoleW" }, { "address": "0x43b1e8", "name": "DuplicateHandle" }, { "address": "0x43b1ec", "name": "FindFirstFileW" }, { "address": "0x43b1f0", "name": "SetEndOfFile" }, { "address": "0x43b1f4", "name": "SetFilePointer" }, { "address": "0x43b1f8", "name": "DosDateTimeToFileTime" }, { "address": "0x43b1fc", "name": "LocalFileTimeToFileTime" }, { "address": "0x43b200", "name": "SetFileTime" }, { "address": "0x43b204", "name": "CreateFileA" }, { "address": "0x43b208", "name": "GetVersionExW" }, { "address": "0x43b20c", "name": "GetLocalTime" }, { "address": "0x43b210", "name": "GetComputerNameW" } ] }, "OLEAUT32": { "dll": "OLEAUT32.dll", "imports": [ { "address": "0x43b218", "name": "SysAllocString" }, { "address": "0x43b21c", "name": "VariantClear" } ] } }, "exported_dll_name": "boxstub.exe", "exports": [ { "address": "0x43e000", "name": "?dwPlaceholder@@3PAEA", "ordinal": 1 } ], "dirents": [ { "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "virtual_address": "0x00038e50", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "virtual_address": "0x0003b298", "size": "0x000000c8" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "virtual_address": "0x0003f000", "size": "0x0002bf88" }, { "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "virtual_address": "0x0043f058", "size": "0x00002758" }, { "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "virtual_address": "0x0006b000", "size": "0x00002710" }, { "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "virtual_address": "0x00008980", "size": "0x00000054" }, { "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_TLS", "virtual_address": "0x000089d4", "size": "0x00000018" }, { "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "virtual_address": "0x00006c18", "size": "0x00000040" }, { "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_IAT", "virtual_address": "0x0003b000", "size": "0x00000294" }, { "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "virtual_address": "0x00038cc0", "size": "0x00000060" }, { "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "virtual_address": "0x00000000", "size": "0x00000000" }, { "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "virtual_address": "0x00000000", "size": "0x00000000" } ], "sections": [ { "name": ".text", "raw_address": "0x00000400", "virtual_address": "0x00001000", "virtual_size": "0x00037ea4", "size_of_data": "0x00038000", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x60000020", "entropy": "6.56" }, { "name": ".data", "raw_address": "0x00038400", "virtual_address": "0x00039000", "virtual_size": "0x00001e80", "size_of_data": "0x00000e00", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "2.50" }, { "name": ".idata", "raw_address": "0x00039200", "virtual_address": "0x0003b000", "virtual_size": "0x0000117e", "size_of_data": "0x00001200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.45" }, { "name": ".didat", "raw_address": "0x0003a400", "virtual_address": "0x0003d000", "virtual_size": "0x0000002c", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "characteristics_raw": "0xc0000040", "entropy": "0.45" }, { "name": ".boxld01", "raw_address": "0x0003a600", "virtual_address": "0x0003e000", "virtual_size": "0x000000b8", "size_of_data": "0x00000200", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "1.67" }, { "name": ".rsrc", "raw_address": "0x0003a800", "virtual_address": "0x0003f000", "virtual_size": "0x0002bf88", "size_of_data": "0x0002c000", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x40000040", "entropy": "5.65" }, { "name": ".reloc", "raw_address": "0x00066800", "virtual_address": "0x0006b000", "virtual_size": "0x00002710", "size_of_data": "0x00002800", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ", "characteristics_raw": "0x42000040", "entropy": "6.59" } ], "overlay": { "offset": "0x00069000", "size": "0x003d87b0" }, "resources": [ { "name": "RT_ICON", "offset": "0x0003f460", "size": "0x000074cb", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "7.98" }, { "name": "RT_ICON", "offset": "0x0004692c", "size": "0x000094a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.63" }, { "name": "RT_ICON", "offset": "0x0004fdd4", "size": "0x000067e8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.74" }, { "name": "RT_ICON", "offset": "0x000565bc", "size": "0x00005488", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.73" }, { "name": "RT_ICON", "offset": "0x0005ba44", "size": "0x00004228", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.78" }, { "name": "RT_ICON", "offset": "0x0005fc6c", "size": "0x00003a48", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.81" }, { "name": "RT_ICON", "offset": "0x000636b4", "size": "0x000025a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.86" }, { "name": "RT_ICON", "offset": "0x00065c5c", "size": "0x00001a68", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "4.99" }, { "name": "RT_ICON", "offset": "0x000676c4", "size": "0x000010a8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.12" }, { "name": "RT_ICON", "offset": "0x0006876c", "size": "0x00000988", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.16" }, { "name": "RT_ICON", "offset": "0x000690f4", "size": "0x000006b8", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.39" }, { "name": "RT_ICON", "offset": "0x000697ac", "size": "0x00000468", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.56" }, { "name": "RT_DIALOG", "offset": "0x00069c14", "size": "0x0000011c", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.15" }, { "name": "RT_DIALOG", "offset": "0x00069d30", "size": "0x00000170", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.34" }, { "name": "RT_STRING", "offset": "0x00069ea0", "size": "0x00000582", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.12" }, { "name": "RT_STRING", "offset": "0x0006a424", "size": "0x00000228", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.25" }, { "name": "RT_STRING", "offset": "0x0006a64c", "size": "0x0000004e", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "2.09" }, { "name": "RT_GROUP_ICON", "offset": "0x0006a69c", "size": "0x000000ae", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.21" }, { "name": "RT_VERSION", "offset": "0x0006a74c", "size": "0x0000037c", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "3.47" }, { "name": "RT_MANIFEST", "offset": "0x0006aac8", "size": "0x000004c0", "filetype": null, "language": "LANG_ENGLISH", "sublanguage": "SUBLANG_ENGLISH_US", "entropy": "5.32" } ], "versioninfo": [ { "name": "CompanyName", "value": "Microsoft Corporation" }, { "name": "FileDescription", "value": "Visual Studio Installer" }, { "name": "FileVersion", "value": "17.14.37411.7" }, { "name": "InternalName", "value": "vs_community.exe" }, { "name": "OriginalFilename", "value": "vs_community.exe" }, { "name": "ProductName", "value": "Microsoft Visual Studio Community" }, { "name": "ProductVersion", "value": "Visual Studio 2022" }, { "name": "LegalCopyright", "value": "© Microsoft Corporation. All rights reserved." }, { "name": "Translation", "value": "0x0409 0x04b0" } ], "imphash": "f110885d852ff89401e593e1d379b595", "timestamp": "2025-08-18 22:03:19", "icon": "iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAZd0lEQVR4nO1de3Bc5XX/ne/uriQbbOFHAD/CCvOoO0AkA2mTTILVziQlf3RkMyUh0zT2dNqUToJX/JNMkuLVTF6knVjuME3apLXdTuoABankAUwmsdJMSYAUieIECHa0jgkQHpawAVm7936nf3yvc++uXivJMXaPZ7V3737P8/yd813JhP8nlHq+0cmgXQB3AgyABgnVvv7B7ZXFnlst9gSnO5V69hQZOADwZmZuZ0Y7M29b2rZ89Hu3/2bnYs9Piz3B6UyG+YUDYBSZGGCAweZLZly+fgO6N72zUq2e7O66ua2yGGs4ay2g1LOnndFyAECRAcF882Iwfv3KC2DmYj7fMvqzf+ZFsYazVgCMlgGADfM9480bs7k+8fqJ0J65fPDrenT4KxPFhVzHWSmAUs+/7zI+HwgaD4DZuyC218xeNGCgmM+3jD7xtYWzhrNOALf07N/JQMl8Yst01DHfuSGyUdLcsi1o4azhrBJA7w3f3EHgctBpd9WY+cyW8YCHK2Q7MVDM5QqjT8wzNpw1Aij1fKOTE+53n5mDEIKPCeKwKg9nJeYzeYH5n/OMDWeFAEo9+4uAGghabu6z0H/3ztBeOMwsbEW2M4OQfWfmYq7J2HDGC6DUs79IhAMgLvqbFCAnswYgLMKnAQIZ2SsS7YR9AERWWLr8v3O0hjNeAERqgIFi4GXasZPPRdkLBWAjpEwAYABE5L72xCmoxMUoV5i1NZzRArh16527GLrTq2/KoUAgn2xQJmgd7rO/a5ktArIXEqUGALMuP/5PyYzWcMYKoLT1zp3MXPLam/Yw4crFWH/t3BKn7rkeWRdEHqeKIa2QiDCjNSxILWh/ebTYwtEeZnQC3M5Mg7Va0nvTFzsqCzH+XKn3hrt2QOt+45t1pszggms22FrGi2tmxse2/IVVdYR3hGuJioC0QNh2sk0rOqnW1ZTmbQEDtx3dUdBqmJk3A1gOAKTQUyio4bs+Ndo53/HnSqWeuzrB3J9WrbTr4cA5+GzYBWOwQD8sPmfGEDGFMnqcbu9cFhdVlB994mtJyhqatoA95dH2do52aqBEDGYwOTQgVjKuE+6+8fMdI83OMxcq9ewvKqUOMKOYdjaWiQLbZ+85jZfaDzA+tvUvg5BgNJyZ/buk6b6zLexcqLCudXfd3FZpygL2l0eLy7Ua1swlu2hKYeMwYTtF6genwhI884GiXwRRneYCwd+nIWe9LuqU0ACAfNtGDPYuTWeDPUBk1NQuq6ii/PDwVyaKcxbAQN/RHQUdDTNREQhIwLlHC8n8CohwnorU8H/cduQjc51rLhRF0QBg1mRnDpmtRCrkIKV3Db5NGhOlGQ+EtmjIfHGd/ZIArZnEksDM7VGU3zNrAewpjbYP7PzVLq25H4T29CLIZ4d2eALLrTCYee9iCeHWrXfvYqDTrARCxSWFzDVNlAX1skvK/WTrQoKZkGCIvJDFLCKvYLbuCuiclQD2f3K0uGyZGtZASVao/Hooe5G5dgvVvPeuzxzZMZs5Z0u3br17J8AlY+Z2qmkCcOqWC5ZZD8Qh8JLVWmakKqNuHpchBN1zUBZegC6oG8GwHKN9RgEM3HZ0R0tLNAygKLXDDegng/el7K69S/KxhwHo/ntuOzIlLp4L9d5w1w6Ay35NggmNiDMNUrup8/dAClQIQXj8mWqe7u+EZd5JWBOsKzQLnlIA3uVA9wNo976T5ZxGLSitcf5TJqyRM81E6/Ldn5mfEEo9+zcToz97X0JCx6sMSGwwmtBM/2ILTR3gz0jXD1ovNCcMzggFVhgsvEhDAewvjxaXLzMoB4DvwGF8sZ8QcX0ghhewyBzZQzTj/7h892dGmxKCQTzRQKPvjMU5x2A3PJfBvc+XNSJLUrUE1k9l2Q0QlRety5DFd3UCGLjt6I4WjoYZKGYHyQI1kcKH3EYuBiIztAt32Nv66zkLwTL/AID2hg2yCkJugf5DQ3IAmoRmGxcqFIvdEWUa3LrYk2qXWYq3LJ2KAUEAe8rO5XA/122O0trtpeiWzcHyJWLzQateB909zVy++1OzE0KpZ0+7gZtp5ZiKwqwktIPSLTJZrixPACKwO1dGooYqLDxVpaB0oc4xRwBgON7lAOCDm79QfOgn3zrw2snjxYnJ17Fm1Xq8/XfejXPalgWcLxgrDya8mYuFk0uA2FlAnXMSqIKgCeU7Pz3a/oHPdfROx1Clltp60zQk3bH/yIKRMzgkC3uICKx1YL7D8JThh5xS+GJ2G2SAKeRJFn7a1RGrD27+QjGvCsNvTE4WifJoLZyLl8dfxncfvgfHTrzkNxDcC9sMM8wZHmYKLkdBMXnBpIKG3Ke8X7rrb0b3TMUXCzd7pueeFaoXur/rp067IkIGQbjAZRuSb5ZCP64ZOGS4GcX0ws6kSMIQGQBUPmrdBXC7WTLZIBmBWWFo5EG8NvGqQTqhezBHpFGHvGTizM7E3vw+nCbZFWls++anD9cJwZSWdbnewdfNINaScS2p9Qr1aWgRHPgfuOnvuXzZegcPAyUvKHSjTEz3I2nWpAjcY5yW0xqyPoxQrVVx/8P3YLJ20ruWLAxKP03g9pSym7Aor3AMYmJfvIJ9LhAMAm2781OHB/aURtsB4GM9/9YDnZTNaHpa9nuA7ZmWZohfYF3AkiTCp0Q6rrUA806RfFHPK5P5PqgtCyQpXDVEEPZLInPbWIJCNU7wg8e+BWlLqVwg1U/oVkazQuUR1oUxGZ9qrsVIzEQ9S5bwgfKHBjqJeY9mDVfXzwbNevYF/zwd5smSjUzTdpTuy9eS/JbcuTBsiGtQwkYaFTIAJQKCYbp3QwpECpHK4diJMfzkqaEAr1SdA0+hhka78AJKWQenKoeGv5pM4ELnuvMvHiagnVkb/bcnVbLOlGVR2sHMEHDFMhmurp+NCZlxpvCCMg565RL79e2EpyAQlDcU4YIUKfuKoChCpPI4/OzTeOyZh/wg7nA6O3iYz5la8PnkMiRtVJ7dtFy3TjAzlradg02XXYNCPg+tE4Q6fRDgdDEh5RFSq5ruhu/ZsI2WpWYRSrKHMimUJEs4gRlgcNoFEQBF5DWBhDByuQJ+VhnBL44+YRYi8bIww8D4YBGiUkgEMgEAASu79WcPuAlAS74FV3ZchUI+D2YNbV++1pTihMTb9qqRFBpySiYwvv14yGXc7ZCgWRsWPh4CMcHD1oAG5ZoMqfSOyb8UKSilQEqBKAKgUMgtwfChR/DK8RfNoH77KWFYCExhoWaFgAmjtlrnFkiC4UbwsmwLAC35VlzRcRXyuZy1AmsJ/gw3TZx5T4skU5pohILMrYrmpNszMWXwQUghz5HTyDzHF3EaJqSiFEHhn/X/7qWUsQIiBUBh6PEHcGLi1UyZIQzjMX5YRAAQLE7NskpHQZhuc2Q1prXQiisvfhvy1hLkESLq+mT4UbfE9IeM8wCBKgnVuvd+r3fE1fEl72RyGVw6i3bhO7NdyvKKXdsGxTjK6IsCQXlXRBShFtfw4KP34mTtpB0tPYIs+/oExhbhUim1eGsUCDySsDxuybfiSmsJmjU0rAU4zCGFUh+i/Jjykxs+7BiVKtC994HeSnpvwuG5PclxbHwLeY3sY9Ym9unFPkU52iGhNCIiH5xziLXG0PB34CaVzJOxwG9ZVLW863GBwA5S/3QBQgP71pJvwRUdV6KQi6B1EuJB5lme+tHQwGLlZwYBFWLu3vvAzRV5P0RI16cebMBCaa25bp6AAFO7AzDNeYCbTMJS5YUQQVEOYyfGAP+sfYCZEu/LNbLWabfjNTBosQ/oYjwZ2ACgtdCGKzquQltLm4kqziUBRhDUCIWjzsLCLgECVaCT7q+mmC+1PcS5Ov0WQZfICEFO5QCLP5wRY08jAOd/03FBCWuIojxu/GzHbgLKAcWk8FfYYV0kkzmmnNZmmLbglbauMH5roQ1XFK9CS74AzYkdzz1oa/tbFkmg0zAuMCqc1OqYn2oidSojgXpE7txOiHv+rosTZFzWjEeSqYhACiCTJSsysQEA/uSzHX1g3meFFjjnds1gbRGL9Q+ppcoPvtKY0XrZyGleLsrhyo63oTWfR6ITsNbQnEBmwwZ9hOvsWACNFPKqa0rmp2Bl0P7MuYFIgZ0LotQgHoA4p6A1gWb1ZByHGCByA4JDRYY+8LmLtwEYYWinwk4PbEgRi5K+XWiTCw1us6kIyUKjBOWiPLouvRYrl6+EFzIzdKIzCCmtphYqjxRy6O4f3D4+zfbFBQWNZ+FSPLBzMNptT84PgEh451lagI+c9lpl4KmkQh7dDKr4abMZoN1EvYe2BUPhfoILDMsgf9KR3hdAuGzt5Vi5bAUSTow1IBOcZZAGQISRnOLpme+2n77w20plxd6hsvhIWYXxWuc85CyfC8owA2SStEz3LeWOcU7QDaaKbcfyAFr+JKk0zmWw/M5lnC742b5Cod2G3aYvXXc5Vp57Hti6Ic3BCpwBmpFpX07pmZkPGEvyQV4kgVlXKsOdt/2AiMIZlYDmM6OgNMkSBWxgztJNX+yoKGALEY0z2LueDPpPaUqoF2U3FtBE+gAnIC2ybsFB1svW/S7Wrl6PRMdGENolSMZPaMa+O+778LbZMB8AEk4QJ8aqkiRBYuOM1hqs2ZdGbKgLewluAMxsnowzvsqzHwDP+dFEsq6AvCDq6cbPd4xonfQ65gg+BqaJVdRhiExOUR+M07V2B7DcWOtXr8e6Ves9czSbfCHRvO+O+z68bS77jeMqYl1DLakhTmpIdA2JTjjRCRKOjSBcMihdkuVT1kmZGE3OmBuo8IzkbDm16zq66fOX7GXFfQw2p2MyACJofDDTesgjGe8CWwjttq8d0MU9N/a6t7wVa1etg+bY9tF9c2U+ANSSKtfiScTxJGpJFbW4hlpcpVjXOI5rSHSMJImR6DhdKLSwJ6Wkcg92sU3/fgChUWaZpps+u6HM4N2+g3cV0pHXgeiwVpkD1O0jeFtvUJn4sG71eqxZuRaJjvvuuG97edabE3SyOkGTtQlM1k7a1wSq8SSq1ZNkBFI1lpHEJjMX2bnWmkIJAvBnDgKP5JpZlNvlDPwHADz4yABfc/m7sGr5+cZwhJvPpmIevdn3VF7H6XeH9VNxwTXwwY6xdvVbsWblOv7qNGssDg+053VrDyv1NmgUGegkUDvA7bfgFwCAFRM5rJjIY+3xFqw70YJLji3BqskClIpMuV7lEamEiRS5e0opX4ExAIDsoZK9waCmBTD1LyEE+qv3f21nwnFp+JlH8K4r/wBLWpaKARCYaTG1vyUZ7xqkUBOCNXlMbi5YMN8lZonW5X+85VF89O+v7XNDFocH2nM4ZweYN0PzZgZgE2lpW56OtcU41hbj0IoJf2/t8QKuq7Tj0rGlWF1tRaQiilQOETMipQBETBSRY76zgICiCPRnf7hrei7OQP/6/d6GdvDXf7xvB+u4nzlBomMACX5v43vSQvDbFVmBk0AmvxdP06Xve4cUYKs7Q050Aq1jxDpGktQQJ9W9uz863pvDOTuguQRw+3z2Luntz56L6w+vxOrJNuSiHKIoh0jlEKnIQ3Yy8J0ZTARiBjcThGemUs83OiOofiUKd8yEnz7936jFVWTUO/VmqEFcyDDfJ2ViFAO0s8yvIY6Nr364q7pt6cSSMWhdXkjmA8Aj606g77oKvt3xAqrxZIgNOkaSJL5EYuKChSbzCcIGW+q6u+bPAtAAKYKiCETGH0Yqj1qS4OdHRiC561CL/yAzBV/nzyRvQChqiejOrJGwhtYaia555o8tqeLOG6r46TXAZEvzO54NPXDpGMrv+SV+k389CELHIThDe/dJaFoA9aVewP1ZAHWASBUJ5jhTkQKpCEpFyKkCXnr1JTz97EE7Cry3ARCilXMr1ne6vCN1uO1/uiuG1mx8PhvNi+MqfnZJFXdtreGVlc3ttBk61hbjS+/8FR5bOYZqXEUc1xB7qOoyd/OzCQGwr+xJMZgHZ9UAkXlw1jBNnh+YVy5qwZEXRnH4uSfDiBkLCFlxeJo6zXyzAQeDtXbM19A6QZzEiJMaftw1ie9fFy+61jeiibzGv2x6Ad/p+A1q8SRqFqq6fMHVpuYsgKBvaaYotXQXM3W6JK3RQQ4pI4RCvg3P/PppvPLqi/UjO0QDkbCIFh5LQxTuSIORgHXChvlV/LjzJB7dlMx1ewtOD1w6hm9f/CLipIo4lSsY/s1JAKkslMMBiHlwFttcO5ekhUP+IAhlhdCSX4qRw4/ijcnXIcXq3xv4OJcw+3X4gGtesY4pTqo4tL56WjDf0YOXjuGhC8asEGqmWmsLhXMQgNt02DjrpO73tAy5Yl0DK4ARQqRyyKkCHn3qR3h98rU0vz2uRwok+ecvbRBj2N/ltYgn0TWMLY3x/ffUmmbWYtHgxpfxYmHCx4IkMUKYpQCEH/bIRKOQb0Wj39MKJB93lBbgzhQiJAw89ouHUKtVXZeQ5ImSs1iKPf4OimAKbaYmM/D+yQXx+c9sem/qNV+ayGt8fdPziBMTkDWb6urMAhCQXMJCUoTzzl0zdTdKfyBpEQjCyKk8aonGz4+OiMw4mxuItNkzn33SlWhTLv5J1yROnDuvvHJR6bllVXx3w8s2GBtYOoMAnK1zyu8qpbBq2XqoafI4WaUw6NK4JZVCRuY9pwo49uorePJXI66UI1cAOZI/qWQDOVlr1jrB2JIaHtkUz4khvw36r+KrOKEmHRqa/jzA+d3wJJp5GGrVsrXIRflZThkOZBwsJeGCXFCOogKeP/Ycfvn806Gs7IOAqwWxrf04SwQSTkhzgoe7qs1z5RTSRF5j6KIxGwuSqVXYFYzST51pnLf0fERqtsyXZKunROYB4MwjLsYSWvDL55/G88eOuh52MfaH036/HgPpxpbU8NRlpw/qmYl+1HEcr0VV6KljQJb5xtcuaWtHW8u585rcuCPl44EMzEpFKOSW4KmjB3H8jWMB81NAPS4ga1Nvh+YEz15w+rseSRN5jR9eNI5ENxRAmvFO085pa8fyJavmOTX5n/WPPNpsWZni3eM2R6grevisOBySj1zx5hIAABxaMYFEx2kBcJb5doOFfCuWzZv5jtwpWBqekivbuuppQiNvnHytm5nGwzM4ISZpm4CNL43xysrTF/lMRYdXnsTrOSOAccBln6G+45g/E9xsllw8kE9aCHg6uHRySXfvV989lOh4i4SdHhhoI4hnL3jz+P4sHTz/NSgGRgAE5jOD2WRpkYpmhJvNE3l4qlIBObfvK9/+8y39Q+axke1/t3GImEryKMyrCTO/tKK+JP5moWfPnYSKEmxn5nF3CBuKbIyVc4KbzZCo8BNBERo+NvLhv71sd4KkL9T94dwQvRndj6Oxthhq71BvJdLUlYvyFadbuVweq9svahJuzpVs9ZR5d//gn26bqtX2L20sa+J94RzA2MLx0zjznYmeW141QXjvUG9l+ZL1XW9pL+6+4LwOrFq2HrlTwnxDBPTtGvxQacaG1ZMlACO+MAec1qWHmWgiJ0oR/YNbxncN3FgCdC9sYD41xH1fvvcD5dm03N7fNT6ZVLcAXDFd37zMB0w+UBddv3zvB/u1TroAVBZ/CbNnvqOb+7sqCXM3wOOLs6ZTSw3hTf/gTRWt813M2L14U8+d+Y6MEJItIELLPEtAG9uaz+w3ti2b3+SY5kx4cV1S88x39PE73jGUICkVJmfxeN5UY1y4AfdtfAe2rph7nrN15Rrct/H38fELNzQ9/3kTuZnPAxbaJWlg+3yZ7+jWf7hud5zTQ830/fiFG3CLZd7txSvmJIStK9fg9ouuAADccuGGpoWw4o1ZCABYOJekge399964dz5jZOmNVjw+1z4b287xzHc0WyFI5ju65cINTbmyNccLsz8Tnq9LWgzmA4AiHplrnycnXsMnKgfr7s8khEbMB4BPHjmIJydONOgxPSnN/9mUAxV/ubA4i+bjWidb+gdvGmpmrpmoOHygPaerY8303bpiDW4v1jP0E5WDdfc/ceTglMy/55XnmpkecVV3NB3BSj0D7US1MhF2TNNsXGt09w/eONLsPLOhSx574ACYNjfTdyohzIbmw3wQjRza9N6upqtss3BJp4T5AICEf9hs13uPPdfQHc1E82I+AOZkN7AA/4OGQEmD9tY4MQ1pnXSdEuYDiHOt/QCNN9t/rkKYL/MBIKliCEg/J/6mpksevb8MpXbOZ4zZuKOFYD6B9z5z9R9tB86g/0VpvlYAzGwJC8F8AKhV2f+mzhkjgEpX9zh0Mu/SyVRCWCjmQ6Ov8o7rK+7jGeOCHF3y2IPDmOnPG8+CpDtaKOYzUDl89fs65L15/Jbk6Ukx6S05joYxz19BuveYYTgRFkbzQeNJNemuu7sAI592tOF/7t9GUHt+2+uQxJxsOXzN+wez98+YGCDp8NXX74XWfTO3PEWk0deI+cAZKgAAOHTt9eXTQggafYeufV95qq/PSBckacNPH+whoj3zjQlzJxpnJL2Hr75+77StTtFqfqtUHL6/GGl1gGb5P2/Mmwgj8aTeIuHm1E3PIlqIbHl6onHoZPeha68vz7rH4i3m9KTi8P3FKEGZSH1k4UY1jI9zJ/srXVvG59Rz4Rbx5qLi8P3FvMZmZrUD1GTixjwE5h82w3hHZ60AJBWH7y92PqZ2MaHnhTUYf3k1xtPxgsYZPE6MEabkiAKN1NTJwWaZLun/AITVDYezwzgwAAAAAElFTkSuQmCC", "icon_hash": "12fccd1569c48b3c20f1cc8e2aa5364d", "icon_fuzzy": "8ce33891e72d2565c69bf1ee11946278", "icon_dhash": "c8860cb919c6c6c0", "imported_dll_count": 9 }, "data": null, "strings": [ "9Hahd", "4K?eCM(UM", "\\4Vybw", "Fo*zC", "rj5Hb", "BT51{", "`CNbZ", "\"F;())", "X1CW)", "Q!f<6", "3@L$$", "q=3sf", "V)6=I", "sms-fi", "kL!t:", "kV8bw&", "Z1pf4", "$1\\0#", "$r]`Q", "|`S4V", "ja7+nl2$", "uoKZQ", "seyf6", "YQWL1", "*e,Qw", "6mVb!", "QO(r,", "E=u;y", ".F?5+5", "ltX$F", "Sk$q[Rv", ".?AVbad_array_new_length@std@@", ">L5k&", "bT)Hmo", "jN5+4}X", ":1:_:", "_-xG3", "4WZ%9", "e<\"')", "#0LVtg\\", "J89J$s", "p:yGA", "Au~2Th", "z14.V", "OsfE9", "es-VE", "->mx@", "}WB%`)_", "de-DE", "MF28z", "9@ni>|", "OWHW`+", "K$?N`", "%H3|", "9d*hN", "3BD'o", "s[jU*Q", "6\">|/", "?p=Uj7=", "jM1>FM", "_X@Br", "`%2U|b", "1Q~^f", "NMS\\aMO", "eQN4N", "3lJ[B", "r.qNbM", "ar-BH", "(}5Eqi", ";zw5g", "R_D\\/", "A:KwrJ", "23/'0", "y\"}j9", "~p_6G", " ,!U)", "?+*2J", "^EiPL", "P+!?U>", "+mE", ",Df}1", "f\"!'f*", "C~]t5[", "D|!/c", "oEM:nP01", "s$.*u", "Executing extracted package: '%S' with commandline '%S'", ".jULv", "r iS,", "g' WR", "h>OEb", "N0L0J", "yUd8p", "39C=I`5_", "u#3bI", "Ej_'S", "oD\"TX", "qIjPJ", "dS:(Fl", "1K2Q2V2]2m2", "*3rM4O", "m6MX8", "aKXjj", "Dot7I", "[qIVx", "k9+Vz", "xJqBr", "!n:)w", "GetDlgItem", "0$0,040<0D0P0p0|0", "MP}M.", "[]+?8", "b6[tt", "*|FqI", "b;Oc*M", "$f`(<", "7=tq,", "G5?>!", "0,7", "I:Z!)", "#wT{t", "{YWToJ", "|IHCc", "\\J=B#=", "myD;M", "/q;#:", "%*aX>", "A0.0 ", "nC+{Q", "(0|!@uA", "el-GR", "6kQgso", "6y", "4mS6x", "U-\"//", ">#EIj", "9tP`IY", "9`B1C", "\\)OnH", "5{MG:", "t)ph.", "~ sA/h", "g_hXJr_", "4'RrP", "dAP,)", "\\.f4$", "-\\o})", "FzFUI", "xupRVF!$0", "ISD<9i8", "B[;V7\"E", "k^]F8 ", "en-CA", "YFEch", "Jvs[d", " U;A7", "4*5/545O5\\5e5j5o5", "+GWl!", "\\y&xr", "i7d&a9", "u3,'6", "KAZ|G3", "9=B@y", "r{b\"rp", "6}$Q2", ";-CO-", "/ghPsf", "\"5ZB++X6", "?@x;e", "cncLBN", "Box StubPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX", "'Ka8\\", "$xn)~Yw", "3s,D#", "JeN6\\9", "D7hjX", "@Fe2:", "FyQ{2@", "h6YZN", "9J+~e", "M@ %$", "5hc'^", "]G>3F", "se-se", "a7", "`]gQE", "NExG0", "_18=h", "`XN9pf", "Oj6#!", "w.OA?@", "739t", "{Ebf[", "Anz':", "api-ms-win-core-file-l1-2-2", "N~PQu", "m=4$%q", "[#4.|", "<<{4?", "Op14/", "TlsFree", "n7(J%", ";~hfwE", "5?\\i^AH", "^O_M6w#", "Xp18I", "?4)i0/h", "]6^(0", "on3&V", "C_#=9", "?yUaV", "d1uH[F", "}t5JS%", "z%u[:", "ZHt!{", "A)#?r=#", "q5/]>", "AnJ62V", "/X6C1", "!QyI^\\", "IRK9U", "MA-zP", ")z_tj=oL", "Mc%p=F=", "2f{8f", "7LPGd", "LU.P1V", "D6g,-", "Ov -N", ";q)&6", "-+y8x", "'hR:", " a!/kc", "KDQN)", "lfU%C", "?U`QR", "?-UI3%<", "hjA1f", "oNC\"7", "k5kP-[g", "vk,MUDq", "-[{{7", "/;wf+", "?z!QoP", "Wd\\A`L", "m\\\\][q", "7RZ%`u", "{nc7\"", "JV^~CX", "_/#\"Y", "Ns[Yr", "[2~8mKp[", "(YaKetm", "0|OyJ", "=X*Bh", "y5g_&];", "uTY;^", "^^r0m", ";^a0k", "5ZF#9!", "pF_0,", "YRIlLb", " luZjv", "`3V{g", "Y5}`w", ";0=N?R?V?Z?^?b?f?j?", "_:4-$", "65btx", "j:.4T", "{E}J[", "~#-wU?", "+a'MFx", "DDzc|_;H", "!yB", "BJM}5.", "n !T'$", "w0scj", "82Prw-", "K\\WHH[", "H)5E(", "1ec^3:", "a7$&n", "@ANVy", "v3*8>", "p<::>k", "0/[;F", "#Gg3I", "P9HlZ", "ZDGp(", "l[ !9G*T", "of~3M", "t[BHJ6", "}B/BRM", "Px+O+", ">r2eVZ", "5TX&Y", "Wbr2OV9", "S|)Mo", "edzEu", "Kk'sl", "%jO[fN", "40=vCk^", "9ZgSy", "div-MV", "\"*b3=N", "TfSt-", "5m:q_C", "s!?4o", "K[c:/.", "v)_Ib", "%sX?f", "I6J9a#", "%e TrWo%", "$FI-X", "782o%", "4+x,1", "t;`|I", "o!7dp", "8r jje", "AgLpk4", "9cG9M", "4AU#8", ":u*)y", "q%!\"n", "g+(Eg4", "lc1|W5", "o[n:\"B", "*8y,+b;", "n!c+6", ">$?,?T?l?t?|?", "\"c\\KL", "|wchf", "=N)ZI", "jAF}&", "v``zS", "Sz){m", "[-&Wi3", "#p~jY", "E4Oh,uc", "?c%X*", "\"9 )Z", "9PzP,", "lB-+>", "PZyL ", "v.'`3", "\\>-grL7(O", "kC2x.", "P~RZWw", ">!>+>8>B>R>", "V8`vWIz", "%)iK#>", ":k4K.", "4-585w5", "]H.3)=x", "*@9j@", "R^CP:#1y", "8^:=x,", "T#-#VG", "ar-ly", "h^Utg", "sm%g)", "ZHv&v", "HI+N|", "s0DKu", "S1WH>", "u4NY8", "`dynamic atexit destructor for '", "Y?y*wW}", "", "1R|\\^o", "es-NI", "UruLz", "F,W!j", "bMqds", "-yTxo", "C:reX-", "Se9)|C", "Nd|Hg", ":2lx@c", "`D?QE", "NhVKk", ";msHZ", "V9ynr_]", "(NF8", "sqxAi", "9e6z,", "#R)s~", "w@+d9", "q3dP", "7-6)?", "/(;Ps", "", "Byvw1=", "`5$R'", "i`3yd", "a0A.|.^", "i\"F1^", "jO-CO", "&_`uE", "w\\tT+", "|e}BZa", "*oQ;6", "HeapSize", "IRW%/&", "m|JCL", "g\\Lo/", "w+pUt", "g@q`y", "f|:T3=$", "3aKWJY", "F&8Ud", "4`7lB", "w\"g;oK", "1?:EM", "R()%YdRV", "$(l35", "!RbSC", "y2GR>", "r$[Oh", "MjQ8!", "KiTFVEY&m", "F*B#6R", "`X5Wnl8", "\"p]db0", "$~$S]", "36wk6", "0KCrD~`x", "Y,bvnV@{J", "yzzMmP", "86SL9mB", "}lC7^", "4N0q\\", "'zSrP", "lFnR|", " 4 jL", ";$;);T;", ">Dv$()", "4f3wh", "?Goy%o", "_l G)", "aIihh", "]601\"E", "T6ZgQ{-:", "|c.A94", "y!ABn", "\"_Q5/", "I Rug", "xG~1}", " D]C(", "R'P(K", "wbI?`", "&r@;g", "e!+/d", "l{n[\\", "%9]\\>", "XXK~2", ";ws\"V", "3~am\\", "}K$Q_", "Qit >5a(", ">QQVPwOs7]", "U^D4)", " 3vub-", "xI;hx", "ZfF1VB6", "pMyHY", "=D\\3;5", "MGgyG", "it-IT", "&`{7/", "[H~2\"R", ";'8Y0", "j^qah^=a", "1x]Za", "ZyXV}", "InternalName", "Dw\"mq", "ECRPMm", "g1~$Bx", "aZaL*", "+T664j", "8[Wv9", "sREca", "BaB1F", "X:~hM", "fL;h/T", "Unable to estimate the required size", "6%a`i", "VpHa?", "Df0_k", "9`THhF", "2R`n`e", "X5b35'j", "3@:B3d", "GetCurrentProcess", "3J5S5j5", "\"5B'?", "+n<(S", "SAXt.", "-?C^T", "QQSO[", "b)EQC", "R5yUh7", "-7nuP", "Asvnm", "X:V~p(S", "I?w]2V", "Zcbm;", "3n+EE", "BC .=", "%Hq!|:S", "2Dl8i", "xU0`Oh", "ASVq1", "Kln0#", "Ha|!Wg", "nb-no", "({!K`", "@4&JH", "ZqS;0&'", "9lw~EI", "CNgpt", "i,pp~", "c/D,~", "(yU\"2", "4:_83", "3Lh>-P", "cEIk4", "=\\\"^?x", "]Xn[+", "=#9=T", "Failed to get text length from the directory control", "Kq,Pdo", "@WZF.}", "'k:LR|gN", "^TUxQ>", "qiZ-,vE[(", "cU(>\\", "\\6zHb", "Windows8-RT-KB", "2QIDZ", "T~u<{p1", "L3l?*", "es-ES", "1DoRA", "\"Gfh4", "J@li~<", "u%jFdI", "kl)9k", ")bra%XL=", "bQ*F1", "sij\\\\", "de-LI", "Aq&gGktC", "9d\\JT", "kkJs@", "YXT?{", ",}+WM", ")SzSC@", "r4sb:Q%", "})!szs ", "J7wnn", "XMI6>", "'2Lzu/h", "nb-NO", "NW3B1m?A,/", "kGUs4O", "s>N^OJ4P", "\\_5,9", "Q=iTZ", "8gWu[", "r2@@P", "+@2i\\", "=JQ`v)", ">{~Fd?v", "Ufnl2#N", "h-wlDy", "F^KtA", "zlsgQ", "p[=rt", "5=-K4", ";Ko[R", "`local vftable'", "WHL^@0:", "p.zF.", ";&{)'(X", "%BZ5\\o", "es-gt", "en-za", "Wh!'=", "ugWp%", ":i)F ", "]t()o", "h;DzC", ")'jyXi", "Z", ">< -s,", "L*a_C", "EPztA", ">bobE", " jj?l", "V>0%k#Zq", "+7h3y%x", "DI[gGi", "SHo5o", "0k_gN", "Jx]x", "]T9boh", "\\\\?\\UNC", ".iTyn", "(wSHT?;", "zkZ%QnG", "&U-Y7g", "NJ^^9", "9'9^9", "!O)[f", "^wgf*S", "825nlu", "C;_`|", "~MA6q", "[f=q'&@W98;``", "O3{3b<", "U6HiFq+", "p%iTI0", "!t^ni", "C,MC>", "'YT'. ", "r|=X<", ":FBW]", "fT7J0-", "o_*N`", "Qu0)L", "sI%_/n", "V5j||E", "-(4So", "*h!zdf", "Fto1[", "v s3.", "^jQ4+r", "LTy>l", "C1. u", "!8i(z", "\\i[Gb", "'leTQ@", "h+KD@", ".N.S\"~q", "s\\+=+1", "8I9S;", "'57Jp", "F[p^z", "_WY{q", "df{q:", "[Y?/\"m", "g/6C8J", "u PWQR", ")>#6o", "QT.O0Pd", "+R!Ah", "yAoiGY6", "XT-W0", "5xY4z", " _SFX_CAB_EXE_ORIGINALWORKINGDIR:", ".idata$3", "8?Ve8", ")/D%,1", "OHQQR", "H/@N$", "KFJ&.", "dgtai", ":iT6I", "\"}ok~V", "q.Nry", "D{D=h", "/0@>x", "Gv27l", "Failed to load module: %ls", "", "E\\fcm>", "NO8]K", "u(RPW", "qm,KM", "w_SJw", "6FPf ", ".;1c3", "9AjTJc", "V8\"Rz=", "Wq$EFu]\"", "kO#tg", "\"~>Ue;", "GDZD~", "zfpYK", "8x3r['", "!~`)A", "3o'sz", "yrnEt", ">>1)YE!", ")$G1x", "!#VtRw", "o=b?D", "l&;{[", "|Oyz.L", "Y/Bd4t", "no= l", "\"srp", "GetCurrentThreadId", ".pr^G", "8,1s1", "lg:~A", "LGi'0,", "bkD@\\W", "H}6m{", "#z.Ih", "XC[=m", "O0v]&q", "'3dqk", "=cW.*", "E3Al}", "_P`Mq", "B|8(~", "fAbs", "Zc\"H|V}`\"", "c1u1|1", "ar-LB", " =AVtmE", "7 7-73797?7H7N7T7d7o7t7", ",@;0Yq", "FQVF9", "eERz#", "J)qayA", "2Mbi}+", "__thiscall", "?8?D?d?p?", "Hn~:d", "T(f(;", "cW\"I}N?", "RC84~", "De,3M.", "1v7lC|", "1)F&\"", "dybNB`WB ", ">!>H>c>", "g%1sU", "SystemTimeToTzSpecificLocalTime", "(]^R.", "BSI\\n", "&vp|V", "Q:8>t", "w@+\\0", "`?S{t_g", "api-ms-win-core-localization-obsolete-l1-2-0", "4)D`\"g", "|J|NOW", "-Tw,=", "=L /q", "<)wV9", "p!h`0y", "{?M!i", "Failed to get the name of the module", "zYz#~!:", "~RKdg", "l:rn|", "#:G59a=", "_m1[:", "ar-SY", "U8Uy:", "[3kR]", "$#t|a", "!j9eMB", "\\((2`", "K;8JN", "zz Jh", "y6`+y;", "QZNE~", "8kW.3", "YPE93", "I3(z#+P^", "2*", "f-+?8~`", "8Cj.P[", "Gr4H3", "(D. P", "#B:,(", "t[*r<", ";]^zZ=", "Failed to load DecryptFileW from advapi.dll", ":[R>86", "YqTp?u", "&N^+b,", "IJ|ydQ", "|Im~#?", "+OBB2N", "=|)_'", "M#;lX", "9Hyeo\"]gZ", "&SZm^`+", "cpJ d&", "et-EE", ",Wi&.", "d3,'gX", "JZ`rU", "J^.2T", "o5i9x", "Dk8bf", "?' Ul", "h0Y!b", "aud5]", "Prerequisite required on system.", "Y0 Eu", "(DGb}a", "qFgYmf<", "F|_lY", "O|Kd1", "a8-Bg", "U@.1r", "VGeHT3", "1i rb", "vA; 1", "B7la=", "[sgdu@", "Z8K.(", "pwf.x3Qt60Tt", "[t[Ol", ";5]_W", "3c,1`c$7K", "<>zu=f", "Z0C.O", "\\8dRm", "E`^V@`T", "%DKG;i", "wWj,j", "-OAZD", "1vn:U", "9PXCJ", "LFabg", "@3Fgzk", "9|a`'", "<\"<3", ")fNYH", "xVVq!", "}Wh@ .", "]0z'&", "YT+A@", "(YmvkX", "Kqe(kFB", ") +4%i", "]zXnW", ",t^P@", "restrict(", ":x7jl", "KX5@P", "M$j\"^QRRRRR", "a1'!P", "Uxqeqs~", "[#lKF", "\"V78;", "/FBQTmg?", "es-cr", "F@KB&", "ykzU\"", "Hr?x0", "Yr.FsK`", ";M\"lN", "Lh", "Nj-pE", "7h4?j'", "DSOXns", "+EtHw", "(3i+aD", "zK[s5", "tX{]B", "t|vl%", "GUTeN", "WSy63", "#m78!", "PF7r\"", "_g{aNl", "<~6~L", ":S&sB", "\\:`~?", "by6[/", "mw?, ", "]m29S", "45~j,", "=W6te|", ",8Yutu", "nGG$;", "`5R L", "o/{O /$", " \"Qg8G+0dg", "73{z~", "v}K$Qg", "ja80{", "rpf;u", "sl-SI", "I(Sw<", "&M+Xh", "%*6$QI", "P1H{J", "*ja!<", "! b@*", "F431m", "x{hwV", "t5QVj", "\"51h", "HS1gVt", "IX71%", "Xj)&al", "^47D73", "$(,Y(", "h<.6*", "# XA2", "6pVq>>", "<]s*>07", "(_v(u", "Mo::{i", "2s'SV", "|3g-H", "Juo*\\", "vi-VN", "h#'o4", "`M=M.e", "Dr@ Dd", "90M>R", "^<`uc", ".quiet", "?FoRx", "cTI^=", "S[P]*^", ";PSczZ", "l\\o\".", "?Z8@-v", "I@EDJ", "Zft-|lW", "MmSV{!", "xDC\\e", "VOvzX", "e 5/r", "Beh-J", "/G1-M", "xrErL", "9kCsff", "Z'dhP", "bg-bg", "#.izK", "ddp/@ )", "CH\"D[MY", "\\.", "q* v\"", "RCr#>", "[t t59?U", "$X;_U", "@fM3!", "BBpum\\<", "_`Xg42'f", "`8)jq", "H(KJJ", ",hESE", "MS Shell Dlg", "-wJfc|", "=a*[x", "ou0tx**", "P\\u@<[", "B'WNz", "3\"404G4p4", "<$<6", "U!Jsf", "jXQ7X", "28cPA", "n0`IV`", "\\)GNa", "rTE&*", "J1$Dny|u", "i4ewe}", "eO04E", "There is not enough disk space on your drive for the new files", "/y`r*", "(;jS{]A", "!Dj+l*", "i)xJi", "}V4kY", "5`>h[", "RmG`cT", "es-es", "\"eR'|", "|nQ\"I", "9Aq5gLR", ">:W|p", "f),:OH", "TnI~>~", "F\"8Wi", ">p}SL", "gd\"AI", ",I.k'", " Zo^G", "_rNN}+", "\\nB{{*H+V", "ybXH,", "lyp,-[", "Q gU6", "5wZjBSf", "pwMv(", "jBPZe", "G|R>S", "jNpl-", "z^9H?(", "h>tsj@Y", "uu$z)", "n,v#U", "]Wo{O", "U`{fQ`s", "Vwg$i$", " {P 4", "CI&@xO", "Failed to get the label control", "K/]4=", "\"3a!;", "Microsoft Code Signing PCA 2024", "u1#F?W", "&Y!}o", "Xj[sa", "xDd7f", "Y*VWa", "z7p?J", "A)>lNd", ".ig\\*(T", "+Hn,@:", "4:4R4m4x4", "r;K%]", "@At&-", "-w`*}", "d~(k[", "-E&R;/", "\\M@sMPiu", "7A!&I", "#_FS-K", ":}N^b", "$uk)c8}", "~>f\\B", "EZr(x", "1'Boy", "l|\"j=", "x(`b#Y", "awN9wF{X", "@,U^Z", "QpboG\"H", "6)-p&", "|B[XpzW", "$W:zs", "-eLr2l", "H!l>V", "<4cQA", "I@42>oM", " J@/oQ", "@%^0t", "3CbLd5", "qC]tA", "sG]r-", "j\\Yf+LG", "D]XGB", "RyQJ)^2U", "aUy/r)V", "uXV2~", "a42AU", "o){O3", "!lN9Q", "b^b(#|5", "Ehcu_", "-2Ioo", "Hf{~R", "kcFL+[", "\"Bo~$.-", ") K8+[j", "0]!LS", ":y}l{", "\"C_pjD ", "/(G_+", "PVo7m~", "icKSm", "w-Xai", "PO)9p", "5iB; ", "Xl1!L", "DnC=yH", "*a@].", "kGu9>", "N?i^_&", "(]uPQ", "P4S5J}", "3K|afc", "es-ni", "M H.F", "ux'<+]", "<4<;R14", "1;(8g", "MV%;`", "q'=X;", "`+IPG", "RSCkI>+_", "v.Y}W~", "|J*l!(", "9C:r:", "SL*Lwq", "-o]f`)", "0 0$0(0,0@0D0H0", "qOwg2*VR", "j(#!?", "|IxJe", "t%[k$", "SnMgY", "L(46H#", "*l2bv0", "Uot&x", "`Q6fc", "W+&04", ".{.'<<", "VURseq", "@\\zP]", "`a$[A", "& S3)", "XUVbS", "Xin.Q", "KM'i\\ c", "A`7og", ")Nti:Zd", "-d06o", "%q*|8", "AcquireSRWLockExclusive", "3;!}/", "Z}R]c", "+kI!DD", "&Bnw]", "EKt U@", "e {'h", "8$8,848<8H8P8", "sH)+?", "^89nj", "NaG e", "6@6L6T6|6", ",rPbWk", "x.a R", "_'EB5", "JMskC", "9p41#`", "=X}z*", "P++ryV", "?hB!M7", "~'>di>+", "byo^3", " S[<:n", "(ma0}D", "AD;FDu", "O^_Cs", "K@?K?", "Ux|[z", "HQefr", "444<4D4L4T4\\4d4l4t4|4", ".CRT$XIAC", "UM?$f", "RI-`?", "-iu8@,", "hkNN|y~", "D+(c9", "w{zX!", "GetACP", "-wPtj", "b{9?I", "n+~2;", "GG{H]", "X~cSy", "O!sQh", "<:rBBH", "m-6>qR", "nj}Ik", "1/'L>", "J62!{", "O6}^#", "3oB{YC", "(|5-6", "./W:\":tr", "'&HmB=%", "PWndi0", "rs(5x", "SHGetPathFromIDListW", ">AS8!e", "|,u7*X", "4H>,*G", ")m\"o0", "Er+l-", "ROz3&", "91979A9Q9n9s9y9", "ZG%V#", "7(lIB", "~]\"TB", "*,QK/", "2=3pMC", "D9U,!X", "8N/b&", "sx]1V", "api-ms-win-core-sysinfo-l1-2-1", "(G4nT;", "Y,6+m`", "\"-rU ", "nSFQrs", "btBS|", "X($0(", "%]s3f", "~iAC5", "&QK:d", "[]>|Y{", "Z-w\\nd", "(}XXK", ",A1I(", "1MTdl", "}3/t)&\"", "Yw@1'", "v?8Xc", "G;Us?", "AR}t-", ";S*E)", "'8SOL", "lBV3)", "`GAz.f", " S|OLQ34", "^l?/n", "S}c} ", "?dwPlaceholder@@3PAEA", "\"R-fO", "55U(y;u\"", "i[ 4#T\\K", "s)U*c", "ProductName", "cg/2Y", ".tb4bl", "H\\CYo", "Xvg.C", "to ensure you have permission on the folder to", "_:{'c", "\"oLuS", "WS(cHx", ")sCt=", "@n(ot", "fUH\\`", "&\\:l!", "0Oo)U", "1074787<7@7D7H7L7P7T7`7d7h7l7p7t7x7|7L:P:t:", "Z_mdE", "AAR[*", "YpedVp", "`XSJDP", ">jl@a4", "$7)5a^", "qF3cu>", "6#*xiY", "r^IwW", "(V{IM", "=6S,u", "i\\JrK", ")HFttJ", "AxmsC", "+Vv#a", "?lc*%", "&F9~'", "hA6^E", ">c]W.l", "L}Vw%", "E9zq/&", "w`gvmN(1Lo", "N18Gg\\", "tp1^VI[", "*H+7Ip_N4", "260416185943Z", "xPH9:", "*oiaM", "rw%P761", "NCV`B", "171fP", "arM-j", ")F;5Na", "qO|?P", "{,CPt", "mm gVk", "PW*H9S ", "MvtLk]", "\\6KZ/", "_S?]?", "~7=uZ", "tfB7g", "\\WU<2", "7w!6T", "drqpl", "2ey4K", "{i#0\":", "g=N+f", "gh(etc", "Ts*2dR`+j", ">Q2}i", "f&(E[", "Dwjc*!", ".idata$2", "*\"AIE", ".?AVtype_info@@", "k~mzc", "(``J_", "+q3W`M", "G|C?1r", "_qBT$", "XM68p_", ":-bt ", "0wU-*", ":c+@B", "write files and that the folder is not read-only.", "td\"Rm", "jO%T{", "DwjKs", "NfYp{", "ISO*:Y1", "yqq-M", "'pNTC", "R #DI", ">|,Ub", "s2iRA4", "z8]_w", "l9vTd", "O-koN<#", ")ZMIR1u", "[OJg(", "xS5{F", "I&LPX", "{;0K>;", "<)X$CJ", "T0'F}", "lKwLh", "PkgP3}7l", "7>8Q8a8v8~8", "uz/v{", "GlobalAlloc", ":;PlQ", "(XD)[", "M,9m~", "D2}h2", "EwY&)", "jdA4>wr/", "j6^,a\\wt", "twaE+", "!J)U9", "J1>{*", "O[n._", "nK%9rS", "K&['d", "}_}uOOA", "o(Mty", "-P+Ws0", "_yUJ[>", "/ ?G|", "w^hu~", "ebCnbl", "A\\\"N;", "Xk2`/r", " zIpZ", "!r_u(", "qnh:k", "WXNJv\\oz", "%}ktL>Y", "@E&D(", "2-LBk0", "9&''j-", "W7OxV{", "n:[9<", "es-PE", "3Fg\\o", "W|Gc-", "/wnsYkIP", "sD01,", "8}Z)Ce", "h1hu_", "A21#M", "es-SV", "!Syj/", "5jZy>", "cHY0(d", "D^.B2}", "KDB7V4V", "3r$Dj", "cTZ^=4", "|TpoBD`", ":jiyi", "s7Avb", "&fq%(", "doUQI", "N=S|Y@", "4 d>P", "YqAc#", "8J)1w", "jQSXpi", "ZkmXV]", "g_?N]", " IPrs", "%JV%Yaz", "V\"9#K", "cP&#s", "\"9o)B", "2-3Z3", "k*L5?", "52X!l", "i@9^U)", "I[d%^", "dQ6wCD)", "wlli*%C'", ",$O$\\", "N?67c>9>", "}vD9\"", "&^e|g", "\\G]El", "m{M[iRD<", "YKFYp", "^j{kXH", "I[idP%", "Go}10", "de-AT", ">NCf\"", "F4b&D", "WLji1wz4", "[%ODC", "jNeFg]1", "RA#0!VU", "mvZB\"", "hl*;\"", "smj-se", "l,o[r", "``?i_", "^={Z2^E&P", ">!0.e", "n/ Zw", "es-AR", "1D97`S", "DU/LQ", "/e4zM", "%_B#P", "i&GR!", "@y&<]I", "{Z$Hm", "h@hR%", "CusuN", ")pdm7X5n", "'S#W~", "E=En-", "!'eMs;", "vZy]Ew", "YH9rS+", "xb&{1", "Ho|/!", "#973#", "pCN3e'K:5", "9b+7X", "s-LTB", "RL3;9_0I", "*f~D%", "WE4.zL", "7,bwm", "]Z ^m", "xOfmAd", "(wvv|e", "!q|F!M", "O$=o7", "[5hg{K", "f{D8I", "%]{iV", "$Dylw", "|Fi` P", "JK'c{%D", "CC v&", "Wednesday", "PRRRRR", "UwepRo", "s8(*?6", "3=]*9(", ":::N:X:m:", "a((s[", "1S!*M", "Y*ofY{:<", "x!)QM", "v:LY,Y\\", "juto\"", "3UssI", "9&v,$", "#[g\"$e", "^>vLC)y", " delete[]", ":?561D", "xw7(+", "|n[}z", "d!^i+", "k`yw&", ",Lp1y", "/6HR+", "\\>oven0", "ftON9", "/^VwLq", "RLg5#k", "Ia>a>*=", "?blC}", "~ZuBu", "DmIG-W", "76yz%", "Y{:'P", "uF\"5i", "dSRe:", "nWb]N", "jM\"R'^", "NL9m$", "|Ac >", "\\FeM/", "&~!m-", "Please specify either /extract: or /extractExecuteLocal, but not both.", "sr-sp-latn", "QA\"qv-", ")ZuS8*4", "r4*N'", "`)t`{t", ":V>02,x", "OZ `K4", "oZG1}tf`", "TBYouR", "&Z/.u", "S'O$<{+&", "GB2mP", "K)7]h", "]|#R{", "jPkQ&", ";);2;9;@;G;P;W;^;e;l;s;", "LoadLibraryW", "V", "}f7/H?", "Du`}Q", "hAFak", "9g5@5;:g", "+u{&Z", "kg%q{", "L^s91", "QA-a^", "?P3n+", ":#F+\\", "PMo| ", "s'}^L", "azHI ", "3Vwhr", "5F)uH1", "T=]f 6B=", "F5c*P", "aqP,@", "e/]S3", "bD4RJ", "4k[", "hFFz_", "extract", "_.a({", "Zxt[k", "6#~Yn0", "SSSSj", "'>#]#O\"|", "Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^", "FBN}Z", "B:ImGe", "/eXz*e", "_%p3T", "'6q%_{$", "CcP.JU", "'u*cD", "fti#S", "EhM^y)0", "$oU\\>=", "P*7n#", "B$2?8", "B\"Ewd", "nZH4Va", "/*D8W\"", "UTVu5Ab", "P>$+)", "Ku'5l", "wSkj0r#~&%w", "en-nz", "`ILypn", "i_B?l~yN", "n\"N|v", "KALh(", "<'I:`", "d ?^!O", "cYXm(", "\\Jl,ps", "N;P'e", "vv}6R", "e\"6Kv", "zD}e}", "_SFX_CAB_EXE_PARAMETERS", "+$J)%v", "y$=E,", "cFq4g", "P $N0", "z1Tw$", "k}=[1", "4';/;f;m;", "azB1H", "$IgKe", "A*@n2", "9|^v8V", "^NHS6", "Yxc$7", "Uf:Bd(", "Ow6VC05N", "Eb\"sT", "November", "8h=S')", "&@-\"U]", "n-b+^", "F;s<|", "$Cn?t", "b-0O.", "eus*c", "9Ol~q", "$3|3~", "n_2f\\(", "#-M*=", "vnWD5z8", "Tk?U:", "*D8N4", "4z_Fy", "\\[^.$H#", "#,bx`", "vKR#j.", "0KRE^", "Gl`G$jm", "c6n@S", "S*OJ@bhd", "yIHO>", "sem*A", "jP/`?U", "}}U;M&", "{[H/-/", "eCQF;", "iTmc_", " DW,:", "]O-$m", "%\\", "#)grI`,", "S<]s\\w", "$;+kp-", "#X->K", "5X$I1<,", "TU:4X,", "*T'a}", ":vbMo", "9~Su,", "f-5&HDV", "G|1;_", "Zx-fz", "\"pjF", "zq+Xz.O", "d[[!YH", "o.X@C", "}{n-1", "vi$K)", " adg)", "\"2\"tU", "f{E/*", "}pD!\\", "B00kG", "gu\\s?", "O$pc{\"", "sf6OF7v3`DWyvkq", "c2u1 ", "sk-SK", "#yTU|j$", "~vcgS", "0O=gAE", "pxrgs6", "\\2@}q", "+\"{NV#T", "Ie]BW", "umdmL", ")h*K~${", "{Nt\\ ", "g", "IR%jzjw", "}dcl%Ns", "cs-CZ", "lG33X", "p`{KL", "3D4:5", "I8i3(_", "I9&NT", "mkvB{D0O", "d\",b/", ":PuKNSq", "|}f&R", "$QntC", "5A~xQ", "u9Ql\"", "7.ks\"", "}3)4`%", ".mm%.6!>", "71c](0", "\\T~kv", "j_O;3", "QEOUX1", "W:}V2Z9", "en-bz", "0(Pw!", "I\"?]/4", "Q4_H~", "j^iMyd", "/w`IV^", "fon_&+", "+4Nk3", "advapi32", "tDJ]U", "t{9`+", "sqY3W", "~i+<*", "VrtZC&", "ZtQ?\"", "zgjQo", "wIef2q", "IR;*`(rB", "KoHWk", "v21s[p", "DkavXU", "p{5/o", "QY7OS", "a@nU+", ":4}U*", "oJ# 2p", "n(#7r", "dP#b)", ".CRZp", "[lG(p", "a5#)f0e", ":5IXu", "ar-om", "7-8JW", "'Phj'", "Rk}-nh!", "rQxW&7S", "lLCZE", "67|Y)", "oQoBp(", "MbIqQL", "ViDeK", "c/VNL", "%Sc>ZT\"3", "J:%cmz-", "K6+!4M", ".SHA[", "#Ip#I", "kk-kz", "04Ue/t", "}+PN;", ".CRT$XIC", "zlqD6", ";X5D>", "Microsoft Corporation1%0#", "div-mv", "Y5xA9Im", "Friday", "LOarrK", "jeJ$@n$", "'Ft19", "6x#**9", "Z#$kra", "%^u\"A", "=7Hk z", "MO,5P", "7246B", "LImBl", "%ROd`", ":3m[%l9", "F}GAs", "U(&52$", "5u{1A", "gu}@)", "i{:56`", "g#b1,", "Mb$N7", "S\"PQ,", "mNz\\M", "[oWB}A", "'AYBR", "T(Q/(", "knP! ", "3A4w4", "W'>5#", "7Tp`J", "*mO]D", "<&|$af", "&Qqo5", "4B\";]", "oKcyZo", "#B.@5fOS", "e7&fyh", "gk,Q4", "]taj0", "\":.}#", "OyI48", "mXwh\\/<", ":ZMas", "90-JT", "=]*[p$", "(8/ed", "sv-fi", "*9wR k", "W.wd*", "}Xqf1", "0J+A|", "]4g\"\"", "Yx&=&H@", "7!y{w", "PX7C/|", "0&luw1?", "NRVO%", "pqVbF", "q;Ru`", "wLBlA|", "73t8D", "wH}%\"", "Tz~ww", "j'oeJS?", "#gG", "c2ft~", "U|?X*z", "^Nm#]", "su1_K", ">\"0;.", "\"M)\"Y", "]/@au", "bPR!|", ">cR U", "2%2/2", "h&~0$", "zu-za", "%`mFO", "qBj/\"^n", "pI9|5", "(-.1m K", "'8$%PCY", "Tc3hkg9", "^?WV3", ">(r'n.", ":ZPdhA q", ";|84u", "Xgn^lh", "FrS9:oM", "Mt?SLQ", "6`Z\"]R", "JYdS]\"B", "Xa4", "gIgMC", "pnG=a", "SGL{O", "Y\"8@wb", "22J|_", "M~3.3", "%RECV", "1#^Qvg>", " 6b+84", "=j4Lm", "^7Ac7", "R_/Ou", ",Hl$-J", "kgK,]]", "F+Yz$]", "R,v56", "o%dG1", "d]YeBi", "V_6Ho", "1SBD$p", "-JUG{", "*(M%X'", "ket)<", "C'Km79", "qn][:|", "y `57@", "*G[np", "7)[RXU", "}\\Hr3", "MDz#~", "4\\bS&", "*R6)s", "o:A09j", "Wq|+~", "zh-CHS", "]!otd", "CreateFileW", "GetSystemTime", "O~34RC", "\"m:} ", "es-hn", " i!sM", "7w7^;H", "z{%!&", ";jn56", "uNj![u", "zf(wI", ".?AUCOutBufferException@@", "GD6Qd", "=QPb&", "api-ms-win-core-localization-l1-2-1", "+1s}p", "U_e[DM", "GB\\a\\)d", ":D,^)", "t4N3? D[", "{d7O9", "Rx\\.YP", "EZ!})m,", "U8?>>", "t~ggj", "r#T4,", "P;_qh^7", "nUD dv", "[ni;`", "LP^'a", "GetTopWindow", "Failed while running the extract directory selection dialog.", "v(1%P", "/R*c]zE]", "WakeAllConditionVariable", "|:N)kh", ">koCV", "*:e?9a", "?{\"3A]VGW", "]gUXm", "\\o?/\\lP", "0K=b_", ",z43/", "}m/uD?", "iM|=Y", "Failed to create the directory to extract to %ls.", "kYv!l+", "krGWn", "s-&2]", "L'f><", "^N!KD", "-WP?A", "2?PnG", "s#(g_", "V-p2I", " H6oPj", "00!PN", "X^^vs", "Yb$OTB", "TYO[!@A=", "4NA4f", "ar-dz", ")Z&'Ay", "9y4j.H", "S^$Kf'c", "WTi?E", "~mH(\\", "]`pD6", "*y{i\"", "3 _z", "~0W9s", "XmsmK", "RZ-h]e,", "5q.G=", "kBj$O", "=PE b1", "IT*.t", "KQXL^", "}l5y6x", "e%#/Y", "\\+UU1z", "T?(?`", "u.Iu\"", "qpkAd", ")1VOr", ".C*uz", "Z3BG}H", "waBo?", "XnCDs", " Base Class Descriptor at (", "bfN{=", "E_eZC&", "r+-bP~", "xZ~;Y", "jCU$?", "V,vrN", "esBy\\0", "w%/u[", "h ;U-", "Qi`7?", "pPuVJ", "r)\\Go]3", "&O(z3", "}2UM'", "y-(y}", "tt-RU", "].4Dg", "~>!mO", "k?\\-00T", "L\\F(X", "#r*\\Cm", "%v%xS", "hr-ba", "Ipe1>", "c*L4ae", "NEi?II", "ODeCa", "X{Im ", "4)5>C", "nn-no", "B]]%g", "v>)0I", "?af[|g", "Failed to select and/or prepare the directory for extraction", "{3 W/<", "Ke4J)", "c\\)(&", "M_@`{", "X7O1%]", "!mpi.", "N(,7x", "1Kv!(", "!6ox ", "s3f}1o", "H/Z[U-", "P, wK", "QQSVW", "*lGOG", "d6TG$Z", ":jT5R", "JA5LlT ", "GR", ":'kt,", ";$MyM", "bx4!9", "yn)vw", "ms-my", "Failed to initialize arguments", "5ntel", "U|RZ#", "K@U;B", "e+;8-", "KL469", "P#.Q{\\e7", "-h9{{", "r~f;u", "%5sGnL", "P-$#H", "\"rB~/", "9_`~&V", "K4!f.", "gOI4M", "[ecI%", "yv1+c", ". pZ?", "8HHDC", "v>|Fy", "u]uF3", "LeaveCriticalSection", "Z62XD", "HK^dUd", "qiJ_@", "5F1,\"", "h-j*", "TO<,j", "u(j\\6", "v)54.", "'K}rW", "u#:MA", "noCk[mw", "O*9b:", "!w$ui", "Q ZyH&", "5('{B", "IzlUi", "Z@\\k)", "Dkcng", "Xn?Ke", "qBtEb", "5|oZ-", "kn)Xa", "qZa g", "?>3 4", "/9l)d{N", "XjKbnT", "[5};>!", "S0Q0O", "H6\\eh", "T-%\\>", "R[7Wrz\\V", "M7MYes", "wsg-{s", "Xm", "77\\YJu3", "sHEd6f", "Gyz;`", "$;U/Kc", "I3_hl~", "ar-DZ", "dVNpnny:w", "_|3]$", "1xniJ", "JZ~Z-V", "9fx//", ">d'zK<", "vi-vn", "w", "X2Tstc", "SQVKi", "O1)Y2", "SD zs|", "Ha?u$", "Qc Xf!", "hEZ|rVa", "Z@zBmB", "{N6)3.", "H6f&@", "_$S4I", "9{}hL", " zb=F", "Ir-s:", "0_}@@-S", "9wS/2", "~gv\"G[", "]ECH{", "@?]9\"p", "l2%A\\g", "?,Kpnv", "s4c?!", "tv9oS", "\\G:Z@", "/QOK~", "{^pR1", "Zv%`x-", "n4D_@[$", "960vH/", "<.%4#", "+}Fm=", "Z8Jcc", " \\2@Y", "+.pi%", ".fZ`r", "6oUw:", ";,?\\w", "}9-;+{", "u:`9N\\", "(YLFr>", "alU]IZ", "15c$$", "*-^qU", "7!8H8g8#9S9m9", "U+h|<", "%c&!IH=", "/{ UO", ".AW1M3", "LB+O<", "\\C\"`L", "Lf>D,", "\"iD\"K", "$cL1Q+", "T$}=O", "y7c+%", ".us+V4Iw", "k35`x", "Ly/,s", "JQ4j!", "v`%:b", "B^ciLq", "oEkEe", "%I\\R>aC", "J8(M&", ".qoRM!", "GDZKV9k", "_e,j1", "HX%1>)", "|d%fm0", "z0out", "CqKxX", "yK]?g", "~2/*!V", "[6>n'", "u2lphu", "=:SlV", "yNE.p", "H5OQi", "e+Jh-", "Pa{?MO", "Y-,zj", "4GK`ch]", "RegQueryValueExW", "9m1rTR", "9ZM*>", "Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0", "Jqm%9N", "W`}x]", "JlKA@", "azB]|V:", "V^3i-", "010<0", "EK9um-", "Zj4)H", "l/g[O>", "C_E;*", "$Um,*.r", "|G,j ", "#hu.e", "q (8DQ", "om%nBX", "K)`<", "jK/}[j6S7", "6E_ f@", "sma-no", "[{!3%G", "A\"_'}!SN", "-%v[-", "R$(&+X", "]KY-^`s", "*0s w", "bXL1y", "?%{1]", "D469-.", "\"`${A?", "W6{v8~+", "Je=a7", "q`3M~", "Jeq9O", "P2]z[", "!]_0t", "qtrCEFP", "YJ7Gh", "`)V)WBr", "rr&{Lw", "C(VDs", "k\\\"aF", "cU^6M9", "wnd+@", "U(D,/", "9Ayt~", "+F?N#", "FDICreate", "\\=K3x", "2Jj_G", "samZK#", "x_o?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~", "pd3*j5gig", "r+hZK", ":y#Zo", "H ?eQ", "wMAPVN", "[aOni*{", "D!E!Y", "N}1]I", ". 5b_A|", ">HWCs", ")~w79L", "A5s#Z", "x{7Rh", "fAN`Z", "j7s6?h", "7{Hb]5", "!L/49!", "k!S,y>", "u?V-+B[\"", " zheB", "m1,4h", "@_5^v", "!_3Yd", "\\;;gY", " )V|pD", "fA", "e\"iJz", "RVHZB", "O+C*k5", "&vnCX%", "@kTR-0-", "-*UP8", "\\oNPw", "L&9}=", "|DZ.1", "G2^v:", "f_UTwE", "bd_y=wZ#i", "da-DK", "j9>Ai", "b6(AW", "_W*gh", "L\"JPp", "IPmuI", "~bV6s", "vx *&", "}&3e8p)", "PUwua", "r93OV", "l /pY", "9QJf`h", "&w9>L", "_JC<36", "]8x'P:", ";jUn#", ";Jj\\NP", "oY2u6", "atH7D", "f7", ")m]!7&L&Q\\", "S`W6n", "es-co", "de-ch", "n?tO6A", "BtYm,", "dfngWB>O", "\\mLdQ", "Wq 1su/", "@WWPDaF", "<$7j|.", "@1dP7", "Q_6=h", "BG2}H", "X;v?4", "{G5c&J$", "Ib Ph", "pMWs;X&-", "Lkg[/", "hx_j\\", "_+>\\[", "6M*A+qX", "f+1T3&>$l%", "3E(Gx", "\\Em,`", "1/J)T&", "=|VTh", " SJ{RX", "dTTk;", "=-><>", "U^WNK", "`!;wl~lW", "~rP*t", "`n1dv", "8G}i\\", "M\"wC)", "BN8> ", "IX5$w", "$Am2{u", "8162A", "_PX-b", "_3)d!q", "K8e/q", "I(e/h", "+]-O.by", "`HvWW6", "[[=Fxf*\\", "P\"[P[", "v:4n\\", "A^jj&", "&}(Y7", "jjjjj", "S2IIL", "0'\"0W", "GF/?U", "35Bqu", "F\\?CT", "sS4XAMS", " Type Descriptor'", "w\"(3M", "p~)!f", ";0;>;r;", "AY^2gY", "+9%1HBj", "Ci_c^6", "(VJs0", "i#=_A", "sW-,& ", ";&K`$]c", ":1?X?_?k?", "\\\\6e0T", "%DN}:9", "EQmY5", "lfI}y", "r] k0", ">Y3Cs&", "e^_f\"b", "w{5|", "`ieUe", ".$yRT", "z$Ua$5", "(u80t", "z4T__", "\\KVr?", "_LkCw", "w7O4ta", "Nzb76", "B;l02", "X_Tws", "_V7N3rK", "@!c:ZI;", "u&LG_%", "m5!I{", "5\\\\i~", "!SnLT", "j@ziF", "O1!)Q", "DK@F3", "p__B&", "MQ,5?v", "#!(FR", "V7_QI", "rxWAR", "KH$N6", "WOzDDA", " }z:3", "\\5GK_", "c.\\\"Q", "v]s%$5", "|]:=2y&", "Q:/;D", "08%jJM", "V`V%L", "nHz~m=", "90~%&", "2$2,242<2D2L2T2\\2d2l2t2|2", "hr-BA", "Z?FWY", "&r\\)qfB", "TbjpO", "Z)l;6t]", "SZ}c(", "?a4g$", "Q]=sR", "}CH[#", "#gO6I", "IgdX\\d", "*)D4Y", "~:k_>", "C8`f_", "iYP:3w", "F-QK!p", "\\*Aco", "@+[bF#", "MLh0-", "z9Pia", "DN-)4", "\"YvRQ", "FcF85", "`k/Qt", "1_ z0", "[?ngl", "3P", "HP1Z/", "N4CUDMNO", "4hYKv0", "th-TH", "NLV J8)", ">L?`?", "h:L$0N", "h8.7#", "$o@}7", "W!>z*", "k5+-#", "Y`/\\\"", "n_|+0", "e,WzR", "DNLA=", "HkG&]$Z", "vr*)d*", "%'oY\"`", "O[iQ7", "p0OK;", "UqWJM=5", "SjKE$U=", "j\":+WFh", "V1", "OT~/6", "9S0]p", "^ieJS", "+78\"+", "D=k]C", "+LRw0V", "9BYm~", "TM\\}0", "0VSw`:", "]{ZOA", "F=!A3", "0Q\\%L", "?mW6W", "Aoq]`", "8j=@\"", "nn(?f", "/P/gp", "KyAJ6~sf", "#W'0z", "=wp@e", "=*;9(", "D(\\p$", "8J9hKb", "gmst_&I", "4Hg~>op", "kD~+Mu", ".cOfv", ")(qShkd", "HN&cw", "`_Esg", "9 9S9", "B*qr+ ]", ";xzid", "':UF~k5", "$h5?'T", "f3GGj", "t32OWX", "R>I/-0", "X2!V[", "If#w6", "%c`d9", "Dm| \"]", "Rbh!Q1", "XkyRw", "6\\.&,", "'342j", "cTF4uMF", "75dMxi", "JtJelc-", "idnvs", "\"2A-", "\\?y(g", "\"lWzb", "K;JrO", "+|4XE", "5B{7)", ">/V1*", "9B,t@", "ZIleA", "-B# H=", "q FHl", "FQ)3v=+", "\"#GdY", "(e2a^", "Npl-)", "rN{}C_e", "vevhp}O<", "\"vQES", "Failed to set dll search path to Windows system directory.", "Gq`,~", "'+q<3", "M$Oj9", "}nvc2?", "qP2/}D", "=Zt81", "\"msR0", "/c|f,", "w^y-x", "zG(9S", "a1`wR", "a-ri\\", "$+9bn", "W-,]|-m", "ND$Jo", "KO L\"c", "gmy|\\f", ":lru.E$", "FcYW!", "(~*v~", "+bHCMj=3", ".rtc$TAA", "M>u3;g", "nl-nl", "L\"\\Nze3", "+,#MY", "E8]&I", "r['gV", "K$1JI", "6_%=#D", "7efu|", "g5pw)", "6Us9I+cR", "/{3nMA", "8.cQ~", "07`RP[", "mIGx>2", "\\bP}Nx", "?Qpw^", "[r{V[", ",X4>}", "\"mZ`ND", "J,iPm", "kZ`/g(D", "!Xv;V", "Ra%{D,", "A4R>{", "Bk#\\w]]7", "r875Z", " _\"(", ":gLmR", "Pj_DK", "9{(~s", ">@Xnn", "&DG2R", "%lI#N", "x&7u)", "C86=_", "tF>Y#", "x3YR#", "se-SE", "Wwhz0", ":9vA[F8D", "pG#m_:Q", "Wy\"t5'f", "u2;*C", "dc~O8", "af9&[", "j:Xf;", " O !U,", "\\Y'Pl+B", "g{l~M", "W[kh]", "|$PR@", "gyjJa", "IWHN2'", "JsCtE([", " \"+82C", "<#gE3L", "O\"lx=", "R;Ga*", "y{s v", "`'CD*E", "t;=2-", "!jfQ|", "P!:Z$(!", "IDATc", "!m9e!B!", "Knh*6", "t\"3g\"", ".aM'F", "jfa31", "m8}EeUy", "#^+aZW(", "ij,Te", ";]#q#", "F}", "\"YVmF", "Z< Q6", "6Oj-L", "01KLHpP", "[!s`S", "2>uTz", "\"!a.v", "?w3vV", "w@]aUA{P", "C*W\\A", "J|n4(", "X]tDo*:dE", "ZvX(>", "9':<:E:N:r=", "S%yjz", "^Gx!|", "}L2:j", "D8PIe?", "D,8;Ku", "rC :7", "r6f;u", "@LTwwn^@", "wL*K)", "95:TB[", "}/?\\N", "z5=hl", "cC$a[", "ryElP.Jq", ".CRT$XIAA", "2=<\\O", "%.\\Q6xs", "=SbhJ", "jzX#v", "DZ5sT", "NII,|", ":OE%iM", "O=:0aV", "JY=KR", "~0#a>", "\"3bU\",", "gS7#g", "s~HM'", "!TBLf", "i8xqu", "@,0R0pk", "ms-MY", "Sunday", "+L7/?!", "wKG[iE", "N.T,\"", "/Q]y'8", "@i0sTCwj", "1ksTc", "\"?Bs>K", "J\\&[T", "v[M~G2_", ">ypxe", ".CRT$XCZ", "sF'',", "zxw<2u", "1&101", "0VZS4", "WV=nd", "A[Wz{", "N_JcQP", "Hp0%,", "_}Ge8", "BUegA", " ,+DTIi", "i5]rm1+P", ";qU%=", "KlA:r", "!Ob;B:Fq", "N4d*kl", "n8eze%Y", "O];^u", "^%KR+f", "8p/*G", "61baO+", ".,(/5", "\\5'Nh9zz4/", ",I&a2", "!0@<&", "@DyC\\", "tR9$d", "a=}3S", "W6K b", "]nX*v", "?!ohe", "J.>GbX1", "vo4R0", "7kE0a", "4,!6U", "gtr;\"c$(", "pd;]$", "U/:yVA", "4)4M4_4{4", "dd,&3", "'A%pue9R", "m.N>L", "%|*ie", "i: s1/", "|M}&G", "RWPQj", "+WSez=", "K)SuJ", "Qm]rN", "b}qP^", ":-nr=", "b9MZg`", "m*4*tv", "WGpop", "'UjAL", "A9<#c", ",n:8i6", "yfH-A", "pU9CQ", "-N5|j", "he-il", "TN;n,", "'pEOv", "EfQa]", "nhR*e", "j\"[VWWWW", "}&=Q%", "0~B\\Js", ",01ZO", "~rJE7", "3]O >D", "U0wJn", ",oZh/%*s/", "a')6/", "(.\"<'9", "_CE*x", "ck;J[", "Jfr-q[", "kJ|5K", "66x_.", "sma-se", "^&-i97", "_Ukc&", "^jDvj6", "<,'ws", "da-dk", "KB[6~", "519KZ", "FT|hs", "JW xku", "*$w", ":wb?U8e", "VfUk :", "a_|$:=", "\"Zu~RM", "`PVlF;]", ")~]ez", "Jp;cBS6", "g&$ms", "@(VGC", "~(RQ8S", "U|zuS", "7;[%q_", "MS(EQ", ";/Y$?", "]Q>L=", "O#zoD(", "lUem&", "~)H_6", ">>LFr-", "?\\.b#", "e>0xa", ".sYxPR", "}O:]Oy", "tb9^4~]", "v#2_)", "J`W1h]+", "Y-N=A{", "3y/?>", "m*^)K", "vEmoH`", "gq", "EF;WT.", "AN(Yp", "/[3YqT/ ", "hJ+X<", "9!0*v", "ln43G", "MMh %", "Cc!?v", "=:cgB", "NY=6J", "l9Fig", "iMT", "T)V*~aL", "a,d\"{", "*i<\\f", "p9B2TvKq", "Oo<7}~Y", "GGFWj", "t[7G,", "d*V/9", ";4;8;@;H;P;T;\\;p;x;", "U.@kP", "xdvXS", "|*M'3", "Jp;hq", "@utfB:x", "&-*$0Ys3OC", "\"_HDP", "_SY:g", "r2G0da@", "LF*f\"", "f-:pg", "6GYVI", "3PMk(]J", "oZh:Y", "g4In=", "|WD]-", "?i[cf", "QQQQQ", "RA\\7k", "LhV5O", "omKgl6pb", "V)tiz", "K:0Zo", "apct-q", "ar-qa", "~x", "Q!L0ot'2", "8M]HSjx", "n$v74", "H%x+E", "*bu3wT", "#n6ib>#;", "Z[`hz>", "CRVrm}", "[ze}3)3", ":P.hx", "DGG`R6", "@[Szb", "c7~na(", " Bgpw", "<&:sm", "*gX4zP", "G;ndX", "Y2![R", "o`&<#t", "9E WW", "o<> m", "TWMB\"", "DtEVW", "jS8K%", "ImZh4%)", "ca-ES", "yP?(~4mS", "4Q?by", "1TveO", "O573P", "CvLR?", "WHyn:HO", "WMvY*^", "'bG{hw|", "S3~l#b\"", "n#)w+>", "BXd5fT'", "Txxe7", "ek:el", "C!(=7z", "=f|cd", "IcLG-", "2!2}2", "bt}sX", "Iou&{.", "cY\\&*o", "6cVuV", "$Nwz,", "hKcJ/", "rGgGc{", "_Q(TJJDSc", "ns-ZA", "-!)#qz", "K1V\"Ze|", "T\\=%s", "acAv4", "t^lRD", "D-,Jxn", "Vc'zMy", "+WR;js_y57", "JSe&9", "9ay7h#", "sVVBbZF", "sS;;+", "{xY:I", "y)$uI", "v+]|7", "\"3-g", "D4{&=", "F\"", "%#~%|", "`I[hj", "152A2^3e3", "aIYqV", "Efi0(", "Sy@\\h_Wi", "|4b d", "iY~LQ}", "_%_9o", "2\\\\LF", "1.d?-~", "n:7aFF", "N?5}L", "Kq]g$", "%/'Bl,B", "f\\Dc)7", "@api-ms-win-core-fibers-l1-1-1", "31H~5", "?t6h,", ".rtc$IAA", "[j4J*", "}1_|Km", "A8 `Y", "E?4d`m", "p=$(J", "l_P=Jz#", "DwbVvc", "CVK&p", "%+PI6", "_6H`)S*", "qChqe GmG4", "{)4~_", "[k7x,", "o(Rv&g", "$|;v.", "KxP_X", "FreeEnvironmentStringsW", "RIDQC", "sB2fp", "F!Ry{;", "&&-zy", "_?z[l", "qKV|-", ":nmyCf", "va%Qm", "'KWF8", "5$5,545<5D5L5T5\\5d5l5t5|5", "Y^-\\;", "3ATN)", "mj|8H", "ORhD#!(j", "s`!MT", "U=W0Pr", "2eR2W", "2R3Y3r3", "Oj%t-", "VIhW{b", "SJ1n@", "`|`4)", "Ou@~B", "-AT{u", "y{Mvc", "d)#hf", ">JL|z", "VF-mf", "%fNy-P", "3@yFyy", "Failed to stop reporting progress", "2#h!,(", "4H[~a", "QlX1'", "*,3f(&", "8UG@VU", "8|\\`}", "zF[2J}_4}", "AspbnM21", "kF8DII", "%0DY/", "/jfv?'", "v]j>3F", "{28`n", "ZKmWp", "\\k{&3Q", ":8=Cz", "x\"'Jl", "l]$kku", "FH'I9", "D{.kA", "KVH!M", ".4 u2", "%|$NIt", "\"7fD~", "GetFileType", "4Xm}a8", ">^l(\\", "puOLV'", "m'Y`x", "VVK-x", "dODT`", "`eh vector destructor iterator'", "Ss@Y`", "monyB", "Htq/b^", "a}UB6!", ";S(}J", "yEg2,d", "_Pm(B", "GDPu:", "A~*PKW", "a7g1G}", "a4@!>{", "J\\qkFh", "Iu'td", "BkZ\"gS", "T9QY1", "]`\\ ]", "Failed to set __COMPAT_LAYER", "4@K>(", "~fTg&", ")~8j>", "3@SQ2", "q*wDV", ":f~.F", "Dec|LM", "rWd\"`", "210rQ", "rH:-N", "&P4]-^", "^9&bBH", "V7WcF", "vR^$/", "11`Eg1", "Yvdoo", "S^\\ g", "mBv{t", "^qU.=t", ">kfhU8", "}wfns", "iL4WO(", "tB", "FS4>(q", "&JY`61", "xA-8\"bS", "OU_:(", "4\"Y(I", "6(h9O", "D|H&a", "%*K-2", "G`Ss00", "+n2/2", "F\"[#\\", "FEt\"b", "5'B%4", "j$&i&+", ";[?[B", "{UWen", "kd gu", "Tb'l^4", "q 4q'BK", "?S2c3", ".T$5kWHt", "NYn\"d_", "3UsE]", "'G.q'T", "<\"6.7F ,ATU", "(F+&G", "=dYgD", ",;45-", ".edata", "OW^&yCQr7", "|Ps}K", "t~%\"/", "H>~Gjt", "=xvb^", "q*w!e", "ar-SA", "2sgEP", "]K;+@", "PRnaw", "_;z0`", "0D_L_", "II\\LE", " [yZi", "%$(pW=", "oe\\?*", ">.Wb5", "Z9=Og", "4gg8`", "@)yI$D", " %1+\"", "sVn][b", "\"xQT6)", "|&d-f", ">KR\"k", "DYBt`", "?]+kgW", "%G{OR", "r*f;u", "O5qZRn", "~z ^[", "IWkKbz", "C/0vH", "fd9dz", "8snim", "diR:P", "/)8-Y", "pU=AE", "T:>Z2", "U@Vvp2", "s#Z`I$", "6|iY!", "9RXN3", "Th DS", "1#[v8", "'e^fL", "D?V1[", "BS VWv", "h", "ijsI4", "^QXv]_>", "et1EZ", "q[HDj", "v\\DkW", "(}BkX", "3_Hi.W", "?[0+{", "The application cannot find one of its required files, possibly", "'0j{O", "3X,1s", "{kpq{", "O(D:N-", "scPBM5n", "4(`D^c", "M:Mk{", "oz6af)", "@=5iI", "5<+zG", "\",IPd", "]-\"[k", ":,:4:<:D:P:t:|:", "qtPgq[", "?`Nw5", ":%z-'", "v \\71", "8%878I8", "C~):U", "$a)S&", "G.c%u$", "aEHP<", "]=g%yBwa", "ZJE0P8jS", "A||%\\.nc/", "*{FM#n", "ar-MA", "S> k<", ";\"T.A)", "dHQ%;", "~Mw0\\", "U$F\":", "sk-sk", "p4%pn", "'HYGN", "1#INF", "<0<7<_", "%XXAv5`Y", "B$Tvt=o", "Yhk{A", "+r}<-", "?fhu4@", "\"ta0z", "GetOEMCP", "l\"|nDk", "ME=-mA", "DeleteFileW", "[=`vgQC", "?N:}]", "oWtM4", "4-x+(5", "q{!!g\"", " ", ":_w$H", "zU;!d/", "&9[`n", "ar-AE", "Z{K_z", "*wS])", "I7_M%$", "L L;q", "[C`MA1", "iz*&2", "d*hJf", "}WKi]-", "*prQ]", "Xao\"n", "={HO3>", "]7FPT", "dRiJPr(3.", "&9116S", "f44>L", "quhR~|", ";i@75", "&%rq}", "!4#,ED+", "IDQ[/", "{n7'f", "Rrw1'C", "=Gj%Z", ".w8XM", "H;LU5", "qEQ@j)", "DTI=K", "rCKaw;", "%Yt%V", "uu([R}5", "VC/hi", "T39}t", "hKa*$", "Swap4", "$}=+kg", "W4l~>", "K1%ws", "*tD=+", "~K!v-vC", "mh+J0", "Sx`-c2Z", "!vJ5F", "JY&Rv", ",6<{L", "JQ'oO", "]/w>j", "I5%j_", "A&?}E", "7E(aS?x", "hu-hu", "C@{(:", "DDyj>", "R&T!$D", ".didat$5", " F5)Q", "9N,_y", "Lxq4X", "M|\"?`3", "Y0W0U", "zPn@\"D", "Wx=+h", "JS\\x3", "U5'wz", "(*}oU", "Bnq2i", "p(oGH", "Y1aK-", "HBJo0", "9QQfI", "DZLg\"", ".?AUCInBufferException@@", "bkf~-", "zeP$d", "gosdj", "LN*4KF", "=OEKk", ")Q)KEw", "TuSb}", "Gy&yf(j", ". 3)\\=+", "=CC^W", ")PBjz", "h8z'+", "3\\Mu[}r", "Gkp,x", ">uI{u", "S\"g*;", "wH{ftRF`", "J{6op", "g@YK7", "s\\UN2", "^bf]v", "f^{C.y`XU", "lp;dEa", "W!6-Z?4", "RRqZ3i~", "nEWvD", "Wjl8O", "guO!=", "([U]O", "DwrY8;", "RP;0*", "P:6)Oq*l", "u@#M$,", "G;{0|", "/3>BY", "i<.(2}", ",cH]5o", "FoGs%", ":SBYs", "0=.q~`8", "Cs1zO", "&76uL", "VAf#A", "8zZA:a", "=jtn=:=", "e*mNk", "RRP'<", "/~+|B", "QZ[O7F", ")d+_y", "OcZiK8", "c}[`u", "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "Microsoft America Operations1'0%", "uz-uz-cyrl", "V\\^Dm", "MHNP6", "^%s}#", ":22K5", "nm(j8(", "3[3`3d3h3l3+6", "RQ'YZ*Z", "Qd%m1QQ", "NC293", "f#hzM", "FNoo&>", "2B^&z;", ",e?`|", "MyHB'O", "N*`Ef", "J_{h1<", "WZ5BBr", "#&_ ,", "`\"|\"]", "Wzj*ftD", "-x86.cab", "M8=C=w", "pq9Ik", "X#uX7nf<", "Microsoft Time-Stamp Service", "$km4^i", "P'CcB", "H;8_/^|", "hfqWb", "~F|G5e", "B?TWwlY", "XN,mj", "ABO<", "9K46=", "pN1[d.", "=?!Uz[", "\"/Egy", "qf='ZJ", "$xHuz", "236Hy|", "m:TJY\\p", "el171Y", "@:E%5", "C~s>8", "D\\`8A", "R,(c-d", "7Vp5\"", "K$o_9E&j", "p%q\"O", "*YW*A", "KusId~", "IsDebuggerPresent", "+GCVE", "PK0>~", "_JR1]s", "3J-!3", "9G0uc", " >sYB", "x:%V9", "iEhu*3", "R.8B6", "_wL'/Jou", "W\"33C", "5wg;PN", "!Ux+<", "WBaW+'", "1@[3,", "I.7\\ $*", "%^#we", "G*BPQM", "KA-Jq", "iYc ]", "%X5A<", "tcL;\\", "bU3IV8nkA", "vC=m;~", "]$&P=", "Czs\\L", "+PXFEot", "1\":gM", "w*h-FB", "\"OKp2", "MHNdQ", "8-vup+z", "Bm(&W", "!|]x$vT", "mSUeE", "]v9F{", ",q0!x", "9F$r'", "L#~~u", "7.\\%3", "!ySjb", "|H>Xp", "4`O5C", "8PKlj", "J*Z9J", ">LqN/6", "bDVyFT", "__restrict", ".8&:!", "34Nhs{", "@2Q[K", "y+`2r^", "piRichq", "m5km@T", "fV}f~c", "p^%yLq", "nCg.D", "@$zku", "?%Yw-", "j:Yf;", "S*z9(", "8F9p9", "%9{Nh?", "((&T1", "M4CN&(", "bukVRO", "J/tU)", "W7y09", "cy-GB", "se-no", "%Xl|B", "Jm69(", "=4y`py|", "qe'%{hc", "v]}fy", ";^MKZ_", "OF6*33b", "kfQ6r", "g1G~o", "OR4WS", "JynJ5L", "tt-ru", "RTr4~", "Voq0~/_", "pl-PL", "Failed to allocate space for extracted package name.", "Y/4tI", "K$ER#3T", ">@n+_", "n^4:(", "[%s] ", "hNZTX", ";m#1q", "RENXe", "hc<(Y", "XwE={-", "WOOgP", "S!@-Y", "@h:B#", "Jpu9!", "+=QPH", "ArRp4", "NR41t>K<", "padgP\\", "QB`ML", "4p?n7Z", "},Cgr", "vH{2Q", "1~jgbh", "'pV5l", "YH}kQ", "f2r(>", "L:-M>", "X5xYC", "Dxu)/", "TD<\"1s", "+{g}@", "Qd R9B", "AmqD{", "p=eJ\\", "gu-IN", "#*2b%", "*J0J-", "|, D=[", "CI)Lv", "$Gi-2/*S.J", "j Y+M", "67H&1", ">xwB)", "B6Z*k", "6%b@f4", "lL@U5", "R\"_KE", "FttD+;", "B{?H8", "?9CP&", "*~G\"#x", "G\\B=U", "U{X[T", "O97~\\", "G,J,H", "-KF3@B", ".f$O{", "/+-pJ", "5LT4q", "qPQQn&", "x zPYR", "Q}4<`", " 4:OY", ";';3;?;S;i;|;", "C4s0E", "_[*DQ", "api-ms-win-core-winrt-l1-1-0", "}1@!X#]{H", "V8qj2}@", "XT&[y", "9Cdl~DJ", "Whdy@", "N*SUY", "{vAUCo", "Yh@GK", "QTW3!d}", "Tqiyd&", "au]F8#", ")=Fze", "riDm:s", "+odd1?6A", "$AwEMf{n", "i{:cRY", "pPCWh", "^'\\{,", ".{-k&.", "h0H/c", "=df'>(b@", "',9}yz", "XMj\\j", "qT;NX5a>", "0SxZ7}", "55ieYV", "w!}ha", "#'}rD", "t~nh0", "!@xa1", "_=<{:", "[a)7W", "P}M*V", "c0/@p", "$k8]::xK=", "w@Le ", "c `+0", "=Io(3@h.", "s7EV1", "USCLC*`", "<[<`", "9e%ls", "A5XN[", "T58FC", "Kt'>C[l", "n^I|t", "*.;H7r", "Failed to set _SFX_CAB_EXE_PACKAGE", "+M\"wL", "|;er^", "fD\"49", "sK==+/S", "-T>OCp", "Q5oQQ", "DJx@{", "*+~1q", "p8l&L", "A0;F0u", "L$*o}p ", "CQ\"/Ed-", "EDn!|Ul", "QQ M", "Z!_eQC!", "=L9%D", "ckR E'", "Y_dmw", "^T$/W<", "<7R%m>C", "h7FR4", "68Kv5", "hsK\"r", "gZrb?!\"", " kEJx", "?p ~j", "xj5{q", "&(KS/", "J&z:p!", "KR;=~", "im8Va", "l7^WO", "@JJ3<%m", "z?$?%", "fZ2aS", "2~gQO", "`deev", "YH:n3", "S*c2:", "YQUG-", "1ZqX)", "2K*d/", "M}.4u", "5ex-r+%", "F;-X+", "*Ef^l", "k_}ew", "+7f7O?9", "jQWWY", ",O!LdeN1", "W$;W,r", "Hj(Jm9__m", "%Z`jFn~vL", "7{P'W12", "]rK&dun", "3;I%$T{.", "x4{n'", "((`y5", ")=M:z", "<= $i", "f8Mtj", "kn-in", "['3m2n", "2>4B4F4J4N4R4V4Z4", "[", "hc2=$9", "JF%X7S", "%f/P}", "2TCEw", "%QS-jZF;X|", ";k5fS", "Gx{1&", "h5.u!", "ju^m-7", "release", "QKbtz\"", "Ae7V?B", "AE}_U", "NJM*Q", "?O%I%~", "%w6 <", ">#U2/", "operator co_await", "PN'w/g", "xMdv|", "`NcX|gA", "EA@lA", "&{^DE", "C%Nv", "!|)p&mR", "vQ]4'F", "2S0~-", "ma%{j", "v(zFE", "'zEz{", "?W2OT}", "uC9_ u(9_", "&;x:g", "xsbH8", "^8J`p", "@erm!", "Wdod\\", "{zp,J", "fr-lu", "^,Y~\\.", "V0aOp", "t5=[vw", "s{c3X=", "aYOm~", "xzx\"1", "jcRIH", "jOgtl", "r:[KZ", "pk\"B5_\"J^", "%RyTq", "^A@ak", "ma96d", "S2Q@j", "2yweC", "n{#y7", "*c/,^j", "LVl)&", "N:K1 ", "ABA^Kq", "s3?Ru", "9,niX", "bA2nV", "|m]o:", "Eo`\\w!", "-:e3@", "D}1Jo", "UC; \\", "3O0V(", "_B2~>*", ".idata$5", "465=5D5K5X5", "2_BU;0", "g?g\"Kx", "75vuq;", "[*3X%", "<\"IpW;VlKbz", "q|lID", ".?AVexception@std@@", "uk-UA", "KfD:{$", "xwwh ", "DuQa(k", ":KDe ", "@vK$R", "v{8$x", "B)tSu+1", "O#q+{", "7/)<@", "ThLCC", "$Q5,M", "BeWG/r", "7b]Rb", "$1~8H", ",i&@i", ",r\\*y", "AIY1X", "\\}jn=", "TWhNv", "L)mpp", "gl-es", "z$~t4", "HuSeL", "\"23;@", "242`2?3L3w3", "^dsPq=", "}7JQe", "G&?q?", "PPYvV", ":7d*/", "o~hq8b", "PX\"{5AW]", "WzJ(Q[", "bE.7<", "w(m}Q,", "N9?Dd", "LT5Wm", "n74+i", "']q4q@", "_mcV:", "Failed to get temp path.", "I7=TdT", "BcpZm", "'hiqAc", "tY2w1,", "EMe&g", "3lL)d", "Lqn7u", "j~8_w", "pLc)-ND", "w/+OA", "a7A{d", "Vp cE", "B7^kn", "F(PZu'", "V2X5O", ";8o#x", "K1#J\\**", "iPx<%M=%4", "xh$x{S", "XsnI|", "?Ei7(5^", "tw3FK", "ar-QA", "A.Zh(", "l*G?5", "F&jxK8.g", "=D$&:", "Z{Ywn", "pce52\\", "SUn9Zz", "\"M=>=", "fXy0}n|t", "1#raN", "YF}sr^", "5jYJF", "5 5D5L5T5\\5d5l5t5|5", "#[:?j", "8?MlP", "}c]X#", "}U%Mq", "F|Ww\"", "pw=}#h", "\\1NN\"", "6R*KQ", "Y2V7~", "FH?5d", "3:{^qY", ")%.Aj", ":^g]Q4", "vvw3=v", " fQ#mD", "K=\\kd", "Ci4t@I", "i!z',", ")w1K&", "Hq{j;", "kSSSh", "p8JDH", "jzXf;", "Wx$>h-", "Browse...", "%`^YP", "Vy-9em", "Rl\"|[", "6hz}1", "1vuU,", "jUOdA:", "UrHvA", "3Cx-P_", "j6ty8", "5i8&%", "i_:qYt", "/i)(Z", "B~Yvp", "MLOmi", "?.wqM", "< I|{", "%K2\\Rb", "n7 gC", "`7M{?", "^`;\"4", "yPG{M", "P}og(Z", "i/c^Q", ")[$DR", "4@4Y4k4{4", "|Rj7Z", "V RI0", "gSI&FF", "8dk[L", "y%@LR", "D&er", "D7`Cc", "]7r.G[", "jF&X]\\", "Gi7dq`.#", "j_K", "BdzRS", "QYETY", ",jV}:W", "E0}+yy", "P%:L1r", "GetWindowLongW", "?3;:`Dz,\"|", "DG;hU", "`/jTP4", "6\\dHmpB", "ja-jp", ": :L:Z:f:v:", ">QnkCbq", "u5;j7", "OU'Lu<\\", "oW\\|v3", "ro-RO", "#_gy&PC2", "C])H4", "Yqzf(YK", "2lhJg", "R{uWY-", "Q0Jn2xK", "n\\exC", "kF3-)", "\"pkY13", "|8};n", "V[-(py", "UY?hz4", "*M`Vr", ")]vUt", "#Y>>#", "ad`Kw", "O 9N=a", "Please install the latest .NET Framework from https://go.microsoft.com/fwlink/?linkid=840938, or Windows Update.", ":J/=%", "T:kng<", "ai", "iWt7I", "rUIUH", "api-ms-win-core-processthreads-l1-1-2", "dwIx0", "Oya%w", "70W%?b", ".O>i=!", "OOXZk", " hJ?Vs", "`Yk}]", "9+HVPk", ":ztP7~dW", ";Z(vM'", "II18K", "+~`E`", "^D(CbU>", "I/w=7*", "y1g!t", "@_5cM ", "VJ:~Q", "h2bt@", ";uX86Il", "j/Yf;", "o])0ok*", "{(bvS", "pJb[m", "I4!6S", "JjlZf;", "EX\"Pcl", "DG?VMXH", "again after you have freed some space on your drive.", "i'o($", "^Yr*V", ";C#-B", "xm[H,`", "M+Ve^", ";`4s1", "-6D3rv", "~ $s%r", "yL?o$", "KsDQw", "-zVBaC", "/;Lug", "kf$8<", "$[YU?", "cd'Z0", "JYb([Nz", "2#U^Z", "}G ", ")ci{1", " XM#zvt{", "NAN(IND)", "5 5(50585@5H5P5X5`5h5p5x5", "c +E", "gH42$", "j[*)a", "AJne3", "0`W`)", " .L4Y", "Qn^pD", "o-g~x", "saq#*", "Ec|qK4Aw", "`e|Oc", "'rtV7h", "9#.R+", "NuI.=", "uaCpR", "<$^U-", "L:Uvhc7", "1/;]Y", "66H$5Ox", "$jF,c,", "$\\?~3", "SNTI:5", "b_BGn", "H1b*cT;", "tbMPDa", "QrVXY", "T>!2A", "P8Hjm", "S&12'#", "\\UI;k", ">!>1>K>Z>j>", "`;yF2b(", "ZYm@y8", "lB_;[", "6hMT}", "]#fkZ", "\\;e\"t", ";kM?Kx]", "}L3'N", "\"k/\\i", "r9gAK", ":rvd.", "l=2yLs", "hr-HR", "%_SFX_CAB_EXE_PARAMETERS%", "W;@fe", "#\\q&em-", "ms-BN", "s+29$", "#9.P5", "o}`Xm", " 0~ S", "i~Ji,#w<", "n.", "msI42", "Z0;2d", "?l[4XC2cOW", "Q:/E@", "ffE1^", "a}iGY|", "|_fy_", ">dSo{", "=2O-1", "!\\GcQ", "7~1E$", "\\swEMi", "jf;1s-/", "Cannot specify /extractExecuteLocal in extraction only mode.", "{RG!7", "-M=]q", "f?aHA", "'U@MD&NB", "kdGN@", "9RL, 7", "\\T)v ", "~59z8", ";U:d%`Y^", "+vuLO#", "#?c2\\", ">FN,@", "t?xh.:", "InitializeSListHead", ",cK^#~T", "SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full", ":#jv$", "I{o;vz", "oa/Ml", "^$'JE", "WideCharToMultiByte", "^$!ch_", ",>F^T", "(2|Az", "Ako9A", "|#[m4d~", "j2c_}WC", "Of**Am/", "D[z[R", "B|=:H", "fr-CA", "4v\"twAq", "gw/6[", "&zz@k&", ":(nSp", "tJzd/p", "AvNHE", "Y06]O", "T}gRx", "sk&3O", "M\\Xp.", "#]634", "IX~zW", "msctls_progress32", "T\\iY1", "x?{2W0", "3j1K)R1", "da:8:", "wUmRY", "i~`_R", "$s1f\"3", "BcP1b", "\"]IHI", "Bst|h(", "{mOdi", ">A,Fk", "kok-in", "`,BM}", "Xa)T^[?", "n_sk^", "sEy9ag?", "en-GB", "Q-[9yW", ".%a9L%", "PYS1V[\\p", "4NTP.", "Kx\"Z?O", "W?ip)|}*", "xfF1q9", "BR5hZ", ".\\t&%", ";sz!LA", "rU`RFq%", "SRyr>", "-yq\"W", "Kp&.0", "Cg+p=", "2G1^K", " 8Qp{", "c/3\"Y", "a|6UW", "D$nYD", "j(C {}", "~\"*[t", "wUDTo", "!'Q>a", "&?IiA", "!JyP*i", "FJRw ", "PIz).", "!&SPXy", "l`4e}=u", "-_oDq", "@IRU r", "Unable ro register file for clean-up", "_y\"e'", "O{ NF", "rKL r", "y]>Uc", "3j:CB", "y3&Bj", "g.\\6c", "$-hrTV", "h,Qpv", "xv\\e'.", "+-5+e", ")~v97\"", "B`&o_", "aH@CL", "5@Z}$", "W8bRSp", ";xiIV", "c9`@k", "U,5wt", "T%-e8@:", "eu9s1S", "[3 \";IS", "${K|7\")N", "@u,`cb", "S>MR4", "-1*z ", " %z,k", "T{S88", "I+!_9", "T7N8?", "BVj(j", "HrH-f", "d+", "F:ONZ", "gl-ES", "{GQR]", "OVD5H", "1zT74", "sv-SE", "HLeV=", "87pBsOV2", "JOsWk", "na6PPRPs", "&_{p4", "h)8}!", ",deVO", "2|,[}", "qyCp7", "ShellExecuteExW", "iT-+%", "?z58k", "bB=w'", "O3A];", "j:x1h", "4_#U{", "UuSN{Y", "jA`ag\\", "5t~;g", "qzd/V", "BAYqy", "636Z6o6", ")M{#v", "\\\"\"{h_", "[.>!@", "qVEzO", "_-;8K", "zvj-c", "uPG)J", "ADA/8", "xtUcc", "Nl}&G", "lFIZ(", ")dPr>", "Zz0~]", "`M,3;e", "D-m%8T", "Failed to read box header.", "Ye_$&pb", "CreateEventA", "[S)gF", "?e}%B", "ai$;m", "P-Zwq", "c21rNX", "5euKYHf", "m*jiA", "+)GE5-", "E$Mg8", "e$*de", "M,j\"^QRRRRR", " :]$7je", ";xPj<", "#JVE$(", "=N>X>", "7bcT3", ".text$x", "E^fnv", "|ZBd!", "0i\\\".", "aDK8,", "4FQo\\k JF1f", "X1f9Udr", "]q^04g[", "M-,4$", "_](vw", "eu-ES", "e{](Oq", "l@lFz*", "*/]:$", "xu&'M", ";>[;z", ";_(tE", "C/p\\u", "BuzBBE", "dmb:16Q", "9QfrO", "i@D6F", "fg:SM", "U\"S-Wk", "4mD=Z", "u`@`1", "luOdP\\", "WD8\\/", "P9!0AE", "Oq9IQ", "$W/lKl", "/Mer\\", "z$[\"K%`C!", "CgBrr", "#/kCq", "|8U!Y", "Nn`\\B", "cn2MKL", "]q.yHCVj", "Mgh_}", "CONOUT$", "Mv_Xf", "Wg\"8Iu", "liX$Y", "]*:\\[ ", "rAxQ?U", "ZlCg1", "/L^V@+!", "3c1osx", "gP!XD ", "{9%7l!", "5Jp~/", "SetUnhandledExceptionFilter", "HgaSGc", "eIN1#", "S`3'V9+T", "BA>A{", "%]2Pu", "29[n;", ",)M1V", "LCMapStringEx", "K$}LA", ");p:-", "d:~z(", "sF-{E", "\\_<;9", "N\\mcj^", "p]N\\4M", "eul%k,", "_=`1R", "6@S4! J", "=hmj9", ">|Qa", "=z?.F", "`@2qBj", "{F%_r", "FkSO{6", "rW7XN", "Z?.W{", "/~", "WDL;nZ", ".Tr0D", "c}FI/&", "4$5F5X5l5{5", "!pU{t", "TzV-}", "osofy6 8", "ProductVersion", "DKN17", "u+t>.V", "`L;O~", "Failed to allocate memory for the directory value", "-V~$g", "Failed to get path to executable.", "Mn(DiZ5", "Fp}c3", "629^C", "s9MTD", "I]h;+", "S.ZK4", "vzs9o\"quNG", "_4,C]", "qDL'4", "w;*-E", "/OiQk", "uz-UZ-Latn", "PT3iSL", "`local static guard'", "/qS\">r ", "9^@ h", "6cWzV", "e5-i&K", "=W{ R", "V'mE{'", "*zWFj", "B)UDeT", "l6l@i", ")Microsoft Root Certificate Authority 20110", "3cDb;", "x>Y%>", "TEE.g", "0y,C{", "QV}l/", "\"66 q", ",;[h!o", "6H!YV", "454c4", "=tS:m0", "=tL:'", "bh5\"-", "g2mv0", ";+xiI6n0c", "v]#Dq", "NY?^>", "UY9t,", "dX\"}4", "6fKVT[", "lxD\"g", "M?Oj-", "j\"qH/JEJ", "Ru5e4", ":kWQC:s", "2bW\\9", ",b,Oo", "0P#^TA@", "NkJ2N", ",jr2m", "&8,b9", "~ee}<", "5w\\BA", "(qvgA", "NgA;3", "zPNGc", "Grz/q", " f0ym", "xxc.#", "HO5T-", "7~L~'", "\\2kIQ", "mukGx", "Vn(r|)", "^`N[Q", "&}0\"8", "f$Vj_=r", "&4Cztt0", "$O0p'", "2Dy,Z&'", "oZ-!+", "--:cJ", "rFx+0", "[=u\\o", "+W j/c", ",PHn&", "0Lw2{", " chnM", "=B9 eGm", "T-rZF", ";- Xj", "_RWz)#", "$Jve\\", "eu-es", "S|z.$", "[O$ln", "2cB2L\\", "z-+;}", "k;NV|", "=\"*e.OWl", "yr~k}", "A~%`a0l", "uh9>%", "!/^<8%", ")b>^!", "1;n&c", "_r)C:", ",wsQ^#", "qR}a3NT.", ".xdata$x", "E5]FrY", "C^g^/T]", "<2=R=", "s$BK5i", "x_Hi7", "BL(3M", "s/:Qh", "GTF3S", "='A0E", "IW2\"h", "XE7kS", "gK4yTC", "UMW)j", "Hl7QF'-@", "9's2\\\"E", "@Yby;", "f)[T'L", "Oo!xM", "sms-FI", "P\\)Z@W", "~Pc93", "czP%N", "9DA{c", "_/_m}", "Y+v V", "h!|bN", "@#3lc", "1HKepP", "4$6z{?@vs", "<;szExC", "pbW=k", "Hq\\t}", "&^8V)\\", "5W3en", "RDgT<", "REEof", "3JA5]v", "|D]ti", "V_X'm", "xt.sb", "}mbF3", "JV[FP", "+;%yT(|", "960wI.", "saPt=", "|6T[5~", "]XIK|", "kU=c9", "UQPXY]Y[", "ngHw%i:", ">p^@X", "J`z-I", "DR+P ba", "xCqH}", "Y*u_0", "aV{U,", "`O'1/", "ZX\"i5", "kJ''e", "kOhna", "z\\e^*", "C|!YGt", "*?%o2", "+);% ", "2zs#+", " a]'5fE", "0|yF^", "x4t|,", "es-ar", "V\"(oqL", "1RziRe", "PlB9Xf", "62Y-`XW_", "hy-am", "J*:7v", "c%j^T,m", "q(X)c", " Microsoft Corporation. All rights reserved.", "TsB6M", "t%9,I", "'[g;OqW", "w:`l{", "xw6x@", "_Yw/U", "krMaUP", ",ey0 ", "WBbsqS=", "={j&Q", "^B{V+\\", "K-j=I", "lln |P", "|;vC+", "WR4dE", "6C|1b", "c.'{(", "W@j0P", "stGoJ", "vyxt~", "El9zQ", "TFt@r", "]>rl{", "C@@4U", "p7U3oK", "1RpW74", "oFFH(", "s`TY\"U", "H=d{>", "xVx0,@5", "[MpNc", ".data", "S*@l~>", "uUE~=v", "7Pr#f", "ZA3~z", "8;RH\"%", "Zx]8K", "UaP xu", "G\\U\\a", "(C8H8", "N(Mv!", "%Z&p*", "yTM>h>", "vp]%V", "z`ay=", "Abho,", "i~9U0", "Z`pCa*", "^XV;q", "k)\"Er", ";p7.e", "`gi8.", "Gm&MS~", "FUf_ ", " Complete Object Locator'", "LNK7J<+", "hMzYTLW", "KnU&/", "0OI}Z", ".G7,MyT", "gj Er", ";&kLi", "4%oG:|", "Vm,o{", "uzdm+~", "Au=ea", "uj:-$", "KNvll", "1niVo", "#~T&b", "OmSP` ", "Lj\\iDJ", "k0dG-", "+lM]8;]", "-Wsp+", ";?uZ]!", "C^KGu", "/lHk|", "@.rsrc", "v9kqj", "B!{ X", ">5z-xh", "(t2Rk", "|VV7y", "7RAmRY", "7hU@z", "?@({|", "4=_d9", "KBkdgU&{L", "u$F,rNA", "-o2A]E", "}u7Se", "4r_?0Y^9-K", "LXwYr", ",4bQq,", "itYXf", "[hHl{?", "7&H}y", "e:AF\"", "1j5H%", "FFG;}", "$FgGdJ", "Q;*-T", "sZE@!", "TEBvD", "_`VH,I", "gW/@Ze]", "!2e}9p", "+g:K*K", "YjgjB", "n@G+}", "H<=rB", "L$$_^[3", "gN?(`i", "\"|W8.g4", "D%W0w\\/A", "bcti4", "KHxIK", "jI^cu", "REA)h", "&g{/", "L~nQA", "sma-SE", "xJ@]s", "EBb)p", "&L}v1", "GetModuleFileNameW", "+Gb/Q", "3'h.+8g&j", "SHBrowseForFolderW", "]F,6g", "Qwowg", ">6D#I", "PV ,=", "s }Pv", "X;QA^=", "aaqU<<", "OriginalFilename", "?KcXb", "H.'tb", "%cE|J!", "rOJwO", "ir0|{!P6", "n~C=b", "T x'>#", "q&8cR4", "|_HfC", "\\{G$=/", "kO#\"0", ")q}kp", "GetModuleHandleExW", "}YBn7", "wA:mn", "!7v(p", "6RRI&S", "%.z8G", "E%J.2", "}ZMNm", "9nNJq", "M`Q+NVB", "iXLrA", "WBQc)", "+=m 2", ".U+]R]", "\\dvE{", "3$3,343<3D3L3T3\\3d3l3t3|3", "D[L0)", "FC/TuL", "ru-RU", "[`U>uY", "\\LU,5=", "kC6|6f", "4%5.z", "v_A\\}", "Jc@HL", "h::95", "29fL'", "~295l`z", ".Vz%q", "bw]c%>Du", ".i6Vw", "qB[a'", "bk)a>", ".hB\\j", "T*eb)q", "MQl#F", "m*BNSm", "k&7lod", "L:nN`", "%0.#iS", "Gh5]b", "@api-ms-win-core-datetime-l1-1-1", "GI-si", "8gQ~LP", "W#A>W`", "Failed to extract", "Tyi>d", "O/CwE", "5zoh~", "!Nx}+", "kaKyD", "V=JGV", "0%w9=FP", "ag~3h", "@-f)!", ",[Rd?", "b\"O?M", "Wj\\_f;|A", "\"G(GvN", "McyT:#S", "O#<5^", "C9'Y|", "mt-mt", ".^,IY", "/}bEGD", "_Fw0m", "`m'X3", "Os?cc", "s=S2p}Ztp", ":k?r6", "o.p:8", "E4d*bK_", "!2GSgo)", "&l 4+Aj", "x~8", "#.q8y", "$d=9y", "SSSSS", "Uaz76", "/!IO_", "ySBxmu", "YJ0+\\", "/hOMPV", "OqI#YkR", "Wk!Eum", "GetSystemDirectoryW", "^TXx_L", "<)YY5", "?>k){oz\"N}w", "dddd, MMMM dd, yyyy", "}Y0T\"", "b~p:`", "JlQbC#,`", "P9Xd>", "+\\pU%", "8e|8l", "fwAb3", "*o,BZY", "eWvzn,]", "y^", "K\\9KD", "{)- N", "/B)3u", "B<^eu", "\\zDEK", "Ba;:DN", "stdz+'", ")-Q2o", "&,[9U", "S%KI_", "c ru7", "|%?S9", "'bJxV", "RxD8*zW", "TCxV1=", "'?-`C", "f-\"{?", ")ZB}c,", "4p[Gu}", "GM'yP{", "pwti>", ".CRT$XTZ", "0 0(00080@0H0P0X0`0h0p0x0", "u5:~Q", "%}{>,[", "2l#a!7L", "hIKkC", "_L-hEOW", "S#W\"I", "Visual Studio Installer", "k:=J-c", ";6te^", " W(F?", "joV9H", "!?%?'0", "^'J|n", "\"D12-id", "?,qVN", "A(?_9", "K'$3D", "Ay.tB.", "wXBl$", "\\ A?s", "=i>x>", "CxmU[", "sO^xD", ",Ao]b", "5nf8b", ".yk8z", "\\'h7Q", "Z4{V5", "TQ*E5", "xIQlH", "qehNZ`", "Yb?qG", "1X3-X", "zHPK3", "m{yC?C", "pGF0s", "ztuP\"", "Jq0G~4", "1oR&75", "oI^u{", ".didat$2", "@7kz;", "U{j_Y", "0p#}*", "CC3{s", "5^`^-", "ZD+^8", "_TELT", "YJB[N#", "9~c2!", "eK%|k", "G_,Rb&", "8ZQfWU4", "oFS~;", "5`^.h", "2A?#^", "D\\'X+", ";|aHz", "}U'bL.", "c[+dca1", "c`I(!", "~mVsR", "JL`GJ", "ewe+>", ".?AUCSystemException@@", "m&`l4.", "'l$IK8C=", "^j~EE", "V6j[i", "&#", "Unable to create or save new files in the folder into which", "?#.mm", "4FaD>", "3http://www.microsoft.com/pkiops/Docs/Repository.htm0", "=Joe)", "?i?ya", "]_MG}j", "[At83", "O/Fd%\"=", "^RQQK", "Failed to decrypt the extract directory", "DN*5=", "u8|,t", "tp\"!u", "HeapReAlloc", "R[i[6d", "u#d_9", "T93:z", "rEt#p", "QFb;4", "*LpCQ", "T!|%/g", "88q#\\", "$I<&?", "Qu#mC:", "g.ip,", "2{9'\"q#P", "(dD@{", "]^f^?", "bVyU4P", "0PO43Z", "dTiA\"", "@tbrpBk", "A>Yg$2", "T_lek", "bn-in", "U[\"Q\\", "mub5+M", "ZCa?a", "aB/l]b", "/F^BOH", "#nq\\bR;", "Z9RFm", "~LPtPV", ".idata", "kS-&$Z", "YlWZx", "%6|lIn", "wk#7q", "t2V1r", "6JHra,", "GetStringTypeW", "Pr~(.", "L+QHBsg^-xz", "U-FZ[", "zeO{x", "?{<~C", "%b=)z", "OW0t{", "+&f20QL", "tA@Gw", "P+h#k", "*x>%nF", "5<5D5L5T5", "T[Vb B", "6LbIn", "zSqM,", "-iQp#", "}8#qk", "O?EBH}", "{\\)^ ", "t/*W<", "o@7Rr", "_EfW:", "K]Ie?\"J9", "CxmEO", "U{5L#X", "QN^[OS", "65lZ]", "@.reloc", "]dl`@9{", "p+r$J", "g}CdB", ">^\\h ", "+.#nx", "GetFileVersionInfoSizeW", "bq{@^Cnd", "rd0`q", "sv-FI", "/p971", "9wU1K", "3@4M4a4", "o8xaI", "DZM>>", "S&%,`", "user32", "40{}$uZ^", "HCFJ%", "z[1La", "9K|1K", "%5~Ze", "P\"jPI", "v_ab3", "BY|b=W", "Z:A_o%", "Yp8jBA", ";N*H7", "F3dZa^", "Fq<]f", "f$ZARd", "v]=Qy", "[m9qE", "8-\\)3%", "0PMK~", "Dv7q3", "VVY <", "`6R9b", ")Vw0h|", "zAv{kI", "^e80/", "3*:t X0", "S)XKi", "iBKjc", "T|3Cy", "7^^8y", "IAtq5T", "Q{KVh", "E;gNb-'", "qplY5", "`eh vector vbase constructor iterator'", "L}&(9", "P #tD", "!!zyyJ", "`,>F'", "9Hl~R5T", ">E5OU", "}rGlI", "XMudn", "ZH$K", "April", ";0;D;T;d;p;", "G4'.1", "8d}f_", "T{K>gU", "_lj5`", "pQ/W`B%", "C<<E=S)", "ky-kg", "MpEWI}", "'H$r>]4", "qaxa:", "-(&HvE", "nKF.W", "Fl$G)", "$Az72a", "-f(qH", "bX#}.", "{,q*;", "D=u//", "Z+v^#", "#-GH%", "i164<", "a!sut", "<^3pu", "ifM:mo", "',k 7", "pwNt@", "uMC-1|", "JVKT'*", "\\Y\\ml", "G?I)z", "'\"Hhb`", "p^D'I", "Z.((>z", "!%$MW", "se;Ge", "|yK8`", "/;*i&w", "e}qwA.", "P*!MaY)", "# +Q0", "\";Hc-K<", "$GNZR", ")7^mh5", "3[&xg", "'~7:so", "QM46-", "+-8`f", "6LQs?@6", "0!T`(", "fb7Uw", "m_l`u", ":1;P;", "jfF-`E", "ojw4n", "NB$3|", "JhY>\\", "&~v;j%", "Z(m?8", "rGn@eq2", "F3;u2", "[oBc?", "i&=K/", "obU5`r", "z3m9b", "3cFLKq", "hmNhE", "xOf?3", "w]RU4", "FreeLibrary", "lv-LV", "pJERQ", "}7koD", "k4IfGk", ".didat$3", "[n>& ", "se-FI", "B:8J#", "_[p\\6", " NYgw", "hkn@>jf", "J4D9/?.6", "epHSZ", "wAr6`", ")wz@)", "LG7fU", "=BxTu", "P[J3E", "Vh$s@", "#*ql&", "oB^_J", "SetLastError", "j~]K:", " i6ku", "%s...", "5{\\}@", "]U^j(I", "i2uMoznp", "*NGVPb", ";pH:YG", "yjno@", "HukG5", "WP^Bd", "Microsoft Code Signing PCA 20240", "}eMSb9", "6l4?e0", ";=Zop8):P", "dp[z:T", "Zl/D?h", "<#<38VP", "p-!I88", "9{<~A", "r(v+%|`", "1U_Xnx6", "&mg n", "\\Lu;Yo*NGdx", "uSd$}", "9{[hxV%", "?=,K`S\\j!", "Gj7 )", "kW^DG0", "w(T)A", "7V=< ", "0.yx<", "zC *de", "2\\j18", "$Ar0<", "WM{tq", "LK.\"fhr", "je+\\+", "wM9N||", "r=u UZ", "ru-ru", "+VN%\\", "-\"fA@gZ", ".DJLI", "8>(vz", "N@+NH", "3eOgJ", "p=Z#~", "FgXv<", "3yX#=", ">C", "^kh9n", "5czBW", "S!W0+", "@_s6[", "ulg`-", "W Qg3", "H$fFf<", "G}Q}#<", "eXnB{", ";#;*;S;", "6a)f;O", "jK!V;Ny", "X` R2", "xx[]j", "4$4,444<4D4L4T4\\4d4l4t4|4", "nhZYN", "v)Q^hI F", "&I/;.p", "+N#gJ", "0g*OH", "SZ`'/", "=\">0>G>", "`Zwgf", "Qr%~Z", "u>ObM", "$`3Sm6", "-FJN7%", "Z=YyA4:", "VarFileInfo", "o#,tp", "!]yPW0!", "=b8;&", "|F8<;", ".didat$7", "84ht-#", "iu26X,&", "#zK>$L", "0BP^'", "JlhoWEc", "I(_@4", "Y\\Q_='2d1r", "Q_8HWy", "^+h5d", "{\"~A@", "'3:_O", "b}MRi", "$UoS7\"", "gG!//[", "0+'1.", "_{PFy", "GetWindowThreadProcessId", "ZT]e,", ">!q3Q", "H[-1UC", ">b,Y2", "GX!gN1", "ar-jo", ":gjy6", "TlsAlloc", "^FdCX", "@4.>_", "t!)om", "RpcStringFreeW", "3_hML", ",0) 0", "9)9B9", "6&7h7o7", "> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\\>`>d>h>l>p>t>x>|>", "`copy constructor closure'", "B4!%/", "E^&x[", "le8]2`", "5&6c6", "L\\DT:", "u", "m{.PE", "xBu^8", "Xlb$YeK/", "'$", "eNe&2h,dD&F", "l&f\"Z", "WOlRi%", "AZAZ[", "GetLastError", "`#-o H0", "|Jg,bZG", "^[xi~", "TTIJI`3X", "[tv0C8", "r1?!BX[", "d|e\\S", "Gefp ", "q.=K>", "9$<4D", "T~Cxu", "`/d_@", "R`BW[o", "ReleaseSRWLockExclusive", "1dm;z", "TEW*K", "1{NnI", "z_^G8", ">TclC", "O~a/RT^", "da0c<", "B||Yu", "; U(z", "I3(h(V", "e;AnP", "jVYLN", "7\"\"Jc", "L;r\\-", "+aSY4", "3$3V3b3l3q3", "es-uy", "JK1oi#V", "%E7&I", "`o*iy", ".R~8)v7", "4r1?xf\\", "]uSQ-", "\"37\\Z", "P+vJHt", "Microsoft Corporation1", "kc}6:", "-jd_;", "n)gSx%", "Wb/;~", "ar-YE", "I(-#n", "@6=x0zcm%&", "5$T.Q", "G9EtT", "(4IO\"", "NBL2~lL/", "`^-=9i", "&UMu@", "D^Rx*-", "cm|N,", "q>V\\s", "2,J>~Q", "Fi}9IL", "oZW-8`", "tE1%FikF", "O3H}3!", "5x`^b", "]%GQ&.", "HPK*#", "je:[m", "#4s[J;d", "?5bW.", "F=E@jDb&f^", "){YO-", "T?TtZ", "}c+]N", "o`5=,E", "*O%Q3", "'K[Fe", "dIaJs", "QkWSVEhh", "Q\\:P!k\\+", "EURUI^N!K", "K8T%y3", "CdU'_", "6;o.l", "}WDo#e", "operator \"\" ", "lDH<|", "y}/dX", "VLwO", "N5$M%E", "j(0\\sg", "jsl1,R", "j", "dB)Vp", "k/Ltdu", "^N8Dn2", "?&9eKv", "V9&:W~", "`ee|o", "GetStartupInfoW", "%^1fgk", "jY^dI", "gp.(XRe", "Failed to allocate log", "yaxAv", ")#%AvE", "B?N?", "zh-CHT", ",21#[:", "7Y)nF", "\\(Z17", "XQ!G ", "~HG|X", "5B\"_:", "^x+5r", "iD@c0[hvP", "?nB{]Y1[?t", ">pKk!", "0sU{^p", "hQ=Z<", "MYD9a", "tqBLe", "mVCntU", "*g_[X", "{.6HU*2", ")psW[A", "\\aHV'", "b@kiU>", "qT$#b_", "2$2,282X2d2", "__fastcall", "dc [Z", "tsy#p", "Np0s#}U", "YZ(sgq", "$'6CG", "B@f[w", "TtTb_", "ndj6x", "WaitForMultipleObjects", ")K]4$", "hMRZh", "Q!^!l@", "ZGBoL", "&}q\"u", "?:4&M", "TRiy/", "2toIK.", "?3VuC", "Q3-iw", "c|y2n", "R$m&a", "~w|/k@", "#CXSM", "jb_@?", "T)IDw", "%{^HB", "0lQE{,", "YW4pF", "@\"-Os", "pt-pt", "eLK(w", "0fY$&_", ".C}E0P", "az-AZ-Cyrl", "E=d#'(V", "1thC_E", "&7+;!*:", "&$q", "tK-{l", "7=fM&", "&+MQT", "l9}_KB", ">*bH.]", "aW{YKy", "jRll#", "TOSff", "_#!{<", ">s%-`", "0m1gr", "'r`3q", "l\\nVqR", ";4Z={kzN", "S&m)~r", "WG@/So", "eH09)kE", "H[l4j", "1o-u~n", "X/k#D", "api-ms-win-appmodel-runtime-l1-1-2", "6Z@Nn/", "`'hrb9", "ZGo^6", "l{:#v", "^u@g7", "nMYsq", ":);t;", "~q>a|", "pI_:f", "BKMY!", ">>y4Z", "~x3X", "pH }g", "qEiOgq%~", ";=JN@", "3Z_vc", "CK \\\\", "o>mT|f{", "Q;?nP", "F5HT\\", ";?l\"n", "W]U`V:|'", ";PI{5", "'E6~*", "x+JJu", "mOH4.", "rN}o$7(", "VF8vQ", "ga'>i", "UFN}\\\"", "toyVF(", "`vector constructor iterator'", "'&2vYI@", "^|q-C*", "yor.L)6", "c'R>#J", "`OX]]", "n", "!d?K!", "{|('+", "r{#7:6Up", "}KFcz", "#/>_^", "FPe$*", "6{:-Y", "}t)~N@F", "R7[&Y", "><-woW", "_uu$)", "6jhTc", ";%^4$", "Kj7UG", "es-PA", " -mdn=", "Nq^t}&d", "HP|D#]", "i-3c~", "3-DHrD", "E$A^l0", "5Ph;,", "{Vj@rl84~{", "}i4Zf", "uK;sl", ";;x23", "3A`\"7c", "$Yl>U", "K1Z[n", "u4<+h@", "nMRNd`", "kn-IN", "\"^hi^", "\\,0ZY", "*)h2c'aA", "P5W5d", "a%=1h", "_co7z", "k-}#x", "U4pTN", "V U^)", "UD9W{w", "vj88[", "G(?)z0", "f#6QM>", "_r5t9", "8g@tb", "_`8W!", "Y-r\"v", "kLfS$", "7OGjD", "?a(6C", "[6/1{@", "F?aYi", "\\Lad.", "DtGHDEa", "`Rx~.&", "BEJDfi", "I|VwuX", "0oDJbap0", "2<='|", "{=9kk", "5D(RZ4Ity", "35W1}", "ilOFQ", "FlsAlloc", "Gw`\">", "N3gI^", "B5b>t", ".5F1t", "zo=*Kvc", "D))Wm", "bv;%q", "1mfGu)", "!Xdk8;", "C*|\"<", "w!t\"9Y", "{f@>(", "!%(t.'{", ";\\~w=z", "TaOnj", "tn-ZA", "", "{6!I0", "\">&WW", "~ARU%", "^v\"Z3o", ")6/,of", "hh.Ii", "_EWC/", "RT:C]", "[wh;R", "4ud.W", "f{[O/&", "C6HJ.Sa<", "M->fq", "~|k4k2H;F", "qjFq>q2IX", "?@?X?g?l?q?", "}*g.q_", "HeapAlloc", "V\"9OP%", "; pkCo", "5=%=&>K|?", "Vh,.@", "xN8|e", " 0]Jj", "PfKhCD", "z?$p=", "hd'<^", "hGbCp", "o*|F<", "[z_u{", "Pzg#'`", "w\\/m:", "Jsb", "^b?9[", "Bc<.Z}P", ")c=59", "%`:M-", "qd>_4", "?h=)(R%", "~`4:X>", "BqyLB", "|s(bz", ")G^c<", "vMGSPM&,", ")B )c", "/r+bG", "/U~5l", "LV$3tRa", "$qg9$", "A]#X:", "_hWX]c", "\\1s,,", "|!.b8", "|", ";J5#L", "@ja-JP", "lgBI04~", "4M(HB", "X]0i&", "m8m:ljm", "l3%;8", "3.)HJ", "\\D#+*{", "%]8oX", "lPWM9", "1pzW-", ":7", "Q28oR", "3,IR=sT", "w[c}3", "]Q^cw", "4N2i8", "eU8j3", " e?.'", "P\"(52", ".wP,:", "FlsFree", "9fD[I!", "Vv)1ws", "jdk?%", "J#CAn", "n9V[*", "0$0,040<0D0L0T0\\0d0l0t0|0", "A@@Ai", "ty-Hw", "vMc(v", "uVfC$O", "qgt#j`", "C$]3k", "suI%,", ";-syN", "wDI%D", "Zy,=M", "%7ua>", "\\PWfs", "v+yx_ynt", ";RA)q@", "FmdY/", "<#T>F", "t'

", "7F;G$F4j>", "`&HMt", "q)yKQ3z/U", ".^]5 ", "TW.Y\\", "Jw|(s", "vAkm+", "UzOZ&@\\", "O:N%H", "x|c_n", "zL{-^", "71+,3", "(>yLB", "HYKw~", "Phf<,", "Z>:95B", "D/{f&", "+=vvt$H", "R:vnQN*", "0^_[]", ".O8v0", "%8n[2", "`h)H%]]#^", "1e.k)", "<*\\':S!", "hwkO]", "j#*_*", "E}Bh#|", "qx_79", "2$,HQ", "j3_7:", "bs-ba-latn", "api-ms-", "'Q8qs", "S2P9X", "f_'ZR", "Esfrq", ")5sQQ", "jANE4", "zJ4Q(", "DF?!u&", "R^|W^", "i7gU8", "lU~x.", "\\uC%<", "hP!FO&l", "SetCurrentDirectoryW", "R#A%w}", "n6\"wF%V", ".CRT$XCA", "vqCW7 ", "H(KY%", "h((=6", "e:nV\\", "ar-ye", "kht}z8", "iX?cNG", "gLhg[", "BUdNb", "PqEb&U=d", "0o_NB;{T", "5#Xh)", "`OQ+m", "X0V0T", "e>@I|", "Hv\"5y-", ",+Y@/}", "vM<|z", "DAvep", "VGVl^", "3?!l@", "]+Dqb", "'puMj", "O0ZK;6 \\~", "8f\"r2e", "%RfAy", "P3F=h", "p[%T\\", "E==2e", "V\"nVF", "N{#~!E", "C8w47", "ipou=", "}$sH:", "Monday", "%;t1J\"", "-t5*}", "VMFTH", "X M(m", "~F$uC\"", "X 1'b", "-3i-=4", "gO#N~", "r'4O(YuFC", "3W@b%", "}/)SmR@", "fgE++", "ZYxoe", "FDIDestroy", ":R\\%b", "*f>em", "~?1Y2", "=a{?I", "(W9Kg", "~Ij ^", "&d8W'(", "cR3ab", "N);9Q", "t:F8M", "B]F\"G", ":D}AB", ":ns+lT", "3-YN:", "z1tmk", "=MOGh%ut", ")38~f!", "9B1L z", "g63Kpgj\"", "D+EU+", "q-sJN", "1<6D8", "Oj@hF", "p\"X';", "sq,Le", "M\\dAQ", "C{HDB", "|WVJ>", "GJfp_", "Ocs/C", ":)Z3y", "gonWm", "q!u_+o", ")AB5z<8", "`],HoNhyC", "Jz-Z@c/Q", "\\F_j(", "wKB~", "pmd*N", "i&F&hj", "TM`5Z6L", "'* r2N", "9C1 U![ *U", "P>y32", "YbN\\U", "W{q2>'OT", "XOD<')Ug", "WXHk;W", "~q0S-", ";+3 m", "\"D7B\\b", "E4};G!cP$", "%04d/%02d/%02d %02d:%02d:%02d", "FOh%K", "sD7`S", "+SZ}=f\"", "Q#{V,~ ", "WK\"Pt9K", "}*+5ru", "_j!/d", "RumBi", "T[G0w", "p~", ".\"J]{", "bO\\%u", "AZeeC", "f]UyNH", "_suHI&>", "%x/E", "ky6RpV", "GKf/p", "&5cBM", "yz23o", "|:>7on", "T~tWf&v", "W{+go", "Jax;I", "0889{", "wcS_@&`v", "0\"1D1h1", "BpS>u", "C6m4U0.", "Q''<\\", "Dtr Iumw", "6qE?Q", "AkAsb", ".d?j-", "Cu ?3", "suJ6$", "CN[(2", "*AKM?e", "CxyK%", "j=vh1w", "gMR5%", "Oou@\\", "E_]Hv", "V]XK@", "<<0,$", "\"M5,\"V", "3N*c)*", "<}z7)", "zqu3Y", "2/JZY]Z", "5Y5}5", "V/f%<", "000|001", "YooAl~", "Z[SjWWG", "Qza{(", "\\E~Bx", "b\"hK=B2", "&k]f]u0", "jVkCJ", "f>8DB", "", "+imev", "", "R!DNxY", "e|WTt", "cy^b.", ".;8#I", "/k]0O", "quz-PE", "-!X:U$Gg", "APW7!r", "Bdq] ", "rxw,4A", "X6&4n", "53T#5#", "Rwf0n", "ar-ma", "v\\&%p", "`,N&4", "a$:} ", "l}LdgZF", "O`f79_", "x/^53", "w?G>1b", " p*\"S", "uj*Xf;", "Efpq,T", "VzJL9", "w|H0a^", "sw-ke", "KuU,-", "%|[&eNK", "vIOsJ", "sUp8L", "n(cp_Pr", "qHJ[K", "fUIM)", "(y;7Mf", "lLt+C", "6eiG3", "cxxeH)", "?FskEn", ") @LQh", "?Kz0w", "Cj1fZLS", "*fE;]", "-=m0:", "$DO!8", "0\\pf%T", "w6cwW<", "2VU'c9", ")wBi_", "3V1\\,", " jp_P", "[=&UOpb", "$'o$]", "?{;Mu", "^g}[LE5", "#1nGP", "M!q<&DLR", "uEHJL;", "v1;y ZjU", "AuL-q", "W9:|mS", "AjcBD", "s/2aG", "rD{Jm", "A9;QE", "en-au", "h MbW", "C|)'qJ", "x{ 0[w", "lstrlenW", "ca-es", ":Xgh<", "7|o\\OH", "/X&&Dg", "3G/Q;A", "zh-HK", "7==2!", "IzH6a", "7ZX&?", "(:WJYDR", "]* {k", ")7hcR", "zTFTh", "9X3+@", "B$P_j", "lIfiE", "v`1 q", "nUpb`", "mfluN", "k}XnL ", "7^Xn6U", "4=/J<", "qj?Q?i", "\"9\\'W`", ".sL](", ";]36\\<|[v", "6 d^_", "}*tJps", "&:i]VM", "2kvw&!A", "{][x}", "|.D`W", "RzhJ-S35", "|~;SO", "rUCS?d", "[D{nP", "d{=~<2`", "ADVAPI32.dll", "\\~sm(%", "=[\\[y", "1X0]n", "L[$#:", "%Xu?<", "$dFRwD", "fW``va", "Ir|4P", ">Y8)`U)s", "cluyk%", "~DFn%", "T(8#-", "9zl_{", "/[,SE", "m\\4eOd", "K\"`]'", "eHv,,>", "q~]l8", "R(3]\"", "f{$aZ", "}|])'r", "*nm;2", "@gZb2X^", "(Q5ox", "6", "5QLAV7", "8+E:B", "]\"&6U", ".f[.q!W", "C,9hY ", "w96g=wL", "\"GZZG", "sqI^!", "zzcDpwv`", "kJ (6", "sZG5M", "9~y\"2)", "e{;4M", "CrpmY", "_KTyb", "qX%|2", "DZ&X^", "GetWindow", "IQ4%4", "boxstub.exe", "RFyA7(", "llk%]", "wotL4", "]#W:T", "`rspAQ{>>", "20260611192300.422Z0", "EGVgE!=C6f", "naQPOX", "fl,Ps", "GetCurrentProcessId", "M*p6EX", "K!/kh", ">{Khr", "\\~e*aZb;\\z", "4Us#F", "y^/P)", "mOA)@Fm", "\"Jw%u@s9", "#@@+#", "WQ&Jp@L", "G(d h", "hH^.u", "98rf$O5IP", "7`^\"", "YIZmn", "J5>3^", "NBcKx<_y", "TGI]Uv", "?#B8V", "-QU'V", "\"5Y![-q", "Ke(=&i", "3(3L3d3l3t3|3", "3eFmU", "ui-fuWH", "LsRrsH", "8M 3p", "0VIyr", "\"si&3RG", "mXgaV", "G2so5", "+P6m$T", "oFi@h", "~a<6'", "7o/>n=", "j,M&W", "@(l_l", "<}{YZ", "kE3'f)?x", "api-ms-win-core-synch-l1-2-0", "Yu]Za", "<^>xe", "g-Od}F", "6*~Q:p", "mkPlQ", "r+GMG$", "ed`\\!G", "nF!tq", " {\\AF", "#jJ&D", "@74", "*9UI6\"z", "6ZW(>", "/(3'z", "ar-sy", "787_7", "H~hxc", "!r>Zw{VQ#", "E5nn\"", "rbrhV<", "a,qHlK", "Umk(c", "D1qzf", "v>x6}y#", "z:b^0T", "0+V&8", ":dGb\\", "Failed to allocate memory for the directory control value", "%Q6", "<0b$3h", "ey5e 8yZ", "XS('x", "l45HX", "`.data", "0oJ!O", "1ns:K", "S9k/F", "YG(M>", "5*'W@\"", "~QBR2", "wi'M.", ".Fg]'", "Ff>H}", "{an1y", "L!_,?.#", "[UdL)e", "01%ajh_d6~g", "q =A`", "VC!HmK", "rI)`P", "`EufmZ", "ar-bh", "qKPX!|", " _%3}Z", "rcNs\\", "Sh0x@", "[Bay*[", "Q7b|>", "Failed to allocate memory for the title", "WjA+h", "?g(C)", "I,)[*", "+wPr)", "xd:igi", "kpWdt>L", "Ds9-:", "^|zn", "gNCiB", "oh oU!X", "2F@&wY", ")b/4!sf", ",R[sgPVW", "$B;(X", "Failed to generate a random value", "6W#~Jsd", "=,-T1", "h4Vaz", "h9eL%", "_7gw$0", "Nmqw=Wm", "34-wdl", "uS8*mv", "3~Tp=", "hI,o{", "yK'J^.", "\"lp5;T3", "-6VoE", "N)sM{n", "L#Quw", "n^%3i", "$b&Q@", "X!L!&h", "5%qox", "]sJxa", "JxqqJ", "G9WDP", "January", "{eNG`", ".idata$6", "eiCdR", "Pnl.z", "F@OsG", "-l+Jf", "/vujI", "pXxhO", "/-l0)", "1F_,C", "b;{BJ", "0\\F|b", "`t7k9", "fhe-V", "`_$[?l7~4Q", "k1'o(", "a0f\"aB`", "Failed to get the text of the label", ".,QFk", "23f('#", ")srCf9", "tHUEv", "44!k_", " :CPNxF?-", "y%'~U", "Npp@c", "4JxnQ", "Upm/&", "w)@9w", "N^4<0", "ZGf} ", "tyeFjts", "3}/s]", "\"/,(US", " #Qs`l", "9[#o{q", "v87E J", "d_W]T", "xRZ9:", "+F`Q@m=", "<+jPe", "N!l^]", "bOV2m", " cE>6", "Jc>5PF8", "_f+Us", "Y4SGf", "YGiy^", "?Y~:|X", ";RiZ>B", "u$!G0!G4", "_8&YG", "i|pMv", "SO]xH", "OceIt>", "/~{sn", "n`v-j`ZB+kd]", "=]q\\$", ">s%z%Z;", "`SLVk", "{ng2'?", "]A!3vW", "l/tEx", "uA%pDFO", "2C~zx", "L{5\"u", ":*T+K\\", "[y@Is", "e}s>h", ":pOgT[Ly", "4y'7N", ">s011", "\"2L}M", "k;6>^", "X3[nz$l", "QvG09", "|>%v7", "v[RDSSt", "\\uoHeU", "MJ=7A", "gr?Sb", "XYA0&", "n>LV3v", "^k2?c", "Hb&nS", "'iP*04", ",A}va", "LcVoy", "`DQb>", "*Q?^k", "0KQ:k(:", "B? z%", "1d<[C", "VH{6\\", ":9\"a^>", "}-bQT", "z(R$M", "Lz# s", "/AauZ", "ZLDG)", "e;*$7l", "8p4-Pg", "zG7j&`{", "s[C)8=", "nkVM", "\"ux[Z", "\\t>ENW", "I8Bjz\"H", "43Tn]o", "A=:fm", "xjtr6", "`RTTI", "%`5@)\"", "I\"~XEO", "@_`(L", "J{s\\1", "D'BCn:", "?3H-h", "DjL+?u", "O-3Fu", "2G3_3", "8okiy7", "A:Eai", "t{]fmx", ":3D.E", "CDr']", "@\\Egk", "5NCe0e", "Xb{@`", "i+Vql", "Sw1xv", "/D2AQl", "*,4t#Ke", "jU^R?", "2X+Rfk", "n0>O0", "Qv3pSY", ">].\\8", ":SL-2/", "cxUAS[C", "!=`zV", "-XRG`", "]V7{w", "(5D#i", "QvtkJ", "]yjI5+XE", "pW\\y=", "yL~hC", "D6(0T", ".text", "JI&a]_", "Z7ibS+a", "aQ0xj4", "T=Hex", "~peZ`", "1h&k-oy`", "n@Li!", "SHA256", "@!0/E", "Q%p/d", "vZkU?Bv$", "?db9i", "1xZ}4", "QfKOa", "+8}!w", "9^h/8", "lj kBwC", "{\\Z>Q", "'&96>", "9#A6n", "s_M{E", "gcf2n", ";Iy3<", "9:kt3", "%~&xN", "xqn(Jlzn", "tC4J=l", "YxLx+9", "?4?&$", "$n2{X", "\\hlV;j", "`J-[&t", "iCEyIQ", "Z=|qg", "#%Wri", "YU)rD", "8m6R*", "OUZ?W", "yb8o ", "~o/sa", "pa-in", "~~S0[f", "(TNEp", "s28Cv", "F.jgYf;", "N4,Moe", "yH;I5", "?|4_)", "53a+kW@", "U3:%MAx", "en-gb", "FX;o0<", "}2ZC/", " MfBL", "y4xn:", ":Dl]<(I", "h|-&e", ". hfR", "en-zw", "z0s=w", "T'.-T", "Y!`U:", "(-TXK", "K:[J?", "Kl{7G", "GO!4Hj", "y,wD?D", "3+(V&", "t6)hF", "bad exception", "9G%A-", "(\\\"uz", "dHW+O&o", "UvXC!", "8F](2K", "Ko^wpuw", "d?xEx", "1#IND", "w+|Af", "\"|C|I*", "mX]m ", "bMC,+", "Failed to set _SFX_CAB_EXE_ORIGINALDIRECTORY", "K7(_v", "DP3E&2S", "{0.H4", "!fnuHs", "NIdwkau0", "o]lL-", "fKh3@", ";Zj\\", "CorExitProcess", "GetSystemTimeAsFileTime", "Ai$0b", "9f4uU", "3)lLR", "&T7+qyZv", "$?uZu", "5G1~E", "Yl$r8W", "I#]Z'6", "Rs4 '", "ogYG/g", "yKr y", "lqY/n", "fr-ca", "[f57v", "z7sH6", ":m4hV", "/eO_uO", "akugT*oF", "?WJFZ", "i=uj(", "oT52\\2", "9,8pM", "QWY-U", "3q*5on", "?nk#O", "zh-hk", "oOd%v", "bJt_7", "J(:*ow", "o+!!5", "LIH7:", ".L-d{", "ET:io\"", "`;s@I", "[>\"Wp", "Oqlg+", "q6`6,+", ";$<65W>", "a;1^P", "d&w'7L", "rg@&P", "_9#G,a", "$K9|5gJC", "Q.w3u", "nzxwK", "e`/5N\\", "}-\\'DA", "k5>tR", "4[Urp", "'uQ@Nb", "7\"sf$", "'7q6E)zF", "Gcc#.", "#$.7~U", "uz-uz-latn", "T55UhWNmwq", "'OkTJ", "~MDd/OA:G", "dC*LK", "?rCpB8_", "#G9w'", "iOMMyl", "8(8;8B8J8b8x8", "*1ic+", "lk;hK", "sa;jxU", "y+Tw[]BDH%", "Y#>u9A", "Y+9w\\", "8_|'}_", "aX8EO", "/`1VI", "VB)Sdi", "a|s`i", "IPz(Jw(", "8uG(2Bi", "+!r1J", "ADwRD", "+6 z,", "O:zI?", "-~wl=j<", "ABCw&f", "ar-LY", "-Qb(1", "5Y:F|", "0k<6T", "@>R#q", "W}|e6", "0R+Fn", "uzgN)|", "o\\e=-", "ivJr-<", "t]>Cb", ":evlR", ".rdata$T", "@ FiP", "Fm%!B", "5RFK?", "XiBzQ", "@-F\"k", "b56~7", "\"by)E", "lGOsm", "ldFUX*", "aqX{", "[kg(<", "? ?$?(?,?0?4?8?", "-$[&>N", "K\"+F8", "utF3Q", "kaCuN", "Rzu+%", "3de?7", "4EBgD", "_hJ!`", "JyrDW", "O2C#zw", "S>DV5", "\":V'J", "dII|GE9", "wP!3w", "slfxg", "zO`|'", "ImzZ,", "?@,,Y", "zmI@4", "|]/kz", "jgxto", "!>a`t", "+kTMN", "yg|~A", ":_^-P", "sANK}", "pMBAxtA ", "~]KW]", "W^}0>Xk`", "=VM P", "6$6)63686B6H6[6a6o6u6{6", "YQb_t", "gD/U&", "Vr31wu", "/(%Soli", "e1H:G", "%S#[k", "#>n~E*", "f:\"a+", "@EAJD@", ".s+(*V", ":j/7m", "q0LqQDLg@V", "4u/eq}", "zzM_rG", "!1/]II", "`vXA1", "Fm3#(>$", "$JjZ<#", "oR^,Bfr", ")mlUE{", "c*>Qul", "z`9\\J", "%\":uT", "i8:K\\N", "G^", "rFf;u", "E\"v{)HB", "17.14.37411.7", "h08.{", "{kR_?", ".[LAX\"", "Ldws|", "4L5n&GHV", "ZCn76$", "'[#/G", "R:MTeB", "ye7$*", "[j=cO", "GetConsoleOutputCP", ">uc4HU{", "J!wr?", "Tnn|m?H", "(^A.5", "\"D1ob", "lJ=T!", "xHvDp", "-9+`!", "8N(up+", "zBfYJ", "jtV22", "*-WI\"", "zJv4n[", ",~5.hq", "iWOV~Z", "r@`m3", "U566{A", "+~b{d", "VS@W~*", "W`Vr-k;", "Ep}j\"_", ">s=L)<", "w{e,+", "Va|`LL", "$BkC\\", "snqn9", "s0pA6", "12mQ{", "P8lnb", "UU,Guv", "`vftable'", "v4gw!", "|KGxZ", "Yb\\]R~", "w%/xuT", "YSm}r", "~DB=y", "XCEt.", "5^,C[", "_d>w4", "Fu!0]", "&C=\\,", "-o@o@S", "*1e!9", "|p17Y", "5Hwcd", "ui3,.J", "DbAs+", "QJIHj", "tTKFF", "TvL{k", "}t u|", "ihQcO", ";9kB,", "Q/'f ", "{ouOSz", ")o7CX", "%L0QW", "hO!]uiU", "L1(c|", "$*`?_", "8u$ \"", "R51B%", "0SeHI5d", "$lS+^", "7uyQv", "E'x*N", "$k?ib", "U!9V}", "Pn2 A", "Jzf\"W", "Sv=cn", "<4}lX", "Wf(M ", "", "&0I0W0", "a>?x1a", "VVYVcba", "u$_HV", "9N^[>", "Kqa/`5", "ABd8V", ":re<:", "66g-Y", "bV`fW", "6t@!~", "II,}N", "0>6|k", "L t30", " Ah", "9-r;0l", "G_5$j", "6EeP=z!", "-]U3'", ".,-Ae", "6|bKd1pZieo", "=dp@Y", "_:8q+", "[&y9T", "P#nCwv", "p^fY(", "fr-LU", "8z6To", "sw-KE", "/tu9h;", "o<79p", "a'L^$,v", "l:pDj", "abEC^ ", "mF3WR", "\"G1V4R", "yv0$w", "&b&NN", "Ly", "hMbN8", "3I5/2~", "Uqe$=?_", ":QW}9", "XL7N}", "9CZ,9FCX9", "s^n3U", "TrWgv^", "v1sRns", "{#)Dy", " ]F{H'", "*n@ych", "UB@hW", "h8/?:-", "6_8Uu", "GPG;S:", "BfP/i", "zb)oc:", "d)1Fd", "(^<1H", "RN% D ", ";4<&=", "!Eux)", "y2)@;", "0fW7f", "F.V'_", "lB{T-", "By>m`0", "IH}V-", " J&jh", "=g,No", "/23;Hd", "q7Z.:", "p%^CE", "2&vCu", "G=PVV", ",6Dgmxh", "~}=JhQ", "{!-|]", "r70i%'", "qtq\"x.,", "/=EJT", "b;m#s", "w^==3", "X)1tFO", "\"pl(u", "{x+LJ", "m5*Clc", "AH#pD", "iU*[t?", "]+`+5", "2#XAMw", "M)~Iz6N", "Failed to allocate memory to hold extracted file handles.", "*TgyzJ", "y8hPs@", "xN]kd", "0++N^", "tg^.F", "^Kd?J6T", "H,y@!c{M", ":0xxz", "G,9G(", "x/fi!", "CV4GVo", "LDZZg", "NL>dl", "t^y{.{", "S^cbLoP", "QCg!W", "#hG /", "`~G';awQu", "?_6Pc?t'Rw", "3x:n4G\"y", "__vectorcall", "vt[LeL", "<0K", "*{/UY", "_1Aa'Y", "&W?wG#4C5@*", "_?HUuK", "LHOp[", "IFrxV", "*5Bbq5", "olyx*a", "rmB,*", "[PD5)", "#}!;o", "vVZS2", "^Vd'c", "pZ#i]q~", "\"CPP}", "o_Fmu", "MBGf^ff)", "JCGl@", "knHt@", "vD'4\\", "p}AJ6;", "e}X\\CJ", "w3&zK", "R/rHh", "=xXO1", "DZ49B", "xl^07", "~D@O*%$", "iV:%5W", "?`T`yr", "8K8R8e8s8z8", "d,!;\\`", " `Y<*B", "*\"' *n$", "->IsU", "|fn>T1\\", "{ sL4", "L^o$Q", "=3\"M ", "2 IsO", "oy0gZ", "asP^Y6", "6=z(C", "}gTE?", "7JB(0", "ZEMc", "uSr}:bR", "CkRZr", "]aY1$n", ")oC=-v[", "< <@p", "RPD@/", "hfVI ", ">U0eZ/", "^?EFZ", "hfY@~|", "C;lHvqF", "9^|~!;~pt", "W#6rh,s", "t&>sFGi", "V9 Un+", "ntdll", "otygj", "qS$F^", ";=pcw2", "4;E0C", "Cr0TjN[(", ",E:x$", "l-[ Y$Nn", "j{FYq", "\\A", "Io^9o", "]=D,G\\", "~=:eN", "M>Hys)", "'lR%i", "kiEu_n", ";{:-F", ")Bn4B", ")bv9q/:_", ";h^%O", "(t.\\[iZ", "t^V\"s", "mnvfz.", "6_gFG", "Failed to set _SFX_CAB_EXE_PATH", "[4p=*", "6t_=b?", "*9/gh", "e\\vXt", "RegCloseKey", "|S'OcNnU", "5mG^!AN", "R5v.)", "}tMmtObxh_", "WoqK`", "y'a;]", "Am|nv*", "!vXZdK", "!jeE.", "VvK*Y", "%hr $", "fr-be", "0+.>LE", "s_/O>#", "Microsoft Time-Stamp PCA 20100", "^BKEW", "n@b=)", "N6;*N", "Z#1h*}", "~2\\XyC", "|z**HJ", " D\\be", "'Q6E?", "2^e{3", "G5LE\"", "i]E>F", "-{zZR+", "i:/`1", "zx%n6", "b;Rdc\"", "t*w[_", "OzwjZ", "oue!(", "xvN Q", "|`Xsy", "{Pudfz* }", "1/0-0", "tJw5#", "VYY,]", ". tw*", "EA6-N", ")32XW", "?L)=.", " =\\tHuH4K", "Hg2GR", "Nd,E!", "SetStdHandle", "P+%`)", "|q0Bf", "99{dr", "e6j,h", "UDLR4s", "y#x0_V", "=$=?=N=Y=^=c=~=", "2.#4p!'", "\\hS_I", "O_gJA3", "R{Y-u", "__COMPAT_LAYER", "PkF&&h0", "/vw0$", "W=]{G>", "9jni,5QJ2", "Sw#0T6H", "8_IQ*", "VodOx", "JA3,x", "Fb6\\X:", "V-ywC", "R5!gn", " _>_L", "r|x2T", "N#E dT", "$/ k|", "6j(71", "vPL*S3~JW", "J<2@&", "V yC_u-)0L)", ":!8m)", "f%Hihk`", "February", "O15fU", "2rklG", "240808205418Z", "AbnN;NA", "IMGA#Q%", "\\G)A3}/", "ZrefA;,", "3CScNz", "##I%J7", "kVlU(", "O$=J(", "p%e-\"", ",5T|K", "i_yU|", "0%n(D", "g'QG4", "*1%`j", "-1ezA", "3P!JP", ";$;,;4;<;D;L;X;x;", "!z`C[", "LyCn4", "HUVM5NN", "RfI8}", "jA\"9 h|", "#3+=,", "iHC]&M", "]IFd*", "Mccu+", ">yI4l", "HlH49", "iX_O3HU", "J T_r", "j/Xf;", "{m)CIr", "vV.??", "J'|Wu", "'B-P53", "ALto^", "H]OTZ", "Q0$yK", "9.3^f", "GetTempPath2W", "psN&p", "4laq'", "Xq9seB", "Y))W]", ":j:t:", "iK(?^", "2kNX5", "hu-HU", "{s}u(", "pCR]z", "6wmpD", "{g_fwKg", "GetFileAttributesW", ")!IwZ", "'9p*[_", "1E8^+", "}sVF\\`", "BAfD#k", "VrM;}", "ET (Q", "S3_u7", "QZ{Z8", "kisB=+", "nlx`g", "|qy&f", "{>Ahx", "8j/C<", "OfU:)", "jp_}vT", ".O[Q6", "E} \\>T$", "'$dz.", "%6RE\"", "=6L84", ",!\\7J", "[ebzSi", "wL_63", "*@d13*", "'6q&L", "lO+!)", "yid^.", "F'Z.~>", "u!rmM", "zr3Pp0", "wgES.*", "X@NsY", "C6{rdH1", "q;x[Mbxn", "g#15_j", "yStEmc[m(1", "(NS/'`", "6CX)|", "hvc-s", "rbf;u", "CCu,i", "]B}/k0y-xfs", "DjXqv", "4l1s9u", "{x+P`", "#Y;qu7", "${ujD>", "__cdecl", "^q)Gb", "oY@M-Bj", "t%%U?", "-;V@{", "N;TO9", "#w/H6", "zh-MO", "KRp{UB", "y@4Vd", "lf%o,H", "HMC>f", "\"1IXVU", "B>/6G", "vnd:-", "JvMi4", "5IY", "Zes]R", " ((((( H", "[pMmJ", "Q(;bi8", "u(+bN", "ISabQf", "y8)5S", "xa'aI^Y", "6dvHh", "\\\\Zk_j", "?qQ`_", "WGq+,4", "&[{x\"qRv", "6a3dP", "hR0Q3", "D;l>&", "d(e=d", "G;{l|", "j~I{(", "-#^WA", "-CAY\\", "C^Pjp", "(mbM6", "LfW3wS", ")TVsNz", "^crl=", "Ou^g5", "fPQ;3", "A5hl4", "x~G;{", "DosDateTimeToFileTime", "=z1o&", "?\\=/L", "frZ-C", "_Ojh(", "utT/}", "jsv?r", "_nWYH", "nFHLv", "OYW^H", ">qTWbp", " `4FP", "Y", ":;:Z:", "R8WKW!", "Failed to create progress reporting initialization event", "{o/nB", "i_`a*", "s:XJCD0", "qIl>j", "')q0n<`", ".m ^%", "8;-P1", "6{DJr$", "#|'.d", "zh-SG", "@=17M", "PZ= k{", "f.'QPp9l", "QjDn&", ":v%-~", "(V^$3", "*&>|I:", ";?BVUy", "YxfF7(", "Bq#i!k", "<{jDz", "2%2?2F2Q2X2g2", ")4<{$", "EW!O}", "e}\"vtn", "q% lMa", "CG7}Z", "ixb6g", "9~^u{", "C8=#s", "SEfhI<8_", "{'SO}", "}#\\}14", "H^0f?", "/RHmm", "SAiWsz", "|m}d#hA", "!uJ3#", "RnhUq", "nW|-t", "mO]7V", "8ttOy", "~duy\"", " ,<3EA", "}k,a8", "O>XX+w", "VO'3*", ")!}O+", "fM_EK", "U:Ht&7D[q", ">sBF4", "`v24>", "RZ{qw", "es-ec", "\\'gTR", "|p\"#3", "]>!h<", "x0C;^D|", "IKIn0", "C7;R9", "%p/\"-", "z Y[TFu", "(=OZr", "BrP6 N/", "_LP0}", "_Iy`3%", "28tm\\", "FW\"{eT", "EsrLLM4", "7*7U7x7", "Pj$^V", ";S(}#|", "mN&Pzo ", "?_uAkog", "NNWb,", "znt.3", "lv-lv", ".*'x ", "7w\\~_", "s$qSv", "3^n&D", "m_^)Q", "h\\iD0i", "~q+lb", "e))\\V|Hx", "pa4 ]", "d`@lz=(", "9_r$W", "_gagQ", "m4s_7", "h=6~uC", "Y'>'dx", "P0Z)5", "kmb}a", "nrhTK", "&y:Nx", "z>1Ht", "3~cKN", "${( /", "Uk#N>tV", "q%joS", "vJXWQ", "fWk=41^", "9o_&A", "pj;3<", "(4S|;", ")^,WY", "x/cpPN", "es-EC", "fe@_S*c", "c`t]A8", "6N?>]", "0!Csz", "nk!EF", "tV`~p,", "xa%)*", "euHRS", "^xnVp", "t!vJ98", "g''W[", "]RG']", "6A5`|", "aKhRv", "2hN?x", "2tYuG", "P4r4-4", "LkiOo", "{]&drq", "K\\f=L", "\"jBdA", "+^g;9 ", "]d3V<(s.", "//aOgz", "2~jdy@\\", "thqvSx", "'?0aY", "3l5,i&", "dCP5PJB", "%b\"N%g", "E*TeX7", "j5=)E", "Rh @4", "`placement delete[] closure'", ")v&!c", "NMDMRK", "QiRDG", ".text$di", "5W9Gf", "s\\+JLX", ".didat$4", "fB\\@Al", "lMCRC", "nlaj~EO", "af-ZA", "IRm9OA", "wT'Dd)", "]^*'@", ">55+D4", "}HJ@h", "}L>/W", "RO_rF", "G|0FC", "0a#_/", "Aj:8U", "W7yR:v", "&s\"DH;,Z", "g%!^1K", ",^zr1", "c/g%`", "6tL|V", ":(:7:H:z:", "90bol", "iNbHU", "6E6W6a6", "VS^`{A", "ka-GE", "H\"[<%I", "o~=}\\", "EJNyI", "_\"QGOu", "IJA,2(", "6`NvlsL", "B/Ep~U", "BK*.~vl", "Lr-tx@", "h^^LL~$", "D~!]Jy", "'Hqk@V", "GxS}'", "Y[Hh/s", "(1\\e9s@", "^7fI(", "1,/tZ", "mn-mn", "oGej_", "N@{< ", "r=n>[", "T26TdHW", "V+V5l", "xFM%p", "x4i\\\\", "TIi:1", "k!;^r", "K Km}", ">Y]i m.x", "9tkmG", "UXIV[MX", "65e\"E", "L2)in", "9,JW~O!", "$DbG]", "}0hZ6", "w83ej6", "f9:'H^", "Y,+H3MV", "U\"+X7-", "Xg5P>-'", "=Bk*o", "|y='&", "yPeE,", "4xI7I#;", "8N|:~", "YDpDC", ">N>r>", "CSJA =", "W2kM!OS", "];NGe", ";n\\)01Dm", "nE8A|M=", "}{!*y", "`X<.z", ";Rs=/~D", "Bvph'", "c(p6?", "#CmI~8", "Lz9>8w", ";-YWBZ", "'RG( I", "y-aesq", "t~IaF", "/#gMtYT", "se-fi", "4|Q~D", "*.vdoi -", "H22-u1", "l3ip+", "E6\\k5", "<*\"-D", "E ^PQQQQ", "!+$96", "G\\#.f", "cq{i|g&&", "rp'c\\", "sbRjQ", "-ENE|", "/Ma3'", "$XZfK", "e+1Ay", "'MUDH", "|\"&]0S", "*691x", "Zd~ C%T", "J&#NG", "W]iNCC", "|J}V>r", "j?]oV", "qlJ/]mC", "$A]=\"+}", "*kW\\M", "*DGtv", "]rX\"}", "[]3c5", "Z+:1gb5", "9}[nTJ", "pTJRZ", "f:A5u", "`B([\"", "z\\OY7$", "rcP:?<", "/-juG", "H2i1k", ":=;N;W;^;e;l;s;|;", "=zj0_", "ryR2S", "+,lQ6$", "3e#JpH", "iDBRC", "G0?KP\"", "s[8&x", "'*(lau@", ")3k;H", "7pPS ", "_f#gg[", "/k#vH", "r*w`'", "7-mP@\"*s", "\\tz+x", "ocQ&zN", "occ^t", "\"3WR{", "\"[fa|L}hr:", "ZgL-H", "/^aZKc", "h/Ne0J", "}Ir}f", ">,><>L>X>x>", "A~[Edr", "2jj,w);", "'6h,O", ";3K6mJo=Lw", "ck`BP", "$Vd_\"h", "5I]/`", "nan(ind)", "rf$#7", "l<)@N", "9'yfy", "{2xuR", "[GXs7N", "=d.ep^", "Atdjq", "|D2PB", "5_,|0", "'Gn'xG", "mX{ }=n", "nvL=-", "p6V~N", "|q\\-f+", "70(,2", "zu@K2", "6 6(60686@6H6P6X6`6h6p6x6", "3B)L_'Lf", "p:u{4", "b55;V", "^ rJ|", "[r0[Z", "h925<", "7QM5R", "|$}G[", "RVdJY", "Webe~E", "tr-TR", "BOfs@x", ";GobwbM", " KWuZ", "$RvUq", "V8ZH;Ck", ";N>Xx4?rOk", "-YvC~I!", "pMJn ", "|K +Z", "2H5eWT", "7t9L\\", "b B`Y", "FUZ:rg", "tD^sA^>", "rJJeQ", "JLHk^XHk)", "WgV\"_&", "<6`Eg", "5X5f5", "mZ'*wf", "P0r6'", "#|~@6", "sRc-@+'", "|i~gT", "es-UY", "&,)TKr", "t;_?-", "1B24Li", "X`9V,", "u?\"Bq", "vn=6s", "Failed to open the box", "4CjyT", "(Za[D", "\"_^dK", "H:+It#JaM", "\\,.38", "'OE<]", "Qzu,_", "Lwa}5", ";Iu`^", "3U3t4", "uZbM ", "=?Kli", "6 1E?j", "{^eNx", "htd+hx", "en-CB", ">P>\\>", "U(ycX", "GsB|A", "i\"@X-", "@F0Qsq!", "aCJ\\k", "`C9Qu", "kEUVWwsWMj", "\\wUA}", "@J9,h", "%`h{gU", "GT\\8i", "EC|F_", "`K^N#", "`O]v'", "<g#Jp", "vd=;&S9", "T6Jt(C", "0G0N0T0]0f0", "ooUI3T", "tak8r", "uQs-a5", "L-aa;", ",)Il,", "u$f:V", "K\"HhO", "tpv0M", "E10f2+/", "i/1]\"%", "2XX$6HN", "j>5>Od", "-6K5/K\"", "Ig|YNV=\" ", "U@K(p", "5:6@6M6X6h6", ")U+RADg~", "J1K)e", "=kfEb", "Z`^Pl", "c75IS", "FDICopy", "C6QZ#", "06.?]", "7$7*787V7o7t7", "1ectn", "itfZe?", "!Nx\\n", "wY*-v", "LkD}^", "UuidToStringW", "(^%(&", "tQ_A6^'VQ", "YXs+^-z", ":k*;6", "FgMyQ", "KqQt[", "0zmo ", "FileTimeToSystemTime", "KZ\\r/", "#O$8G", "2;+e05", ")-cLM", "B>U6]w", "}Mf'a", "Vv31 ", "ExitProcess", "7wZ]x", "2N3J/", "Y_[^]", "uNp3w", "[2(7wq\"C", "Or7#63", "`5-B\\", "$BWa1?", "3GXxVA", "JdD6fycS", "G;b!/-w", ".?\"e!", "\\|vZE", "-GVK`", "Ax2vh", "[M)\"p", "*NiOK", "CHN0U", "rM$e'", "E0iy[", "r^oQJ", "7>1sYLr", "4(h@.", "^lA?,>", "1hbI0", "sS82y", "j!6#D", "]_Cw?", "y.7J?P5", "#\">O\"", "*P\\8J7x", "=v[ks", "fd>n2", "p L-l", "h*/@'", "Xe?1X", "(VyXX", "pW(5cnR", "Mh]f@", "0OwER", "E'Cf0", "_|VN+", " S]%w", "?'Av\\", "W}aZT", "UTL+W", "hAk.x8", "^2E8;}_4", "\\;YZG", "=kmmA", "{7hX(", "y*8DT", "h`Kr4o{:", "pa]d~", "-[a[-", "WI4/; ", "bTTZ-", "-O5i0", "xJegl\\ $", "3MKgDd", "{/mw=", ":24lUF", "u]@iB", "\"j-C*dq", "Kte0e$3", ")7jN{'%O", "3,:$i", "o)hUI", "Ruhf'", "L(\"9?Jw", "GL$19VL", "s/|~j", ";&I?DP", " p,rir", "Z,jd.", "m|RX#", "#SD+Ed", "v}+3q", "LpN_O", "&kQU]", ";z}#\\", "@1YUSc", "HKx*1", "KYCbU", "\"Ehox", "dbVn0", ")HtPA", "4 4(484\\4d4l4t4|4", "{mg?P", "/@`ly", "pTTDU", "A(n7\\", "X'HKoL", "!Kbg?T", "YdveE", "YD];g", "25of2Q", ";#;7;?;E;S;_;n;s;", "o,]Xbt", "y(Tz-f", "_N`q5", "}31vU", "|Ql8mK", "BMuMK(t", "\"-E:L", "IxpQ;", "3X'v%", "6rrm&", "&A'nR", "69d#Z", "|d*YdL", "x4X=^", "6Az\\m", "G+#(W", "qSLn&", "~JSb7K,", ":;./m", "AW'BL5", "KyC\\:l", "VHay.", "7|4C?4r@", "qrdrK", "%k50v", ",TStA", "4$>@S9]", "lw~-AGWN", "JZ^yr%", "2#Bg4", "Failed to copy the file name", "PostQuitMessage", "SR\\Q.", "(jO^|", "6x)B*", ")H8~+&", "6u5Tt", "KmV-P", "EWR=d", "#fhJL", ":t,{6y", "a]!!{", "Q$*L3", "uq$_'", "I)u6d_", "30NI;", "e\"v\"o?", "q\\I!I$", "0r6}}", "XQo4e7Yt", "!c{M%", "y&M})", "QNm*M", ")p+x8", "D\"D T", "/h{2O^", "02Q_?", "`YheG@", "/\\Y=G", "U|]>T", "TW5|s", "_CoiY", " [fg", "485F5]5", "[H#Ah", "H5#? ", "X.vm\"e", "\\YS0[p", "c;Q@Qx", "'XtK>?<", "le7]z5L", "%}dDe", "b:O_c", "4%\\]1", "5(Kis", "!,F+E", "1)1E1}1", "=7fKi", "3Ecrw", "2Ns+#,", "*qn9:", "r}cj8", "}-^F0", "6gmV:", "SaamF", "DM\"/AC", "7\\7mv", "+-VB[", "Failed to get command line.", "GNfL!", ":7:S:o:", "4E5a5", "`A_iG", "{SLBY", "u$\\|{b#", "!Aj!D", ">7^#l", "+X%ys", "]=-,x", "5Bj~D_", "{Su4$Oc", "%7T<>", "d]'^6", "p\\>5>", "n/iUV", "Hc&5il}", "GLXwPX@", "GBm,U", "\"4l.v", "G!X^ji", "d|E'Kh", "2Z2z2", "ss7}j)", "ke}[U", "J<> /.", "Su3 8", "W\"sK!", "P\"8?wENR", "85#D;", "=Tux+-} ", "Q0rV`", "&h4>$", "T~/X9", "(-Q{,", "B:au3,r", "N21a=", "RA0ft7", "V]bK*", "ASV*`", "=_kQ8", "KMP62)g", "a^P(H0", "geUe\"", "(=`[V", "T]Qv!R", "SF!UY", "D1\\AB", "z#E~h", "#((ir}", "5+oyl", "oN", "SN>n-QU", "A:9f]", "`2p8*", "(i:a_", "v@,RY", "cd;c=", ";tJ[4", "w{9[z", "Ac&FL%", "z;_|ls", "n;m81", "?)cBG", "8ZTp5", "O&,e:", "[xNXglJ-", "V6`@o^", "tgl4QK", "|i}X,", "2 333H3S3`3m3r3~3", "Q/kMg/", "z^C`}", "nB'ho^", "E5F,v", "vuypuv", "Gfm$5", "yoBc[d4!", "o3s2<", "+^W,.", "Bv?l!m", "#mZ=@WpiT", "nu{z", ">+>4>x>", "09rpw", "vzauN", "zvwi|", " &m_.", "Failed to acquire Crypto context", "c5N1 ", "gbwZT", "===Uq", "X9;Xj", "\"z/!.", "dbeweo", "<4UrL", "joEsZ", "qiU)61", "_@32$", "*wyFv", "qOS:A", "HaxF)", "'x+Rz", ">jXpo", "gZB!U", "5Z|*d", ".E:Q}", "8:v26", "s*}L^?r", "+z}my", "N8gT6", ":!:3:Q:c:", "`qv%!", "MdL*_", "$ o}?M2@", "owisJ", "%S7T+F", ".%x0?)", "6J6k6", "SnAHf", ";Z*Df", "_:/Ad", "OKt[w", "tcZgv", "Mls5g", "A$o/ZJ", "1)1E1S1", "ycabinet.dll", "U,eT(", "\\`,Ah", "t/t`6", "!X4=k", "N l3?", "5g<>T", "NBi^1", "w-\\Bk", "es-bo", "_>4m", "rC5uh:", "AC;cc<", "&'Lu6", "(~x;j.i", "IoUX9", "5Q'J7", "u:&*s", ">cyVS", "o'$*H", "eiYF9b", ".rdata$zzzdbg", "F(^wa", "e0(6y-", "Tf;jG", "A+f3>", "C^.@|", "IE#jp", "SlkfYAuW[4%", "X^KAR&4", "ON'r%WU", ";qKnJk", "q@jOek>", "MPQ88", "-!y/So", "1Lc6n", "{g%tY>:", "z~!0kk9i", "/E#}?G", ";p#\\V", "DVGb|>", "?WN5Be", "Zdqm7", "/8(d}+", "cn5J3(", "YDXC_", "1 1(10181@1H1X1|1", "|$ ;|$<", "unVf-", "[O.Uwj", "[zz#,", "uw9+i", "$}{wL>", "6e1U][", "h=JTv", "m=2ZY", "<3jE9", "$ka4T", "scTa5", " `&b kB", "wg~p<", "nDhgo", "I|@n@", ".+c;N4", "}VA1<", "9Cl~ ", "2H2^2g2", "NgP#<", "Xp{;x 5m", "v92V'", "xc_`uy", "L uga", "^`yfz0", "'$\"HJ", "{I|D{", "I|Cb4", "p+_y=", "VVVSj", "'2FpV", "K\\\"ME", "?HZRS", ":+OT&C7,", "O=:T/", "&M[;]><", "^nbZe", "m@\"w#'", "]N~0D ", "^D0^<", "YtVLsO", "cMM|4J", "Cz{b#f", "~3ZW(", "CTb%:", "PQQSVW", "qa+>t", "]Icy9`", "Extraction took %d minutes and %d.%d seconds", ",c~Dw", "*X.P,", "=bNk,Y6", "f\"gK3", "{O^1D", "4O^!/'9", "SS!F!k", "_VhR,", "(ywii", "]U5#/", "Z\\Fe9", "|z.[+", "Myl:#", "ZG.#b", "FPw!2&", "c!PAd", "bHnl^s", ">;1H\"", "{%Nq:=u", "m]lu3(", " EaS[Y", "Mrh@[", ";81z1", "=+J1N", "POf\"A5& ", "!+0a9H", "October", "]Qk3oY", "YvzCz", "yT0OCJJ", "b&a87", "|x&o!", "uJL|d", "hJOF(D", "d\"2;", "7^L Cd", "=G5\">", "X:;P2", "&dtGp", ";YUJr", "e^d!%J\"", "sv-se", ";aYt{", "fYh?~M|", "y|Lxb", "yrUo3", "d*T?n", "{Z0gf", "!_,|0", "+\"Syw", "!fPU`2", "K-)D[", "hA%yK3", "=G|'j", "csVE|x", "W3t| g`", "%bE]9", "X`xD'", "Gq\"d92", "m6%9;", "5GgOy", "AFYhy", "&UXbe", "9nH_>", "RE5%[", "[|:B6", "qRt u", "GmV\\v", ">Ud,u", "K}!Wc9", "pxs0\"", "}hB*eT", "M>SKKeR", "=2>?)", "Gj>-R", "hh_ZU\"q", "Wrs?&", "?YR[gL", "CBu", "*<&]|", "l-:\"@", "]_#PV", "^(4h+e", "}OJ_ ", "\"*D%l;", "nC2DL", "HltR.%A", "&^Ox<", "!DhMg", "bX!$fH", "jhdT5C2%", "=U1Mw", "aU4av", "7;GC*", "4!?MmIm", "T6 gw", "@kJLy", "=\"kz5", "6#haWd", "L3=Zc", "|)8=E)", "KJ-TlK", "-:M<\\}", "5k??r", "'AZ(j", "3;1EB", "*cx'$", "wq3o3", "/~#f#", "$p4r'", "3d@.*", "t3&PC^", "!%|S)", "6(6H6P6X6`6h6p6x6", "~\\|>2", "F![jGg", "/lGZe", "~:uIhw", "GXRSP", "< 0dH$\"", ">6k/7", "1QycW", ":':y:", "!<<..", "]$]Afy", "U=L#\"", "6e|\"V", "*a&[q", "WD/pe#", "Wu6zI", "e^p3 ^", "dP%L>", ". Z+Y", "{%(", "S.)+an", "5Q_X=qu", "_mvu<", "C:heu", "ZWvm\"", "tcx8/", "0D]/e", "-xVr'!", "[]YVqM", "kz>I5", "pn*4Yh[", "U,DKU\"", "WBS2*", "FL|4]", "vG7}\",", "360322221304Z0W1", "P']Nv", ">z4+E", "g\"mR\\", "xrUuf", "+q@aJ1", "q+%TWV", "6tW|Bo'", "sYj_~)", "SF$cP", "TQ$uB$", ")pA", "1aj]n", "z02K#", "Ko4HB8*", "$nKG?+", "PGBzV", "\"jY2]6", ".eE:/", ")1d+J", "nV~_r", ":yGmpQ", "TbRE<>a+", "F0[$W@", "M8xX$", "pOjb|", "1XA=eZw", "+u$_U", "D8E`W)", "o{nSRHJ", "rOew)", "s!=G:o];", "dOc@iQ", "(2kf3", "F:H2s", "|vQYM^", "^,n@)1", "XM\\SvC[", "sMgXM", "S3|Q_v", "w)t)8", "8%tXKK@", "Jh,8O", "rs)wu", "F'}@t", "w3Iilp\\j", "qFr~E&", "+ETcD", "qgc4/", "^x}y3", "~A{vE", "JI[LE", "\\XQ%`K", "Hambb", "epiLA ", "!sOo$F\"", "|fqrbX", "H8Jo/", "B-cT<", "b3K;0", "se@4\"3", "HPqc6", "[h[T&v", "3))f;", ">;;\"_", "AHX7h", "Qv}RJ", "R(1^M}", "}O|7jZ", "Fv\"c|", "x59xL", "w+S3:", "D:I%\\", "9-^|O", "2'5Ce1P", "qj`_=Ok", "D`78^", "w%(Hv", "q[N8D", "4v7sYn", "wDX8x", "Y9`10", "N^7d-s", "9+B79", "ATI6L", "`managed vector copy constructor iterator'", "!L`M|f", "<7Po*@", "a&K~H-", "##W_=#", "?t$L'", "H6@(K", ":W!q|", "MessageBoxW", "-+(=v", "es-GT", "M_tXL", "P7J9)", "`j|F@", "1mp^d", "Ry4c*", ")!}rU", "/bnhii", "=qQc]", "8H,Epe", "zh-chs", " ch28Z", "3Tunv", "~'jwEu", "7>? s", "[u{t6\\", "8GrR:\"", "vMV<>U", "T'&?\"", "N_-Sb", "K+i/z", "[{iy%", "V^`Av", "o_F/.", "dgR6t", "xLluU", "5LSAN=Vw", "Wwu", "Se\"`^", "?\\YRG", "\"IR^^", ";!a2.e", "p%61y", "RegOpenKeyExW", "YBD'/", "YQ(eP", "m/R6q", "F2YL@-", ")H)T7", "!>=e)Y3", "7|HGvc", "_%lYc8r", "XJJ*'K", "!-wiG", "vPS$", "D\\(Pl", ";nDa4", "%U,\"9", "qk` \\", "6\"/sn", "0:xdt", "G\"U,0", "+Mv@;", "bg6[mC", "ZSU\\m", "zxZI0", "4J(1E", "/d[li\"&", "8Y[c[", "{!1KY\\", "en-BZ", "9A|xNnb", "33h/r&", "k^LBc", "MX-adg", "B*IKK", "}TC5m~", "}y97=@", "8TFYs3", "fNjU yod$", "W8VF,", "s\"K,}", "]>5CDf", "B\"ZM}", "'Nu.7f", " p##9", "~!-\\P", "O:]:W(d", ",)~d,", "}-):>", "!$_Or", ">C%XB", "V`>69.", "aE?SRE", "xg${5", "d\\ili", "SuM(;", "h}Q@fX", "{2Bg;", ".data$r", "QEAiH", "1 1j[J", "P?R*P]", "WaitForSingleObject", "advapi32.dll", "_0XX/", "3e7,Wr", "qAo~:", "Er26P`", "1_O\\y", "G*1/h", "#h4?v", "HUyl2|", "sr-ba-cyrl", "Sb.dlf{", "|O!N&", "SB*WQdz", "zh-CN", "gz~x*r", "R'>V0", "9!xdh]", "z^y> p", "es-sv", "LoR>K", "L%*p20", "absug", "_':;Q2g", ";m!Ve", "24<>#s", "kxYjF", "F-a4T", "w\\SgW", "rW>Ia", "y&:Tk", "Failed to execute file", "\\)oNxA", "@B-w-", ":?|`kTc", "dnuDr_", "+{9\"E", ";?UJ8", "Z^CT7M1", "co-ZVu:", "hd[E|", "cCpMq", "De(bgR1_", ".~Hg\"-", "*(7XE,", "F\"i8tR", "'X2IJ", "*k\"#!5", "Mz3'(", "Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0", ">|Xk_", "XTy?>5\\", "9c-k9M", "!(d_Z", "GPM^K", "D4^f5", "c^=U)", "ku3rxX", "VirtualQuery", ">N]i(sC", "~l6-!", "C~z[!", "q:t:_:W", "$6-cb", "c_AX7'", "^%!\"4", "T&SAf", "e6heiJX", "IV5apB!", "KB)7z", "Iim5{", "5:IF}", "SPec]", "]t&F_[", "_zf}V", "Sid=\"`", "GA'q''", "!lD@d", "XObGvn", "yC*2SJY", "i@i'k;", "MnK$KO", "\\ST>,", "}4<7R", "l.DJw", "Q%]{_D*", ")S6kZ", "ms-bn", "`dynamic initializer for '", "zA[XC", "&&#-A", "-)l*np", "EIxS/\"", "?KycT", "'=!|\\", "#2joL", "]'O\\}", "@/L(w", "3^9\\Q", "m%1m{", "WP{Gx", ",XLNxHM", "r#=9?", "CySuA", "j#Env", "~qXLV", "<^/g?", "\"LD]_", "A\\~] ", "d/E%=", "?4=-q", "M_LjR", "pj=kp", "mU-6~2", "5XR$$", "|R8E\\", "a.!~&", "`vector vbase copy constructor iterator'", "!b$a3", "HB+TJ", "v~dOCC1'h", "fI!J.", "y_\\Rw", "1a9>Z2", "rB$w>M", "o\\q;h", "v2=K{", ")GM]A", "]1`r.A,", "$S;;1T", "!.e&:", "@/=3!", "+HPJ@V", ")O@H\"i", "K^>N{", "L&=j0", "A@4/y", "lJL`@", "7',xwP%R?R", "))1{%", "#Z[S+Y", "'%nl5", "@^L%`", "#bKIK", "to be uncompressed and installed. Please run this application", "''*)]", "LNW$LT", "JOdMiU.[#o", "5k-Y9", "mSN,3}O", "3 3(30383@3H3P3X3`3h3p3x3", " $?#D", "xf ]_", "C.0 g", "&|{#p(", "j@Xf9", "sr-SP-Latn", "gD}ZXi", "36u!Wh", "\"I{%lpp", "~Cq=@", "DqB/e=U", "<%<+<", "6`>q,Zj", "!}.?Q", "&qAsx", "KG$@D", "vnW/Q", "B0M1_1e1", "T0n2*q/D", "u_&e^", "di&9>", "@.didat", "5jR>t", ".BA}J", "e5//I", "MR8\"2C", "=y 18F,", "qm}{%", "Kr6r\\", "PP9E u!PPSVP", "F0xN5", "^\\,18", "EtxTh", "WJ#e+", "sl-si", "^|ko3", "s#Fg$", " S68qNy", "d\"@o\\<", "K_|jx", "t+O9r", "id-id", "/+(UE", "FUW+n", "3cp}9}", ".V2[r", "mk-mk", "1ON-x", "5vWU9", "K&i&j!", "?z'k#", "yl9[k", "&:KQ]{", "hH.mU3p", "}(+$G", "af-za", "%}QD0", ")PZ02", "ay&7,", "dW:UU2^V", "DESHv;", "L)wtP", ",ggH=", "R%[o*q", " J%B+", "'9~H4", "n#tZ=", "syr-sy", "aNb'x|", "*UJkk", "%0(V6", "ar-IQ", "*fn-Qd", "q3uP0v", "`eh vector copy constructor iterator'", "pX\"(M", "jDUG_", "R}LBY1K", ")jZwykA", "/'ARtj", "{w;^\"", "RZku=p,", "cFuSKo", "}*A;%", "xw=}+", "|T^Z(M", "AM3u1", "YT`!I&.AW", "qqpNM", "yOWggt", "xZiqc", "o6l%Bg", "`JU< ", "Yfo`_", ":b9Hs", "2S!`\\p", "r%W\"`", "9{0~/", "[>jXf", "ixd2C", "\\I&:H", "k8$Xu", "/y|0Vk\\", "k=~D|", "v)\\m@n", "WriteFile", "wS[h[&", "5vhz?", "Su*aX", "LUqg", "e!AK=k", "+o\\,&x", "0n0W1", ")tvHp", "\\]6It", "gs\"--+", "nD+%6", "#6\\'\\", "JrL`J", "v7]`^", "4@IY3", "B>~*M", "R[Lg';_Ys", "9(!p$", "YLHGi", "qY%hP", "RWA!*_z", "&@(IM?", "2Y$J`", "Y?'Gp", "TG}[Q", "j+Z;2r", "JAti(GL", "c&S\":", "#aF^`", "HWX].e;N", "a9xT>", "\"=xHP", "H*{E1.", "sNFdpb_", "kfVc$", "HzL$Y:", "qYf;7", "BSC^b", "cRhrG", "@P~{z", "-.}ft", "xb 0&", "_x~]T", "TmQcC", "?@?U?Z?_?", "\"t q#", ".CRT$XCAA", "[#(a!N;(", "j/x%\\", ":X>;RX", "J3.2i", "c7@Yd", "Or=\\|", "n3`VZ", ";Pmw-", ",)|0X", "p~g<~", "O))OfPj", "3Eiw*", "7X0[1", "*0|{Gf;", "u*wAt", "m*Po6", "_bDQrlS", "is-is", "G;~||", "?ZBtU", "_TSEA", "A`^G'", "afJoE_@", "CgkPk", "UT}Ag", "W6%iTP", "Li7:R+", ";6Ghy", "\\4B,z", "GH%g_9", "Z\\Oi8jYV", "sEp\"@", "I&\\Or", "Bb!kl>=", "ju8\"[", "`cEO{", "JmKRk", "ir#xk", "$7K@F", "^ HoB4n)~", "8&%N", "=h>2_", "1bf^F", "jp+~rYq", "This application requires .Net Framework 4.6 or higher to be installed.", "|`!4m", "Amc/)", "quz-ec", ".didat$6", "}` .u", "B;V0|", ",$cI;", "I!Tnh", "BA_~T~D", "P!,VN", ".vPfW&", "mKP^l", "6EY$l!", "(liV0~i", "PU3p~(", "2.|4X_", "`vector deleting destructor'", "E[EBM", "sC|*fyq", "iFJ!Os", "Ztrnh", "rq%X|5.a", "BoYk*", "ucl3C", "J=\"i\"", "}(3#h", "#3m4b+", "T4mgKI", "GetVersionExW", "POH|h", "u:USX", "fmpckQc*", ":/+-<", "_ho&]%qj", "`d':\"", "sU^vaH4", ">vWpT", ".R)d:", " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~", "~{/OZu", "A{vMx", "0*i/a", " Srx%h", "Ye!1V", "#=i8)", ";,U^V", "[d/OS", "ftMoXR0", "o/vI6", "uCc<&", "nwA(v", "G1[ysU", "F8p5b.", "XR8nM", "7(x]+#", "j]$_?", "CwKNx", "kY;2U|", "_oS,-f", "8tHg9", "/ia?n", "ReadFile", " x0A9", "D.eMg-m'", "rgn@@", "\\bQ`a*", "uc,Wm", "I?N]q", "9epvfa", "/L0hx", "7b!_\".", "#}N1%", "tv)A(", "/9fg4", "dRHba", "(HL;o", "N[FOB", "EN &A,u", "mD]'w", "=Mok2", "y}>_6E!7", "mqN-\\", ">7Eu*J<", "3JHHyv", "&j^eT", "H+m,$@b", "u%N0$", "7@H5t", "7[8 9N9", "*a(zp", "0jmB^", "=cl$T", "Pza/)", "m", "6DZ>;", "s@ojL+", "u7@=:", "kok6>", "GFi^/", "acEz<", "EYY_Od", "9ZQ]~x<)", "s`tSG", "<\\cl?\\yg", "J}i8Yz", "e4*y_", "[;eL\"_|v", "hmafd", "`GbslWG", "r:&*D", "Fh]1FS", "C0OuuH[", "x2u}]", "1R1X1l1", "U%LHAD", "d)>;\\", "h5h&f", "(E}+[q<", "s'|#^", "/.pr0", ",[ ~FO\\", "MwaR7", "z6@Q&", "Gz1sXQ", "P%|f<", "G&gMz", "`DV%O", "+I,}V", "0W=q4J", "@;56+", "AwVyq", "r_A[@", "i|>.W", ",F`nX`F", "fJDpne", "(null)", "rM1N|", "&$RkoR", "ibp^$B2", "Zl&y)", "9?[yf", "XVZ~\"", "!|OWud", "x2KdU", "fo-FO", "B4D_$", "V)L+,", "xM+rX", "+J{5y", "@>$]\"[", "x7#mj", "j3\\D.y", "E@)Lc", "g&7 h", "oOQfX", "\"&$O'", "GetConsoleMode", "ErJki", "nq6J{r", "kglutW", "y6{Cg#", "QLYq}", "AVgBX\"", "6jLV\"", "TGZbH", "/|:Oq", "#lJsH", "`vector copy constructor iterator'", "9 9$9(9,9094989b:", "}(G@zaS", "h+S 7", "OWT3(", " q{HZU", "-8wA.", "OKGF!", "]+!OjR", "$2+z:l", ")F{|hf", "\"\\2Rh", "-DaK_^", "`g@[C", "W*An83", "Y*iwP", "r.4/F", "~#1(0", " @Xzw)G", "?J:ghb", "\"70,@", "vsVDXm", "|iqoK", "0fp.v", " HAjK", ":6W3E", "VP P+1", "V8\\@D", "qj;2<6", "o] aD\\", "TB[hiol%", "'A\"DYO", "6M&iei", "s}:.NZ", "SetEndOfFile", "t]8dL", "(2Kq\\", "W[:7+", "m 3L~oH", "Iyb-(-", "C\\`ft", "7*Wjh", "i(18b", "#,r=:", "$KrY+\\", " dfx", ":|&} ", "T gAl", "4y\"Kz", "^Ee9XC", ")+`Y&", "\\/z96", "jw)/,C$", "%r<\\H", "*K|@v", "?3jDk", "+[SFX", "et\"Vu", "K2%pI3!", ".t8~$", "The entire Box execution exiting with result code: 0x%x", ")f7lx", "q<(=;+n", "k@D%(e", "runas", "V?n1i", "?sZC)_1", "N?1dAF", "Y.qJ[", "w{W!9", "A62E>6<\\", "de]Dg6thB", "B[~)p S", ";N&m8b", "Y3-Z=4", "6pUq}", "B5fkO", "&Xu@D", "J%3]m", "+f;\\X", "`7I7x'", "La]X+Y", "|@FbKE$", "a_\\6c*", "HLqbD", "xT>d4", "&V3H_", "=\\\\?\\", ":3ktg", ")Bg@z", "s2'h@", "wG\"TB", "TM!ff", "Jv|fW", "@V3z<", "R{ F-6d", "]rVZW/", "Microsoft Corporation0", "d@jy6", "V})ZDW<", "\\o[7D", "$R7.-!", "\\Mg~X", "wH*P*", "oV)vd ", "vGD]Mp(h", "/BZf_Z", "ZoQf=@&", "K\"f@y5>", "V)9N@", "eG5kn", "Mx\"/lE", "FEk%>", "~q= hL~", "Z9Z&2", "He]@4", "/Q}Ja", "y~\"c1R]", "fE67@B", "-MAYN", "Zhp-Z", "u>~r2", "NLG;{0|", "p]q<[BE", ">>Bj;WwYk", "[J]|c", "3q^-1a", "rZf;u", "ZbO#7", "b\\B(B", "tR2vnV", "5Yw@O", "`2/]t", "MiA+$", "\\qv+sr:", "}gMI=^", "}ouC%a|*", "_HNu!", "21;de", "XMj[z", "FindNextFileW", ".bS}\\", "BFI\\7", ";.DEk", "vYxyu(", "pKMf,", "N>\"er8", "Ur9[AL", "gTdSM", "9vDZU", "96}C&", "b@t;0=", "tmip/", "NY&eS", "% u#(]", "T4IZv", "lf1Li1", "?_tC}ZH(", "PO`a`", "tr-tr", "Zj!Y[", ",k,-3", "dCIP)v", "GetCPInfo", "<9=T=f=t=", "Arap[", "RoInitialize", "SfM1+~", "up}u G", "IdyO8", "!`l 3", "m?_*;", "}XI4M", ":(,xA", "&(-nf", "Jl1bcCQAS", " LB3b", "|I;Ax", "k[@>%", "|}%BS", "CreateFileA", ".;lry", "@t8(-", ";j;~;", "MOfYg", "4?%w;$M^", "^zWWY4", "NP0WS~OD!", "GF'F`", "_9R-I", "&hjT\"", "$]m(Q1", ":&odS!d", "B?l+j", "dAP5S^Wt", "G;{P|", "Y*sB&", "+Di_'S)K#", "bf[E|", "3`C\\ow", "M/=m9/N", "u,JSS", "ut{HI", "rx_-@", "Qb}wV", "Vhl.@", "\".G;Zm", "\\bQ$\"", "~0&qxf", "d0]WUc", "&w6:~^", "w#+4\"w", "O6,.M", "VdLqD", ".CRT$XPX", "3pHNx", "%%4j[", "9~a/*", "8HecWz", "LFmo-Qw`", ")lZ[b\\", "OtGwFqtS", "6W~ b", "mDZ]L", "OUo}[", "Rl7-#N", "6P8Yp", "9#909B9", "n|b4?", "{`&ms", "]C2&/", "U@j.F", ">sJ 8", "&#[4E", "k%[IFuE", "3uMb5", "&oC}D!M", ".CRT$XIZ", "Yy;)a%", "T#Z29", "fw3:D", "A]A06", "-h5,N{", "u)N<.T9~", "@3aAe", "ZI9{:", "/dq}LlA ", "Q$TM;m", "8jQO[", "v}8H/", "0S\"ZT", "v!+", "mQz`&", "vnUVA", ";x{5#", "~M'7zc", ";2T9j", "6]N;V", "=*G'8/", "npMMf<", "v\\KQB", "V)T:,m.", "r-by]", "|dp>T", ";1(7e", "&d0u'", "!R-#:", "&fKD&", "k2]Dp", "zu{+J", "Uw=|4v{", "7uVfh,", ">4-6", "o{,^K", "ymnfi", "%71pn", "-zz+J", "P/7@z`4", "5XTqF", "yW%8Pg", "B<`J{", "hhQlS=$", "wpjD!", "TAgYle", "N`@X/l", "hAVW&", "0 0$0(0,0004080<0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0", "es-pa", ";t*XxW", "5nm\"t", "_==t&", "yL!,p", "N')T/2s", "%7(iQ", "Mz\\ku", "1+;*T", "YW6A<", "saEz$", "|i I<", "dv1V!yw", "B&N}N", "Kh8=F", "w#lBY", "3^AHk", "Ozb", "Aqmmf", "`virtual displacement map'", "t8c^&", "/QaZ$", ">+-#<", "aX)KC", "y4Aem", ".4yQ{j1y", "\\m'Xe", "wxod5", "818B8X8", "[avK>", "; ;$;4;8;<;@;H;`;", "1aj*6", "mFQu ", "j^!Xv", "z(mhW", "qzOf?", "#2'qm", "5Spd+j@", "h*CVt:32", " ~>{lqb6", "A6n74", "H\")4c", "L\":#}", "en-jm", "KXeTZcb", "sA_J~", "wgxa&", "u\\~6g", "%4MXf1", "B\"q(w", "\\N8vH", "api-ms-win-core-synch-l1-2-0.dll", "Mk}q<|Z", "u_$XKD$w9g", "D%YDS", "k;S??V", "0RRmM ", "Zpf,x", "v$}M", "Extraction took %d milliseconds", "30>0U0r0", "m1~Q;&", "{fK1\\", "7$7,747<7D7L7T7\\7d7l7t7|7", "/Cb\"G", "+V(-&", "V#|U[", "=[H2[F", "GWM]P)", "71s,,", "RCt)*", "fF-FD", "0xsPf", "tH[E ", "xMWJ|@L", "?N>+-m", ",J*%9", "&ngyI", "|'b%8", "M:k+s", "m~-~iz", ",0ILk", "ASv@F", "pz$pw", "fwtr2d", "c'JgQ ", "`%4Gm", "210& D", "2UiF~", "VZjhv", "Vh\\.@", "0+W~h", "=K9os=U", "msm'C4", "w5(d'%~", "lmICr", "Wd6Kps", "aj'^/)o$]a", "aaakr", "gqe.B", "aK6g;o", "E2vmj", "#M`bI", "MNko #yE", "w8;!g5", "~yJ)j", "z{cBk", "az-az-latn", "YTx4)YY", "zDT%z#", "~PpqP_m.", ":X.Fv", "m_;J*", "4@-)8", "]>XOd", "n*AJ-", "4;o@5", ",|xB1", "y aFr", "WK5&./h", "k;)gb", "gu-in", "}GT'y", "Microsoft Corporation1200", "Et Dw", "6L!}h", "XK", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z", "q'BO1", "fzkxu", "eTjUp", "dO&4By", "Ukxkgp@8s", "\\F|'s,U(%A", "a*\":x", "x}2@`,0", "%`c#P", "Nbq&x", "DecodePointer", "%vfYi", "a&5+j", "?P\\#]", "_VnQA^", "1d1s1", "];ap(", "6OrWS", "eoh^B", "Ss;M&", "NWz,P?Q", "gc] sc", "&A3AS6", "en-JM", "Gy#;1", "\"og\\j", "@|qs&", "u(2", "FMAPHf)", "/5\"WB", "G3\"hwHR", "BH8*7", "/CS'E|", "2xwm0", "Y%{W(", "K+kd+", "~|.mG", ":)MJs", "E^Asn", "_z@<]", "D-1k:\"", "rNZ0>", "}?LP ", "\\w0(M", "w6?]%", "de-lu", "/>++h", "Bqn%z", "5+28Zub+", "-OC!-", "aapL}", "vd;Nzb", "@c3=k}", "i#D HWl", ";zB@d", "-n;uc", "js&${", "As|a2[", "Cm[|<>", "@H4.g", "z#:qk", "&9Dj_%", "0c@~O", "#YtD(", "__swift_2", "ftb~i", "2G,Xr0", "F},\"z", "ejhb'", "SwuVQ", "-=`<|y", "XVT{9", "ZqqT\\", "H{34PZ", "(-UN", "quz-bo", "i1 DK[", "XU+{>", "df^7(1R", ".fv`Eo", "NnS}j", "w/0!#", "7PThX", "qt\\E#", "Awb9oc", "DAdlJ", "en-NZ", "P^zfcY", "%!|L9", ">^+Ew", "tCV6\\", "Nl cK", "}$y\"'", "_u4tw-R", "89{zr", "HBpZh", "?^mYoe", "3iD(N", "Q3}_0", ">B=rv", "F~*=2", "H%Cx-", "\\p%5>MM", "_hH)Yr", "9zG.D", "aoe*0", "a{G6,E", ",\\.AwL?", "uGnx5", "Call to the SHGetPathFromIDListW failed", "de-li", "3wO\\[-", "Mf\"Cal`", "H0+!b", "/,VcUCz", "}rM\\*", "]vTW#", "4x0*)", "+>uyY", "h6EqW}", "{{D],a", ";omh\"", "\"c#Az", "jP)3lZ", "~@cXW", "j.ra}", "`R3js", "?)`[,8", "5BEV[", "FormatMessageW", "C!&\"[", "TG>~.", ">CbFy\"", "yI{[[B.", "^u?]V", "zTcJh", "w{'jE(t", "xBQ9fS", "5z=*('s", "@~fm7F", "Co}vU", "R!v)bk", "Y)Q{ ", "igdRp", "2`&n\\>", "-}z~O4?", "?5K\"S", "[2?>{", "Aah9MsqF", "uS^R%", "K0;)$", "D}\".`", "F-YkgI", "3\"gZ!", "`{w1T", "}bM4|", "Gp5oe", "jyJ23}9", ".t8rY", "l0LxFLd?n", "dVG}I(", "c8U;i", "v]'9R", "kiJpd", "7i+D!", " RoL4", "PP)\\)", "C2%>C", "A'O(a", "<$wG-z.`s", "ktt|]", "N%XT LA", "ig*Vr9S", "B(wsb", ")^ECW", "RH7(g=qb", "lACC[", "S:L]w", "}eBqk", "*]D]xO*", "]i_}V", "|{Nc:", "_cabs", "sSx_B", "GAgnY-", "l]v[%X", "lz[-W", "3N;*ZH\"", "Jf`T?", "<,nR5", "?w@9", "0SrCD", "=Z;HGvO|", "|T&.X", "daP(&$", "*B`)w", "^.L~3", "`DV7C", "7hRQSp", "'ADb2p", "49;D ", "*u-tlNsB", "!m>&[q", "s{dMQ", "r-&md", "Nz*-)", "extract:", "\"cx7_", "bYT[i>", "q\\:]hg", "_t))tSb", "1#QNAN", "Kw]I ", "4R`IQ", "L|Bul", "EkPXY", "$4ShbK", "wR^j>", "6(RG9", "", "O'@&0", "zqL@N_", "*Eheib", "X0qA)x.R", "U^hO5E", "JUs#o", "Jq|NG", ";?l)0", "+x-\\:", "wKvtV^", "zNZNb", "nE|B.F", "Ma5B%w", ",u[\"cs", "w5pj1", "3dIF|", "Ry-[@;", "RND.j", "[qvw,>", "GetCurrentDirectoryW", "0@^#=", "VS_VERSION_INFO", "`u|6d", "|{\"b#d", "vs_community.exe", "aph=9", "($/Hw", " /#4v", "md[!_O", "T]WO!", "(`X'^", "snj3(", "EZ@1.", "%!AH6", "3{)ad", "2Sh;[", ".>+[_T", ")G#`v{", "X}Y}\\", "40+j/", "}K xJ", "ar-sa", "Zf2S|", "qG$zw", "j2`)Xn", ">Y(sac", "JFxb,N", "i?)/f=", "y)\\eR", ".idata$4", "wvOIs", "*Hs8Z", "T(r^]", "5#636", "HJUX ", "~@R .", "O.c?c", "*w2i@", "p2{(7`T3", "jXkx;}", "/ly~Q", "Z>]Kd", ":odig", "lT6;-", "VqQA>", "1Fb`X", "C{OV6", "9HA4bY_", "$'N](", "ROS[a", "wOVmV", "m8VOuH", "mXU6{^", "P0g)f", "T|p<'n", "F-", ">uaDc", "Zw]S@u", "*S4D%JS", "tbmlE;8", "LocalFree", "8nuRmL/z", "Z)%[N", "^4n\"rb", "?4?9?E?J?^?", "x'9d{[:b", "CG9ym", "A[mVy8", "#:hlVH", "rY!h'8", " 22m>", ",Ds9X", "WyLn-", "v#4_E", "=a[SM(", "5g303", "?GyBk", "uxs#i", "RY#!;", "zI%\\6=P%", "A9'DN", "=== Logging started: %S ===", "2MK@1H", "_~OFT", "tT=L[", "~gw%j", "eG!0!", "$z5FA", "-(.!&", ".?AVCInArchiveException@N7z@NArchive@@", "P]NRM", "fw}ww", "G~mH5x*", "7&777?7^7h7", "ZuLum", "7|kufd2I", "6$j;N", "iu71X", "$yT|", "XE{|U", "D3I4q~", "8$Kd6G1", "+L`[-b", "4WjBI0'/", "fwyn%", ";)2O>", "t2D. ", "49xId", "GetTickCount", "656<6e6l6", "T> 7c", "uRk,X", "bQbn$]", "ar-OM", "F'O;M5", "VNY{'P", "K&#,@+", "ux@~rOi", "3wk1%E", "&L,={", "`@9}e", "rijNk", "=t6NtGl", "g;{cr^S~", "X4E%l#D>", ">;v~5", "252_ ", "l1C1>", ":U,lb", "TK{s)a", "BM#'f", "mgSF2D", "*Tc*[N~", "9!y$>@Q", "!6mdz", "-4^Lw%WG`", "[9Z*8\\", "s,g n", "LX`V{", "-+T=O", "I49)]6\\", "|-]})", "yx@Zj", " 6d[4^Hc", "#XBo5Y", "5p{>m\"lf.t\"", "R[iEu", "r}yf4", "N\"vg]", "a_uf8", "2q|Kt", "(l/pn[", "z.: *J", "y6B#I", "-w0-z", "NU2FW", "2e+fe]", "|p_{B", "wb:zX@", "U[-H.", "p!eh;e>", "[([s0", "|xzz:", "+3iv:", "JVu|{d", "MR:06D", "+?|q<", "D(;}_", ">j'\\M\"9l", "9@rFl", "8@-lu", "4#4r<", "wwX;l", "\"!ExX|i", "lR={lgHOQ", "8U t\"", "k0Zoi", "67,66", "&pD^.", "3r^wr", "-#|Gd", "nf<(s", "QQxPr", "vFB$\\7$", "5`#['", ".ubVLq", "`C*cso6fZ", "4DO\\=", "|OqE|", "1Rb'EM", "c(5,\\", "708Z8b8", "kZyc@nC", "w*LnZ", "`P\\ivQ", "DR2g*", "I$DbW", "sN7ii", "cK+R|C", "@/2#k", ";,>>1", ".q%wl~Y", "th-th", "jx&.$", "*z:R]", "P:B[Y", "J:;Yu", "GetEnvironmentStringsW", "aRL`,", ":5=_f", "p:/BV", ")t8{]", "'H/~O>", "s*dz>", "W{8'~%", "VISwl", "7>8]_", "_UbEL", "t\"1~f{%M", "BN7I~", ":8yC%", "~+-z\\", "3$3,343<3D3L3T3\\3d3p3", "z<5?2", "6DS+1", "uZ`aA", "V +V4+", "[q3Bu\\", "t>(%?", ",(POT/M", "9iD<}8%@~", "yVPLx\\.w", "Z]<:[Y4Qk^", "Qhttp://www.microsoft.com/pkiops/certs/Microsoft%20Code%20Signing%20PCA%202024.crt0", "i4~w@", ";A}0=m", "EMdwQ", "{r@R\\n", "4-rp.", "|o^J1", "nB;ufV", "\"U\\5@o-a\"@", "&MBUO", "XQqT!", "/R@||", ";8f~Y", "EqHd0V", "~p.(A", "='s`z", "LS.gl", "@yd@s", "Directory '%S' has been selected for file extraction", "qn 6j6", "Pk.5G", "4Q\\.N", "h,8qKI", "%y.Yyx-", "n:$=9", "nx^'F", " mG\\eD", "=Z >L", "ud`Pwc", "f,|8>", "=%f\"l", " `;{\\", "Sz]]<", "B[jLz", "AdRE6", "Of|kI", ".1T0+", "z|ZskI", "%e']0", "qp\") O", "H^eUJ{", ".(1sm", "\"utoH", "KAqz%", "4T`Thm90g", "aAZ{*", "j=3[0", "WCNW9tk", "Kr^Fx", "l\"S@|", "&'1Nh", "|/gG1", "kN9c5q", ")Uq6K", "! },')", " sv!", " }Z!@", "*Y-e0K", "}VY*o", "iCS~JQ", ":cpNfF", "|KBoj", "?\\,B98U", "r{^!-v", "L8>w_`", "+/}IK=", "6hG{=", "FIaGVi", "L[\"fI", "9(9H9T9t9|9", " CRlkH", "6 6tND'", "Z*+Zo", "7tB=X", "%l@H(", "?='A`", "zP^Ix%", ".RXP[", "P7 {9V", "KZ]p.", "&7e f?0IT", "](>TH", "iMv,na", "k0mf,=", "`+c%,$8", " =Em?", "CK3G~", ">u$fl9", " zC=f-", "LgbSe", "5F#0>t", "8PV%y", "-i5.gHuhJ", "SPARC", "F0^[]", "@RVA%*v", ".:J5JJ,q", "+gG$\"", "wIo6x", "\"VXj8", "An|vy+d'V", "A(m7n", "G77gc", "ECG$h1", "I`J~$", "!^{Vc", "2@j{9A", "E+y?LN^", "\\G2[b-2u", "T'z/[", "3,u>L", "#d|Oq", "L_{S]", "mZN};", "o_W6T", "iSI!n", "6CA(\"", "95`r/J", "{u(.,qu", "8fqj\\", "n!s|/", "`r0Zqo*", ">~@2J", "ytQ_*mz", "rlf;u", ">v>h9", "\\7uT0", "eGJhEJ", "=}j:8)Z=Q=", "6Rk!&^", "+#&TQq", "@tutr", "c/8NSK", "zG+kH", "f@4@opT", "u9'k[", " vTx_L", "8/8:8@8J8O8V8]8b8l8q8|8", "FindFirstFileExW", "z\\CPZ", "$zOH,", "[Xe9'??", "2l>* $8O_C", "5\"z=p!\"\\y", "SVWUj", ":@z&u", "x(:&Fe", "0-]Z9", "+vELZ", ":cb7B", "60ttq", "i e,bL6", "fQFxq", "K_R C", "T&(ju", "Y }}o\")", "r>>]7", ")8M4&", "P>DrA", "Ezzj7", "74HBlW", "Wn1l]$", "H t=B", "8jMSP", "]!av<", "#8Aj<$8", "yBo XJ", "4O/s3", "[.C!U", "S<[hC", "_im)h8?n", "AuMs{}W", "(qZc%S", "7o>W?", ")Q}R!", "rN:<,", "TV\\R=4", "HD>B}", " =:<%", "4%Qb^", "o!S+]", "'j3f-", "[{d_", "v/jC\\a", ".SK)3rB0", "EO", "L+b)NW", "tRdK/", "Ad+1!", "Qi&C\"", "{7,3<+", ",Ni=~Y", "vy>^PM", "+hDN6", "jZz% ", "w7mbD", "\\.sn^<", ")6dBH", "`4+Wa", "9'PR'", "m UPd", "_(s\"S", "7$W:CE", "qrjo1\\R", "\\|r0E", "!0)0`0g0", "~7r\"O", "v)}%-", "~3\"4[y", "Nsd|Vy", "AppPolicyGetThreadInitializationType", "k$D5d|o", "L`&vl", "\"RdTb", "4 4&4;4`4s4", "[:2Q%", "s}(YF", "qy;|a\\/)AA", ".CRT$XCU", "=;>c>", "es-DO", "|1+!mvz", "oN#_b", " y?8S", "j.+|{", "RRRRR", "Mj^uw", "9H^0Y", "y<: 8-", "I0ITN;", "RbNbZHo", "{R`5'", "p/,vb_", "3MCO?", " :~V3/", "PP!8\\3:", "-j\\jP", "en-ZW", "{Vx0P\\", "eHQ7zG", ",6J_;", "\\~0Mf", "On_Ir", "\">%/y", "URhfJ", "@n2XL&", "!QL_Z", "=^i,i", "cqA V", "R'qphcY", "63!.;", "Hgh?f-", "7dz:,H<", "u*y2o/", "p|l.Q", ".2 c+", "F~/y(", "h99!w", "J[{", "#Z/O6\\", "+s9!T", "e*4 rK", "Hg}LX", "bj5xQ", ".t9n&>p", "p[5-e", "rKW^5[L", "`vcall'", "6~%PD", "9GPj7", "nEgWN7", "g.'VJ", "aXWN7", "c_mc3", "PZWs1", "5+YW&}*", "0Ia\"`R", "/OH=P", "9Ut;2}K", "H>whK", "Xo1 +z", "*9L`+", "#@xXN2", "JdioQ", "l|%;d", "C}L^Y", "?Wj1`", ") \\ak", "Failed to allocate formatted current byte for the random string", "PostMessageW", "f{Fq|", "bHi3l", "Zb6^,o=", "Uk3Iq", "tjmo$", "lOGyC@ ", "c^O18", "`Ac&n", "1lp/t", "'3lGD", "T.V$P", "L_9Jf", "7;Q*_VzW", "*/+oll", "]7E1d`O", "~,->2T", "iAGfYP", "Wri{R", ",RX*J*", ",*SLtx", "?$faj6", ".-]ws", "0`N1*?>", "EN'1G", "*7{l:", "J%K$%", "X?kR>p", "J4 7O`", ",+1R^2", "Z>VJ\\", "4V5[5m5", "@6cRg", "=,WBj", "a*8_/", "_.yc%", "B)O_{p", "%_Q|o", "8$S0O", ";X|6*", "NC'm4", "uI)H~Z", "0vfd'", "QQSVWd", "xwj0?$", "A$6Mk", "N|dgr", "User canceled extraction...", "l0,`F", "w3}C/", ">o|7K;", "|kl0#", "0:D6J", "Q{#j", "+u8*xN", "),m|X", "~^in)", "152C2Z2", "l)'V|h", "3Tast", "K>rBL", "FA.uA", "EK^6.aU", "c~=#;", "#[p4R", "#=/VB", " m\\&}", "trT[S", "9C0~&", "8QOZK", "9V0~'", "Sh$14D\"jx", "`vbtable'", "PF[.dn", "CBd(\"", "V:~3*", "b.y-7", "zq(ce", "u0>L3<", "ESh^+|", "RICty", "tT^1o]", "Upu?b", ".tls$", "24'+HawN", "J@cpW", "&v]ZE", "D:H6+7$", "xI5ZB", "_NxUY", "7\"s9l(", "hb,\\ Cq", "Y:3Jm%", "3pw]Z", "T\\Hyp", "i]eP<", "?>},2", "0syBb", "pKVoN", "wD6-#", "LuHJe", "COM/Z", "3%>f.", "2L0dJ", "@s!0j", "VT2+)g", "5zC\"1", "xLP{3", ":PLI9SFH4", "upLrp", "9n)}!", "sz`e~", "VF*~]v", "1y,V2", "4S2x/M", "5Ii++", "8%F&H", "!21|d", "K@yFq", "t2$>r", "zPF!p4:hB){", "?}O6;Pr", "wt2{5", ".(\"@v", " m4s}", "u/&s%i", "\",ZEDY", ">#oXSD", "F!Qir3T", "MFLP2j", ",8qW?", "/qB%v", "2!2+2H2r2", "|46(,", "9JGzA=", "y;+)U=", "_li-u", "k[Lpmk\"[ZH", "R{1-~", "Q.&aVo", ",yWC'E", "TK|\\I", "`ece\"", "[1c,*1", ".KbK8", "cV4y4[", "'oQY:", "y|$C4/", "'k*R}", "2{y\\n4", "s_B@a", "{,D8g", "qp6,>", "1BbQ/", "+CPzL", "4.iK%", "^sbjj", "48Jmv", "0}KQ T", "qO%SD", "!FnwA", "WO}Z(", "xk:m_", "4zgkJ3vE", "clU`<", "Az?|!<", "p2>U7", "g{ho5", ":Lv<0}u", "e", "5P-|/", "YO(4V!", "W-s9'", " r'oP4", "6[SE(", "o33lVDX", "<%0uP", ")7&RP", "U~6tz/;'aQ", ";{Tt1V", "TxB,c", "K|{^k", "KDP~9&q", "8CkZB", "VO3]\"", "V\\N%;T", "5Aqx?", "\"RO(i", "ex49t", "SRNOz", "H/?N>", "T4q:3", "cIP.o_", ".rtc$IZZ", "O(Ze", "W70hC", "8zs^W8", "EgDw+", "A6q\\-R", "j1T_h", " %v=)l`EI", "m_71/", "@Y2lp", "w\\|&m", ".m<|AT", "g,HBD'", ":8:X:x:", ";1.po", "OT^S/", "@3>Vq", "*z>Zx", "y=tkuy", "#D$0#T$", "3KiPj", "xnflJ", "`nDk&", "MY3$h", "]up>-{\"", "N4JZr", "mSjf96f", "8_$Z+", "(Dg/,", "aPM4(", "w$Ln*", "9{}-q", "i8pMG", "JB=,D", "c/48SSG", "D(#A(*", "2m%rB", "&\" \"W", "426H'", "x\\ML{", ",/^'#", "_+!+6", "@UEf=", "ilj8t;", ":$;-;u;", "=sA)OJ", "_Tb)=", "rZoC2", "4c{zg", "0]MAJ1", "`[y9s*a", "O(x((", "d.hXg!P4", "hW_Jb", "Q[|VA", "sq-AL", ")p[Ke", "YLFj`", "4}%^|", "]7m", "InitializeCriticalSection", "r3hj+F", "ID*;!zk|G", "_20nA", "T\")vvz", "s$Td[", "zpkR5V", "tI(C4Q", ")MS01", "4T{,}", "8CwR#", "]H?S!iH", "`typeof'", "GetLocalTime", "^]dG5@", "eovp&", "h6B^nV", "+b;W#", "7=n1#", "GKEcJ", " DR{{4\\", "L7/6b", "tV qoV", ",HR*(", "s*6ys", "Z~|DA", "I~|=PXx", "*W{%h", "F?^f1~`H", "37>#[", "*WE/O", "$Xh/f", "?$\"HQ", "+!c:##", "lD?G2(", "u99O-(", "`[I=.", "q8\"]k4", "o0%$!X", "2Gv+|", "}h2Wz", "Os(#P", "kmC=2", "5[I`R", "IM^t#?", "7NgK|?", "wd&cl", "HmRG{", "5ITq&k", "6*Q:%", "qqkHm", "!cO+e", " D,e&'", "6}>Dp", "w*_Sv", "vat~e", "fr-FR", "~\"X`$~/", " L1\"U", "J;4r3", "$#A8pq", "]dibP", "vn=9f ", "cn8PF", "4@oHL", "+1 eB", "!=dyG", "p/Jj>", "G2Wb{", "$6L_ ", "*J')z]oc[", "2,1%jn", "h)ll!:\"", "LJ0CK", "!,^b6", "'0sdT", "n$#HCuAQ", "iX@$1", "QlZVE", "'YLol,", "'bqK|", " >VLpP", "~_BAnOs", "r[\"h{b", "NRE&b", ".~Nl ", "I*nt$", "l}dV0", "\\6XRn", "}Vo\"K", "Failed to allocate box path", "F*>3b", "6*9nz", "8I5&A.6/", "#D Q.0", "UH+'<", "1cL>`4", "bCbq5", "x2?DK", "[v,2w\"", "PSgZApYk>", "xINa2vEM", "6}?V'T", "GS7Eu", "G@K;,", "ra8HN", "k)WCjQ,", "{p'o&", "iZzC&", "ctSuQ", "oqc.j", "ce6VwG", "X0tUy$", "2>z$`", "9s1Dj", "#MVQI", "tzs9B", "6!=gQ/", "(U=g-", "fb/Vh", ")zsp(", "#}6AM", "/c=7v", "$*y@@", "3o4C#=", "F0#d0", "xqqh?", ",ZLtg", "?5qfW", "\\8\\G", "gRAYU>", "c+dMG", "SzLk^", "J~t)=C", "5aB=W$_", "MY2& ", "' .+N", "(38![", "OgfIy", "`scalar deleting destructor'", "Ii\"-m", "cJeM1", "#(e2I", "ZR\"!zw]P+", "YRtK~", "Failed to allocate memory to hold container handles.", "n[O@\\ln", "u47}J", "Mz~*#", "rW$BAz=g", "`iA93-w", "(H+,4@", "h\"42l", "$.\\O;]", "\\t4YzU)\\", "a_VG5", "e^U0E", "0KF|", "?(r7G)", "IX7##N", "up|f{X", ";kn:/", "]x (5", "eg>jC", ";|m%u", "*+~@O", "ml-in", "w.5)IFp{", "~wp6`", "+bTh2k", "RH`>c7A", "<\"Rf0", "B4KP)%", "Z1r0g", "=u4:z_", "B]8+}", "2 2?2f2", "3x3j{", "(lnkp%", "TjV{eRBk", "VPh[=", ",Le`S", "SBwkV1z", "NG9^I", "&$PKc", "-`7(.", "$_Aiz", "u,5-P", "E`00j,", "3WH/#", "@7wqLA(", "_fO'v@", ".CRT$XPXA", "[mY%=", "ExLF/", "LoadLibraryExA", ">:?V?", "{z}=*", "h%sv=", ",INz2", "VJW6~7\"IBp", "", "R0kw%", "yPj(5w", "\\R(eU", "YO~=/", "Failed to set program args", "@m1@?", "mUW-!", "3A-3}`", "`{T&e", ")wQQp", "-0Sd3'", "%Io2*", "P1u\\", "R~#6@R", "nC$dF", "T#`#I", "Q+2g\"", "4v;k]9", "1\"sBwF", "9mt5^>Oin", "noCleanUp", "1+w,~", "4h1q'", ",EMa5", "K\\;%3[a", "wPnsF", "K.VEd", "8t[bc", "OR}m", "eZ\\TF6", "VTA5c", "zxmlu ", "5e8c.", "^.,KO", "S@yT?cD", "T:?iGh", "V!8@Z}C", "+jr\\b", "hX?K4`", "=G2HJ", "4#qN^", "aw#$[", "7$U4 Q", "-4|\\A", "en-TT", "#p`=Y", "Wy'2X", "U^T<+", "R*`r=\\", "g:FgR", "}SJn,", "kMWxd", ",vWV.l]", "(sG;M", "&&I8l", "=Y]FH", "ur-pk", "V4\"3p", "aN)l3", "=u9feh ", "S`tEyq", "W/\\k{,", "B3E#c", " !1}`", "K;$v:", "`^j\".", "r8z<>", "kVlQW", "4HVw]", "Yz*h!", "5s@8?U", " new[]", "qcRfT|", "wYFOU", "hz+_t", "UB#Dt", "*n0?J", ";;i `", ",@8Yh", "!.K7?]", "xl@z@l", "4v'4>", "[qoyS", "Y}^CMtX$L", "+,WiY", "u.zl+c", "FI$9", "2#3P3g3~3", "Vl^:?", "c8EKN", "eE*-;", "54KvJX`", "h(0:u", "H'PpQ", "O^2OP", "R\\d.g", "4z(#U:t7", "lKERNEL32.DLL", "kk^5&wlI", "|B4EN", "BCryptFinishHash", "DY0x{", "a&5gi", ";/gmbe", "?_d1.4", "m~Xnoa", "TXTjP", "CQZdV", ".text$mn", "KWhC5", "|Ab.Li", "because it was unable to create it in the folder. Please make", "|1}JO", "VCzrv", ")@cC*UV", "cFJ :~", "SP;+2", "*69pU", "]'FVx", "Ub RJ", "6R6V6a6m6", "2N'bPtAbfm", "# x(YX", "kPZiB", "pMxh*vy", "k<}ctcj", "UJBQ)&", "-AG|A3m", "7=7g#Vto", "*t`=+", "{%)&g|", "?.i8S", "h/K.@", "zW>!M", "\"3,-o;L", "h!qbK", "[&NT=", "\\-az!", "toiu\"", "W6}fm", "l:>)-", "+bGw)p/C", "4h^4p", "j$EkF", "r5\"[F", "L7?a9", "*f,reh", "P4ai0", "})pC&[e", "UVT'V", "WE|'q", "`9>L}I", "nl-NL", "[0lk.", "M", ":Z6~K", "#^{Gr", "gulK#", "=~/an", "Okmg3O", ".3I$l", "D$$wtva<", "| 8&T\"", "j[QH4", "$m,Opa", "G>~91", "Hnv=H", "')~>$", "R%EdDzW", "mj 0 ", "HV,{k", "k>z^\\", "}*BWh", "x1k0!", "h9E|+", "XTnmI", "N0LX[", "*/X/U", "*KG=&s", "es-cl", "r]t15:", "0yDy\"", "J)-r~", "=2&u*4", "XAd;) ", "++Irt", "r_si9", "*>S;'", ")+^U`", "CNb,u", "jkDE4", "1Vy^@", "|8h6I|", "Qs4>o", "&sC%GJ", "9<6i9s", "> \\y<", "ZCI I", "X3MCm", "|PUxS", "lBq`][I", "f4LjK", "\\NX~-", "FT\"?b", "ZL1el", "A:Gx'", "maC*n", "T~! O_", "`g(HY", "vr~.[6", "hqe_YV", "es-PR", "N(\\,Y", "u*xz<)M", "L=^o_", "%C1'V`", "=%=.=9=@=`=f=l=r=x=~=", "Y> #%:", "Failed to concatenate the formatted byte to the random string", "BQaVjY", "]6\"fF", "tb4k:", "\"J@){^", "6-)@P%", "A9k}_", "x.x)3", "q=|BW", "3U,;1r^SS", "nxZ=%", "zoBXe", "`1?un", "&dAjj", "9gvAk", "N%vF-", "0}bPh", "n%m;0*", "4eoo6]", "D<`ms", " --env ", "9Pt-I", "XMI$o", "V=IMC", "q%\\T2", "{_Poy", "gLd1M", "qMdy)", "!$(Dy", "+1zm)>", "\"B <1=", "1O2a2t2", "gQ0>A", "VQ!uT", "+Ssx(", "^F7\\?", "'69#z", ":yPRL", "|Yb]]", "9x'>b:", "a]6wi", "@CaQX", "X=@YCq", "q?9J+", "81/#{", "e>|Y=", "tcy,n", "?u

", "-XJH,", "VirtualProtect", "_Mx'l", "5RAaZ", "YS!ZJ", "1 5_.", "\"1+xH", "`5jp+T", "FeTHl", "]~+a?s", "!RUE'", "xj`9>wG", "gK(#V%", "4&*cW),", "u8 sR", "ru~`cU", "rnwQu.", "(l^uR", "jdvfy", "NXf0]1", "zZShpn", "+Ut3&", "6yv(rr", "v3<$w", "9MSST", "u}HrH", "[o\">J", "tdBv?", "sKqVD", "q1\\Ree", "?|]1S ", ";|L*|w", ".z5mm", "M,@%>", "'w(EK", "uSF}i", "+JXY+", "5OIX\"", "j@0>/", "cK`%k", "s4l{Bx", "J9}\"(-", "vVsCg", "", "Jy!{u", "Y(qX-", "-m,}+", "5}+u!", "%#g;n", ":j#xK-", "yv0zO", "L8i4oo'", "pIy(bbs", ",l'2qQ5", "$?oRh", "~-!onuU", "t:Y&es;", "ka-ge", "yg99w", "oS[/U", "KW#YZh", "Vw_cJi", "iD+_,/", "TMz=$", "5VS'%", "$V7Fg/", "|bg^!x", "Q&|/Ob[e", "KNtg11", "VAp+Y`", "%IU9r\"8+", "3Rg=!", "dnYuqZz", "ud_^[", "tXkFk", "k*,b{", "Xl<%rJ", "V7$n ", "DdQ)%", "*(9G%+", "Ph%1}y", "Sd\\E_", "-WIwB", "5g~ag", "N\\H8vL", "abi!S", ",W.CyV", "@z5y7", "orO=z", "?`}xt", "#AY s}", "k>j9P", "c7Amz", "f0h\")", "gC,gH", "Wi)M=", "+IIX g}=E", "?6?C?s?", "PgH1K%1", "2G^\"k", "J?o>dA", "*xKSFb", "`omni callsig'", "i=iT<", "P*\\_fCo", "%FJdW", "\"M", "mscoree.dll", "F*nL9", "$GeUp", "Y-%O j-", "SiV!\"", "=qpXO", "^$Qfa+,", "q2HPG", "GjX:8", ".w0cl", "y/X4A", "&!r2\"", ",G*", "X2}3\\", "#6<40<", "j3`B_D", "5%|K6", "Yo+@9", "ktQcE", "|[Q\"!", "LoadLibraryExW", "cge.I", "L(.wV]", "%* 50x", "$+I\"K", "EE&if", "@y8_de", "I{ojRA", "P2k2'", "D{Y%@", "I:Gb4tv", "Sj8-'", "6|g'f", "{5wQ_[", "KdONZ", "e9lA\"", "sY\"id", " )8=)x", "aAy,U", "pldZI{", "ns-za", "0Qh'[", "nl-be", "6lMPBe{%p", "B$n;D", "}on0]7", "*pui:", "#\\+7jd", "\"/qo0", "4:eqm", "", "ej{60 p", "tn-za", "0c6Dkz", "tUpgC", "]S{af", "-N&G_pW", "aa;-u", "TuOaU`", "wivXI~_H$", "i-2!5", "}'R9D", "a2yU(PlE*x", ";Sv~eT", "pt-PT", "38q9 K", "~P6D.", "Gs}&y", "es-py", ":y|u2", "%')\"!;L", "T9(-^", ";~.kB0;$kbB", "\\WHhM", "8P\"VE`", "VNTex", "{$=R,", "wlV}ak", "PAkSm", "?&>rH\\", "[FnC,", "e&E@J", "@7)' \\", "|`r6w", "Hlx[K", "H{1#f", "LjB|o", "6+Ku,C", "Xmc}N", "c?i&o", "6y\"P4", ":Bc e", "9_QWqL ", "YP~?`", "=\\T^\".Ud", "1JSec", "V%mKi|", "'\\;M,b)", "SDHF2)^F", "b!QjW8<", "menx\\Dr", "m-Uq+", "DHY>Z", "Sf)>4", "Q3zoz", "Z``(J", "9{D~P", "u+=H ", "QRZ6Q", "x/rS\\", ")WjET", "PWT$e", "N9Y=5", ">>!}Qh", ".*(Yo", "4;9#TEy`", "yV]d_", "]6NE@", " WcqEI", "ahfN/", "70787@7L7l7x7", "kRRes", "2,282X2d2", "o&l@h", ")~}Io}4;/. ", "Z0qE|", "/d&0kUN", "v8|/*", ")'EVWm}V%:", "Q#HI?", "nT1`<", "26h;,~", "Failed to get the directory control", "RPCRT4.dll", "7_ 1e", "d=yoc4", "2B^IB", "%0|p=|S9*", "\\+I.5", "W:\"v&", "4{$~L", "]~#3J5t", "{tQ:x#ra", "t(N>@Z\"aK", "W3A5]", "d,zD6", "o!E@y", "{kc|S", "icg?:", "e2f0?)", "%(_T|", "0!r50f", "LgF8d", "en-ie", "y)8n|jr", "?o>X7", "V[^ 4", "W\"N?|", "@e5e$", "f/6kmC", "=Cqr}", "~n$[", ",V{J|.", "8Gk ^", "Hrc%i?", "E}xMP<", "ncN~)", "5Rh\"gD)U", "IJ-\\:x\\t", ",5hEZ", "#n@7~", " 7*'~", " DS2>", " w>2L5", "Jk Q~", "9n&py", "1M)7v", " jZFY)", "k_5UT", "T(vJg", "*])\\+", ">Mi#+", "C&{D4", "ek.Wr", "p\\nG<", "Z#&o]", "{}#z5", "vgU`fM", "$NuvY9", "ndTu5", "SendMessageW", "sjh2!", "iq4ib:", "M8m]A", "]lMye", "viBnU", "7;8uuW\"", "x!-n%", "~z\\s*", "F.Bjt", "-@w-sA", "}[MPv*", "i,bV;K", ".bk;T", "};sL5", "q\"46]t", "m3So`", "n Z7R", "RL~vHT2D", "To=0q ", "e8xVVaoun", "h/z+`;", "!OoUT", "5|S(PG`stEH", "LCMapStringW", "kP}%y", "D9zHb", "/B:2XX", "}]V ,", "!0h|qW2", "8cUh*D", ";n>W{2L", "KD|8AZ~", "Pgn4f]Z>", "p}kwv", "lZTjF", "z@N8A", "9Ansv", "1t,b9Q", "1N:noy", "oV!~K", "9{IVQ/eLh", "iSTGSF", ";Lk^6", ".$Cb", "yP5_+", "VC)Bc", "1ldK,", "o)V4m", "BVCnz", "6&[K|", "P!1N9g", "&XNn* e", "U`~{'", "VD6+/", "N^'7E^O}T", "2+&H;", "w>ZC4gF", "9_CJ{LwZO", "bYoh`", "=\"}h(", "y-_q4", "vd_2!", " NC}rtCD", "Aoo$sh", "h.A$xks(", "fo>Am3", "`,J9)y", "Lh[Yl", "BEA6|vIR", "CompanyName", "e~^%Z", "Bmm}Q", "\\i[\"%", "()]\"K", "7>1:;K}", "|X 7[", "jFGCeP", "`{4LdT", "xR%~Jv", "3:m.]", "zh(T\\*}!", "r]c=s", "JWmda", "1", "D'cxo|1", "is7tI-/:", "42#'W~n{", "(.D3s", "g}moK", "2l[X~", "#?/_M1", "ikU;.(64", "&!X+`", "=~eSi'", "Gmb,M", "K/B^v", "9d^bx`", "Ea\\B&", "kMykg4", "v!Am<", "pnmw8", "?np?;is", ";0ZQ/Z", "f{y%G", "%p=;/,", ":j}2G/", "%z?xy", "~YQuY", "|bE(n;Y", "4u td,d", "9W`'r", "lC|i]", "&;%YO", "KH@o,", "e[\"CQjf", "98mJc^AA", "k|i>q", "?=G^<", "Os48?>", "rq>=)O", "5p^8[i", "!%*y\"", "Dn-EFu", "KMI)!", "t'T ;", "9`Y9bR=", "f~e]I", "3.2*+", "~b_r>", "&.c0^\\", "l4XP(v", "0W5u$x", ":5\\Ln", "SZC0W", "G7KkE/", "<,(;}7", "_pRdg%", "U!7#[xOjo", "V2C!M", "Oj~a+", "rFFkAq]}", "9wWKE2", "*lJ$1", "V>#!pgb", "x{>4E", "&&!-\\>", "8U]_f", "*2Hr:", "#oc]Xw", "K=i;9", "Q2*~k1", "b+zul", "t',4K", "Lu/)&", "[N*dw~5", "W/\"ea", "jI5>7R", "+]\\f", "-:q{6", ",TT2<", "4ChS:is", "2E$\\E", "GOH8i1g", " Y{@@", "cC<#~AI", "^>\\c\"", "yA({@`So", "(S$L@", "Df64n", "WU;Wi", "|$cJ8", "Thursday", "l>S", "-k[41wgU#", "zkB[p", "x,,y3Q", "\\?", "q%]Hb", ",txmJw", "6+nh7:", "@~#!C", "'K6?l?", "*0JV~_", "9_-U2{", "RT5Yq", "I8?8L", "]03Hl", "Pb\\u5", "=J'qa", "M$5US]", "^LDML", "^Vk9}", "*`3.z6a", "s=-:6", "R< fa", "L;K!x", "df\"{6!6", "a]gno", ")LZ+3", ")uGfv", "YNIh", "+_(9]", "-Dvpk", "mNT?J", "` :o*", "68|tO&!w", "J4Ked#_*5h+", "5_G/:", "-yb`e", "ES9%;", "fn?ed?", ";\"a6", "5hC+%", "w3wii", "[-$\\!", ";kl5F+g", "tybO5", "se-NO", "JOT |q{", "G$4NA", "nd(_l", "Od6[~", "uZZ6&", "CQ\"[M", "[+cobT", "E}HM3", "@T[UA", "O'R(t", "+WG[N", "X\\l=\\;", "'Dp|k[+", "#3brMt\"|", "^\"6!\"iD", "MQY%%*", "cgTXKrb", "]e)$S", "Failed to ensure path is backslash terminated.", "#&rTJ", "*LLT.", " `!.{^", "BIZC{", ">H8?U[", "pD\"eh", "RtlUnwind", "Q<0q'", "R<45&", "+;S_OG", "{9Q|0a1", "ru@@r", "v+}#H", "kA;T\"", ".c^@~", "PiQ^mps&", "2D*qr", "/!;(k", "|(eX4", "'63$!", " \\^>Z", "<$Ek,", "/i>T7O", "Fz&Z,", "QqXaG", "8u`~vD", "bk g\\", "\\i7eb", "2>qf{I", "S6+&0", "aUM]3", "}\\QD2", "?%FEd", "8ne'6`", "{&J}*", "r>_A ", "Y8CK$", "bt%\\l", "b8|.3", "Z8eBj8O", "20260611075249Z", "b--WGh", "_t&~L", "SygN{", "U", "S226u", "(@,#[", "5G5dUU`X)", "YC]u!", "Cg!2bH0", "W[\\'Z", "sf6aqO", "l,ep>", "4vN47", ")!<}T", "Sh|6lv\\", "q1`R,", "n[oF^M", "*f#Ka", "", "iLH:w", "SZa2GT", "JqtMo", "G*6yK", "{cT7eC", "6(6H6P6X6d6", "4=NOFU", "hwf|o", "yZdBB", "JwVWZ", "-#,us", "#hT:83", "2b5A&'m4g", "or.C/", "&7hEL", "n;ZY1", "e{mUUH,", "ybg7Q", "uuJis`h9", "&`]}Z", "%+)0p", "OE.\"D", "|^:P!", ".,oR+", "mi-NZ", "AD5Y5u(", "C]l`cA", "VU;eK", "|_[i>", "hec*6", "ymbA^", "-EFp|", "Dy7D/", "beqAe", "#G\\vu", "=W>m ", "9T^wDm!", "/,Cq(Va", ":1C|rj/ ", "$WFWDD", "aKj~o", "&2icV", "JmnB#", "'`'O|", "Y\\Axu*", "TlsSetValue", "Error 0x%x: %s", "WNc!n", "g3}E:", "cADdG", "5h5@l", "T^*r8", "^DFn_", "K,cmG", "7CBM^", "R[!*;&", "oO]Gq", "7v,/w", "!ykyg", "Ei(Q:", "ktY%.", "]`.;:0", "dj:*u", "A7gUj", "Mk\\Y2P", "z+;|D{", "U(qS:", "+WJ99", "BGLcS", "ft#1(", "09za:", ":.qbY", "Windows10.0-KB", "\\V:QO", "'+~:4", ">eLJ,@", "f8rmEd", "Z4Q|B", "_@Q3d", "J0*kB", "y\"UvO", "<%=Q=k=q=", "3r2]H", "v2!L.2", "-|~WP", "en-ca", "e,ktnYuH", "\"ha07", ";[0~k", "Y2EkS", "Lz4Xi", "uEf1q", "RiXsk", "^", "C)Rl.", "lj:+-", "2I.(o", "_glC6", "QEk|,gKG", ":%:3:P:X:", "&E8[k", "/KK~k", "_@PZL", "Dni&$", "Ggf7#", "J`dRG", ")^DvX", "#-rN{", "\\znS))", "^*~K9", "e$!RD", "G`yIW", ":\\P+W", "_KMq$", "es-CL", "c2w$;", "\"c@w1F", "OKag_", ">mY^8", "pa-IN", "-yp/8", "OL'Y5", "EbQ}<", "6\">rlI", "M6/RSH", "a'f;Me", "H`dGF$R", "%!Fn4l", "$Y&lW", "3a8^?\"", "EPe'N", "'cSaw", "){\\WM", "d`j/u", "cD?tj", "tK~?F", ">!>5>>>C>N>S>^>", "70Stizh", "w4Rrdi", "XCX:Ivb", "Gy+$R", "9#WIhH", ">EV`n", ">uISf!", "&jW=e", "VXQx~[$m", "}jBUnD", "-^]]C", "Pf\\", "o&5<6u", "5Y4kI", "SC-eCy", "Q>&a1", ";T,k2'", "l't^G", "/)}fYf", "+^a=E", "S/5(9", "", "ez$4$", "Ikmijw:", "kQ#R;", ":!72X", "YT`DB", "ca&/-", "\"]1m?V.", "_\\@.&.", "y@zuaQ5", "?]\"wX4", "Hh?2`", "^^,]?R", "`4#7i", "E|XeT`", "a0_0]", "u9/w#", "4.m.F", "mD=eN", "=KPC|", "T7K#c{", "I[XyDr)", "`J{PwR", "7{W{'", "&rEoo", "VfcB9", "DeleteCriticalSection", "*I[!)8", "vbcFc", "e3t mnT", "F/`xiu", "}J\"\"x", "E9>ar", "D]D&at?", ")5JLoy", "/`]U`\"", "=S{pKkP", "ar-TN", "cB-L6", ",c'?VDH", "#L4ct>Z", "h\" W?oN", "2E$N<'L", "ISBjf}", "I8HZ{", "^x

P^", "K/h^2vh", "c=`;?", "AiOxv", "'1mx\\mW", "/ vWf", "rz[CAC", "&z}]$", "mGz<'3=", ";R:Fw", "}0E!E", ":m9Td", "M^1$_Og", "2lq#[,", ">M}5Bj1", "~}Zb`/", "pp.NJ", "*fO/Ux", "/c;bN\"", "N>Q`\"}3", "`UBO;QS", "es??E", "CI}Q2", "\\b)u^", "`GuX,", "*N:+h", "kd[z<3)", "+ x", "fr-BE", "N]48hv", "n1PQFW", "Zt8%(V", "a@khO\\R(", "OmuHB", "fj:d.", "iB7vL", "tFkURa", "P1:DR", "k#Zm;", "lie='", "u0i6~n", "X6)Zk", " {FVAz", "__pascal", "b: _T", "DfT25", "R{3-'", "n({.I", "}.a8e", "?WqqD", "xms3iLB;l", "t5SmUh", "2p@rTA", "O:GU7QK", ".msFN", "_zj8.=", "{u_dZ>", "xw*+0>", "w6Sx$", "j0Z9~4t", "KRBnb", "ycv\"N", " Class Hierarchy Descriptor'", "Ia2>Gh))", "RfKa?", "~ +~4+", "SgWo*", "}?UljW6eY", "R. A\\^G", "j2M>/", "W{`'K", "4RA`k", "HgP\"uK", "oWP/x", "R*c+?", "A kQ9", "7,747<7D7L7T7\\7d7l7t7|7", "{j6wh:L", "i>ELv&", "Ny\"vp", "fg9M[J\\", ")]I+v", "SY]vWRdl", "1BlYd", "'AUd$fdk31", "qg&_`", "(f'&%", "CbaJU", "m1-Sx", "ST@K:", "/yU&+z", "Ub-=0", "^!5pp ", "zUt>($n", "(c PM", "t`nmc", "ZlS<(", "L1XL0", "eyqTB+Q", "*'>-D", "<.IZ;", "V'q09", "JzR}9", "U-0Mi", "^^+s[l", "_+W/d", "SW-V\"", "LSZwt", "@,W\"S", "]FVBF", "QK)uB?", "`)c?u", " ;yD0", "\\#+v7", "NSoj`", "4xve93", "hG]OQ,", "Jj9sE", "shell32.dll", "Hkz,r", "f>q/c", ".7oq\\", "{)1~9o;", "$5*|>-*", "~:T\"8", "uRZ3&", "vq+Lq.", "hPDM7", "Zism{H", "SEBK#5r", "+B$&4", "T6<)", "+~S{ 0A@", "GLv:j", "j%i35", "&#%Wx", "!!u):", "zu-ZA", "8jPVAh", "if 6M", "/;3F0", "~.#HZ", "X& D/i", "t.N)4_.0", ">http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0", "mk-MK", "Xl-$(S", "_yvSg", "\\?;e5", "s*3I'", "@af)s", "fhr$X", "TbUy$", "NE4`E.", "!N+D[", "Microsoft Time-Stamp PCA 2010", " fDk#9@", "E[oF4DE", "+`yhL4", "%fo=lpo6", "3+FIwq", "0EQ]6;xp,", "8]9W=", "^/p-T%q", "~'=}x", "rl(B&L", "b]K^pc", " M4|:", "^i2]M", "]H{U]v+", "P=k2Szr", "dAPO_=", "+;$+G", "AB6hb", "wln4zU", "tP@ocI", "6&7[7", "Fv^~p", "}^Y:S", "CFTz*", "-WgGMl", "!O}37", "2>RENd", "W_DYh", "6gG:l", "jh^Z!", "#`'Lu", "Ds'>y?C", "s-X[Q", "Zg>|D", "y:ieV", ")E'L!", "O-l+?", "hW{7f", "3dN1US", "75XAl", "1k#^!", "#cDeD", "&(]T=", "%!@'xT~B", "lkGYJ", "hm-B0", "PQSVW", "3>i?ht", "x],$g", "September", ">!?+?a?", "G:u`|", "ywy_M", "Hy['g", "\"e;Ex", "[5^g69", "yR0Ub", "\".=\\<", "QB=@N", "7B?Zq", "$%tx4", "-\"Br5tUY", "`W~VJ6", "hYu|j2", "UU9uQ", "-Y5:N", "|bT7\"", "_K5{-(o", "nD9:h", "fJ!`m", "K,QzW", "<=lx/", "HGAqe", "l^6M{", ":]|", ".CRT$XPA", "/PsGb", "W\"JxH", "GetCommandLineA", "uvOIC(9", "mn-MN", "E;TM ", "gzH1!", "2q\\*{", "I g(r%Tk", "?+0He", "xj F.", "lj=JO9", "nQ=Mm", "Failed to get text from the directory control", "ojD/t.", "ZR~{@", "bT-v&", "Failed to set target directory", "(Jzn~", "b=CL@n", "Fcp ~,", "ZX1O#", "pu+hQL<", "Sqfu}&p", "\"YsHD\"", ".L`nQ", "--- logging level: %s ---", "QTPLw9", "ZI-Yt[bG", "USY17b#CSA) ", ";Z0LGe", "w(#Cn", "fpAfRg", "THh/.", "D{b(|", "kT`LMF", "zQ<_U\"7", "E]\"mv", "ht`R", "2#W^S", "9R.a!", "72;lN", " c^7r", "]$E-6", "OJ@(L", "'AT]2Z", "*>JN ", "LZU$_Y", "-~J57", "Yi,+7", "{+]5P", "JJ:-L]", "2\\Id-", "xby^'", "LegalCopyright", "1&Nq[", "UX1i7O", "fb-^j", "ziSG'", "~; t\"O", "\\S$\\t", "ma$^w", "$Jncq", "F|k:T", "ZOc'v", "VRcA2", "JPzk1", "FPRU-(", "m]j;I", "_ebfop", "p);\"h", "lr]]j", "vW^-[6DB", "0c1y1", " I>[pd.", "aj%iq:", "gRN\\z", "t%_$0", "G7hJ91", "|NPk6", "\\x:u;", "4T?~Y", "v&W<`", "sA>vd", " ^\\>W|", "a{J8e", "3dM?*", "5B@hd)O24", "25m:a", "l:]}S", "#B>{#", "8C uY", ",>Lze", "|`*vg", "!Y1deBB,}peTtN", "afEGf", "UG#`A", "|I~IeTMP", "6'IKrU", "18nQ/2", "mirYe", "/q)(a", ",18", "aDlII", "Mer2k", "X& ,&", "c1~Md", "%16Mu", "070d0", "_o#CX", "^m|ng", "(\"nO[", "|dKn_", "RO#]c", "%\"J#e", "4%4/4A4M4]4h4x4", "d(&Sz", "js*Tq", "op\"ax", "M&Bo0", "r+l`C", "M|XKC", "EgQp!", "`dCJA", "\\CX,i", "b@VjdP", "o'ep,", "\\UDn6", "?\\xgg", "r3zF~", "N]=ub", "aL.;E", ":.fhj)", "0.0M0x0", "rf!I'", "T/NMh", "Z]V*:", "Nel[8", "Bf2Y%", "\\\\1w2", "^P`/ \\0Y?G", "J#Y)sz", "](nHT", "uAmHBj", "Xrywt", "zdMw.", "ce]&M", "\"yNd,", "J_8Z>", "`fS!(a2P", "j5Ee[", "U>,VD", "api-ms-win-core-xstate-l2-1-0", "x za%W&?", "=IqP1l", "YP`Aw", "f%Pa*ha", "PcY$p", "LRWT^", "Bmcyk", "m#eY~", "~L~D\"", "}9-tX", "^RZTe[", "ao]_R", "H0V{'a", "L+$+w", "zX&K", "H4UO`%]", "elrNsi", "|fw\"P", "6nqK^", "3{iX8DN", "h0ngy", "a-yc~", "C*gM*", "15[Yl", "CommandLineToArgvW", "RWrOW", "f@XuE", "..Jb#", "l^jar", "Rb4Pmg ", "YL*mX", "?%l#+mc", "yP0|?)bDSzfK", "ZlCOt", "yxWS(", "fi.7E", "?Qg@.`", "8fqER", "|$jpfP", "2*._+", "&Hzi\\8", "CJ^=4`K", "FYip2,", "xJ|dj+", "&@|el9.", "3a%wT", " fW\\pf", "SL:[O_", "P$yWs", ",>jM ", "I_djA", ">s|#&n", "ed0a]Q", "0=tR[hSB", "q 8!\"+", "~&5!O", "xo", ",^\\T#'", "S!`r\\3", "7:LItk6?;", "af@[)", "m?>W+7r", "uNrGH", "x8B*hv", "R)p\"e`", "XG+ny", "5 5$5(5,5054585<5@5D5H5L5P5T5X5\\5`5d5h5l5p5t5x5|5", "+6~&S", "c>kd,", "300930183225Z0|1", "}}9wA", "6dl#[", "Iy]_K", "V/kvQ", "2|[;pP", ".Visual Studio Installe", ")q!Nx", "(:tz6", "V)Tq:", "gG+Hy", "[mOF6", "D%b.%", "n6Wyw", "3NI,5", "]4cI.O", "zkD ?4xm3El", "xc$v|", "eZQ|6", "]ozsl", "IDATz!", "mce7[243#", "/P;ga+I", "S]];'8", "kMFlX", "L9tUK?y", "az-az-cyrl", "W1N0e", "mP[w63,-", "Asjg\\I$", "eZSVu", "~c'Ph)a", "4hRj@L", "*u!xj", "[!zfT", "b>0^s", "'C(muQ", "x,M=7", "2,s.\"", ",;{sn", "|m\"1T", "FZ]j@", "3{|m{", "NCQZA", "^k&l(o!Q", "(,:ky", "<}LL#", "6vp/F", "(A\\vc", "R27_M", "4.R_O", "%_GyI", "?*6]4 ", ":fAM;", "&iU@l", "\\\\Q!R", "<4q5M", "3#CA.", "cbL~}", "R/cTS", "SetDefaultDllDirectories", "SD410[", ")*kt=Ik", "eJ!'\"$8", "D|; q", "OUudzH", "6kfqI", "]F>s!", "=6QW!", "fuY?F^", "J(TEQ", "aoGMS\\X", "_hypot", "}>KUK", "!pZVz(", "WOcD.\\", "(1w*<", "ELlB/[", "U|@ l", ".{<':", "M:ru_", "D!ML/", ">~X@:\\7", "ftnsk", "bK\"Bl", "An error was encountered.", "hr-hr", "yT0U0", "KERNEL32.dll", "W.ggs", "2wBt;.\\", "'3_}&", "w\\Z?j", "/V*)y", "GU}>@", "Wz}Ib", "4+WLd", "IwD[-$", "%^$dW.", "k)0#.a", "+7+&w", "`local vftable constructor closure'", "c$0>d", "a$h.:", "IIq @", "0x07M1", "3l/!*j", "Tz4_(", "rpZ51&~", "0u_yc", "g7~.Z", ",5Geoh", "Xat>^", "^Lx}7wy", "xp %\\", "H`/5^;", ")kT&p", "Failed to get the extracted package name", "?.}_[", "$XAT;!", "JE]d?", "L| y0", "x`l~l+", "0i[:n", "in]3Ui", "=97mJ", ".00cfg", "33Ig4|", "%Q>rO", "h-Oi\"", "/XCB;", ":QnTZx", "G9(u@", "fnjnx4", "+^q\\q", "7$.yi", " !TdN", "3Axd/", "oFa#&", "zZ+H5:", "gRb!w", "&UZu ", "!9+}v", "LkUPN!", "YR{I<,T", "Vwp\"", "0[o*/", "`2MDn", "~oOmm", "0q(3Q|", "!T/IK", ":r3ct", "hW 7L", ",V*+L", "uw-7`", "8s}{r1", "R\\A/}", "I2>.C", "__unaligned", "VnK5Q", "I_&_?;", "9p u\"", "X]j4}", "aaEEW", "VaJBiN+", "&j;rkOM", "?'???O?g?", "dm6F,", "4Ap@a", "rHf;u", "2ws@kp", "Xs'A`", "[OutWm", "*5lkj", "LZyKv", "\\2R2I=#7f!8g", "]0Jh$", "8e(Te", "LSq{~g_", "_i~\"W", "{7s|pQ", "7P<(u", "8Jsc?", "+owu~", "mV#:p", "aTO^sl", "^I(Nu/", "[|}QJC,", "[J`Cl", "{cg-jQ", "--R9|M{", "::SIy", "9R #?Fz", "4Rgx'", "8jClr", "~`", "p`;b>", "3&%H/", "r~8hH", "7%=DB-Y", "<#;\\\"", "V.jx_f;", "w7f9", "@btWs", "|M]?T<-", "Nb,`8C", "BXQr!p", ";98*Z", "4p\\7\\", "o8Dbg", "vk^sE=", "z9||G1", "4|at=", "(lXt?", ".RJE}", "?)>B*", "7!7&7Z7d7i7", "#E\\sX", "ar'iU", "1\"&>G", "ls'29R+", "#|!Md", "Mx,3/ok", "!/b`?:", "\\YJ<1", "\\)PGm", "_F}5nt^", "ar-JO", ">+'LE", "-sI@R", "-^S0 ", "78K#s", "[S: \\", "+D9hO", "5spqqi6", "vfNJA", "km\"UK", "3#e5$", "$\"'5P", "/:\\hq", "@3WoP]", " wp`d", "h UQ_", "Ww7wbL", "6 S3[", "k~% T}", "GsY||", "\"0hlR", "/\\_5(", "U7o4T9t", "A[0lgg", "$.d\"J", "n.;f'Ex", ">)~wN=J", ".v>gD^", "p3R#S", "IkZw-", "S$[H+", "8DBcU", "3rQSKF+3u", "Li>}~i+", "x]xV", "w}z%\\", "$g#-2", "5Pt!3547", "[l>hH\\", "~t@`y", "$inYU1", "+Pke`", "D4JO`", "ResetEvent", "LaZg|", ",K/e(", "\\z,4r", "n7Bn|#", "kuAUJ", "cI$qCQ", "p9o:)", "#CJ", "bcrypt.dll", "|hFo+", "|4k $", "VfWr,", "IT`r_", "Y^#3 ", "|7r7R", "!v(+mQ", "4[b3RE", "g[[\"(", "`q3 PL", "RLly(", "E*)KAe", "oL[3z", "73wAm$", "+ V^bsKN", "/g.X|", "opD[g", "ldexp", "h=GRe", "MRX8<", "^#x^r", "47wXY", "\\Ozdw", "$a?DR", "/D'4)f", "b!W,J", "w|;D/r?", "ou@O}", "'&$B?}", "[b5f:\"d(", "\\", "R>:W@", "`Y74[", "bI(/g", "T[|M,Q", "%&[eP@m7", "MSy0+|", "IdR'C", "@*5G2/r", "Q[`CGH", "hbXBL", "K_N>C", "c&4NR", "%s`gc", "34j1Q", "xNkM/", "KlW9![]6", "4)o1\\", ".79Ox", "3-{or/", "v*QqR", ",J<[z", "?OS'Gb", "mt-MT", "Az{/?H", "m2AV0", "1+mz3", "h+6wI", "XI\\7_", "$tfvwC", ",_,G7", "ob(f.", "+)Gm ", "xC.4ujO", "4Up}8uP", "xoXD~", ".3iv7", "43R|4y", "E+9w'U", "KO|gC", "%E=Q}+", "w/$i0", "_f!C3@R", "xlz%+", "W^KX}", "gyNJ'P?", "4_4S5", ">X.B5", "~Yw-}R", "GwQs&", "FO'#j", "}|YS&", "a[81G", "$aO:LP:", "1yE@wJ", "v=:e)", "HT{cr-", "5v%2w2d", "xMTr=", "Q4$!i", " et}N", "qbNX^", "*|@3q(", "Failed to open box from path: %S", "U'jEVEE", "pB=11", "m~iQV", ";VZW&", ".L4 d", "JCj{6", "eniOO.", "sV4/.T", "S6%,[", "/H;-;", "boYmH", "&dv}*", "sxL?!", "v=efpG", "3[~ f", "pd[;Nx5", "Pw`~D", "W=C\\G", "T5u>7", "$3~L<", "vj^G8", "pFX+K", "AMke3", "g-Mx#", "3^)8'", "F2D;^", "Pz=dp", "r_NUu", "]Th^lq", "Yz4[Ig", "pt-br", "|0$D5", "\"<+Ya", "0IGsm", "{B\\Y8@", "'{C@F", ";cjPw", "{8/7c", "aAemH", "pEK`=", "L{j3D", "xY=U&", "+MVBy", "Failed to set out directory", "]$&33", "auI&H", "P$+%n", "H q;v", "=$b<1", "YJjNt~`/.I", "[mL;<", "U+E!(_", "p8;0@", "-uy:|>", ");>M+", "W\\H1%uZ", "[j%&*", "S4I15", "M=>(\\r", "/L?)av", "8W\"f\"", "+]X`r,B7", "SVWj@", "}BB~G", "^f,C$D", "_SFX_CAB_EXE_ORIGINALWORKINGDIR", "=02,(*", "lzl}H", "di[LY*_", "X;2sk}", "ZIVk|", "'nGPtK", "\"lH", "}NtO$", "{duMO", "Ud05#", "{:i}l", "%&uwuE", "ar-EG", "c^C{*_T.", "XFLN^3q%", "?oT!P;3", "%6Z`K", "~Oo=&dq", "nIDAT", "%#|=~", "k8}Gy", "p@IJu", "Qnu9To:", "@}8Jv", "^8ydr", "n~K-JnJ", "{(xqG", "V\"39;", "=jkMI~", "iDp$*9A<", "8Rz<`O", "X8ipi", "Ln]Wi", "(d|O:", "\"I,7O", "f#Xv~", "Vhd.@", "ZOGsr", "gaw4M", "v6?nQ", "Awx.$", "[;47,", "WKCq9", "%[MKD|g", "/2Uga", "+b[G)", "H{)iZJ", "M_%&Y'", "fa-IR", "$!@.7", "cG[1o", "K_:ys", "w4\"DFS", "jIre3", "|YY=n=", "]O6n(", "/z.91", "cQdvj", "FI)3U\"Ee", "yh=$4", "&3nYx", "iJ{;&", "Vw)'IEaEd", "qY|Yhq", ">$>,>8>\\>d>l>t>|>", "GdZ", "4KJw|", "+\\ODd", "V*vOg", "PPPPPPPP", "4roOT", "[|y%_", "al}Xf|", "~C9O?U", ",lMCW", "e]h{C", "210930182225Z", "aAKi.", "giw4s", "Pk5QrZo", "a[+", "2*Md%s", "x'3m]/u\"", "G\">Hh", "#v5<'", "b.i`h", "Ir<4#", "#9)S^N", "SAzNyx", "\\\"?Es", "{D![6W", "a)k(2YJ", ":p#3W", "o0!|WO", ",", "qx-9V2", "`]~^f", "v*p@$(", ".-}OZ", "'O :Z", "JrQKme", "0ivA@", "E/ZYC", "c\"mC9", "ExitThread", "E ;FP", "Qb:gyz", "_oS\\ ", "=AKY.", " [oc7", "prHJO", "az-AZ-Latn", "*ix0P", "hft\"S", "Ny'fj", "}1Bqpp1", "s:.Og", "[W*>n", "S:;-^x", "VJ9l)X!k", ")PF ~;9Z", "K)I:4", "]$#%By", "W49~qF", "Z\"S; ", "czJES", "xmqtw7", "?:IVr@Q", " =8\\\"^", "8z:}?", "dL!Z>", "nyn0j", "m?7m]", "e[", "+H!`]#", "\\B.?G", "e;g.|8", "Mf|^\"", "0^#Lv!", "aqME9", "lZahp", "\"\"S/2", "3&von4#", "YqYRt4&", "B-sFx1", "4}H%<$$", "db$^w", "R(\\sQ", "%r)%3`", "^-CF*,B", "RdLx(", ".o=Aq", "$XB{$", "T=A->", "!}dWn", "U+|Rblk3", "r8f;u", "'Lo!6", "r@^9K", "TNkvK", "Launched extracted application exiting with result code: 0x%x", "w@XG\\", "qjlxr|b", "}p!)rW", "a)7I:", "-Mkse~i", "_-3XlK", "+VYS~", ">5>[>", "}V!U1", "z'h4[", "dhoqX^Ga", "GpV.<[", "X5>xg", "jrT@e", "uC=^Y.", "/;8_J,", ";i<|s", "^l\\)ZN", "{_b>_", "MmiHc", "Ne#2`", "mW`cr", "36LQp3", "n7:QS*", "UpPx$", "2hK'j", "7L40e", ", ip4", "l@\"ku", "Am\\Da", "0k7?=B", ".vCVS.0]", "VAbJH", "P>\\`2", "3s*'w", "7o01;", "vOZDM", "r%`e.", "G&|m#", "kdVM*", "^rzXt", "#B/~O", "Q-z2", "ld\\J]", "NgSlyM$", "=n@Fg", "g^KLTf#", "=`UH^#H,", "A7O=-", "99L!v", "(_Zak", "{A|rI", "C=+t#", "a0g*Kh9&", "`w'eS", "rvb`}_", "cRp|OM", "PFl3{", "g@hsi", "g1KU*C", "Fl3zG", "EKBdz1(", "Wx[G$", "21LR2m^", "TR/LiWD", "bF-Qpf=", "^BVHO", "c&~*V", ")`z:t", "rcu;T", "?SNfF", "D0^>uu", "2\\>lH ", "atan2", "'M9D>'", "d!C1\"", "879N9", "ppn3;eL", "N`lrM1A", "=(=H=T=t=|=", ":1_'6", "@B#ni", "v@z\\r", "7pcC|D", ":UwhM", "y1L\"v", "mr-in", "yQd9E", "6%CJ{_", "@bW]m", "L5=6f3", ";o&i_'", "krA,]", "j?1Hs", "", "ifVyk", "% >ua}", "5r}'fH", "Lky/5", "0C:>o", "!G^zM-", "GetTempPathW", "1N9|1", "Visual Studio 2022", "T&^J!", "1(0&0", "\"`b+7", "/.Qv^T", "hG^pW!", "3mw$+", "Un0G=)X", "Z;Dv{", "hXA8{", "sVtX@k", "OeLp*i@Q", ">Uuh)($.", "#$\"$z", "_<;}f)<", "ko-kr", "rP(0jM", "K*hbT", "~uGB5", "4$9im/9", "Ks8H-;F", "JIW_M", "|2=^,U", "2nQHm}", "uzStXV", "'lKlM@", "(9\"nH", "*tKi~", "|xuXq", "F$)=_", "x 7\"p", "5i]j[=", "/P}x8?K?", "4N>\\70", "?_=Ard", "f1Bx2@", "mE&ni", "Gjrx3", "Wit-^", "?gK,-", "($^Vc", "9#9mm", "6P#,X", "-k.!|", "!-lZq", "]FsC<~E", "u^GyDa", "z[4P%", "pbJJm", "EW9c>", "4xhG#", "-QSg^", "D2Gw7C", "Z=#S*", "s!=_E", "V\\ ^`", "_TDmi", "ye;!5v", "buqli", "TaKag", "}PNSH", "F}Y 3b", "w'\"&Q", "a$Szl", "#$j}__L3", "n],9a", "oa!==", "GG;ZP~", "~o0ZNj", "F6ml\"b", "dg|R`", "fy#P`", "?0~+5", "V!5!=", "$|M|/", "`t>||", "XjL|Q", "92~s)6", "t/", ";x&j9M", " +hg^", "X=--9x", "k!C03", "BZ[Rxa", "sN)W#", "t.JUm", "Sghv)D", "'s8-|", ".M8l1", "aH?dc", "I\"^tx", "h_R3:", "@PZnQi", "39vS'm", "%Ty1T43j", ">jvwO", "`$QWZ", "h/(iTd", "MZ(Jtc", "z)X[:", "?%Vv,Ui&", "VFVfig\\", "Zl}*:", "\\*=wc5", "0@GCt", "(fSz{", "{t}'xv", "7^bP9", "@{]Ry", "&`^L)", "*JSCPB", "v1 4o:,j", "ZZlwenHp ", "yuQ5g", "7B7|7B:^:", "?Tvf.", "ZRl<(y", "x8,,7", "+uI0qd", "w4i52(", "vI7iGK", "hGbK>", "{xgNq", "hu=^?", "xDT!XNM", "Ru!\"lM", "O43BA", "_ZUuS", "US,C{", ";.^o3", "SuJlu", "_|z\\F", "floor", "t~He/r", "C<\\2O", "y8e+Cn", "G4Qm^", "yL[1 ", "Kt'%wkO", "3yc5!H,", "*svD%z", "1f-u#", "hD1frW", "HsM)Z", "/4S1C", "r]T0=@dM+", "f!cZ{%", "}c4:N", "8z)~U", "$gUo&", "#rAHfQ", "0+c>^>", "^q_0G{O", "mhoXZ4", ";gtJL", "hlgop!J", "lv>jO", "b}%0\"V", "H)r#K#", "Xt>]sm", "z7LjV", ".)R*i7A:e", "z_1c_J>", "{gftN", "u=2X.", ")@`'[Bv", "M#1o^", "Failed to get progress bar control.", "z?gD ", "n{oS)", "\\n(kMXW~X", "UpXr]", "J97C@", "tEN,2", ";YAM#", "D6#*4|", ";Hn|Ap", "`}FR3A", "QpuB`", "!Gr[*N6|8", "W-5L&", "~ Y_\"", "*p7yAG", "eXR M", "#;o*FPHxV", "hC:gB8", "peAi[", "@tm5[n", "[q0X\\", ",_JwZE", "%i{iNt", "Aa%[F", ".M\\uF\"", "b7)( n", "XK'/$", "\\l\"5OW", "CzU2]k", "eCh|91", "PL?PyG.", "dlKOL", "3(nN6v", "P&E`z", "e-}?j ", "VyZC;", "|59v(", "}59\"k", "(k\\xdbs\\x96\\x88\\xae\\xde" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000294" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000298" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000029c" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSCTF.dll" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000029c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x768e0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000d3000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a7000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a3000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a3000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a3000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a3000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80#\\xdf\\x04\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80#\\xdf\\x04\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80#\\xdf\\x04\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80#\\xdf\\x04\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80#\\xdf\\x04\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80#\\xdf\\x04" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x768e0000" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\msctf" }, { "name": "BaseAddress", "value": "0x768e0000" }, { "name": "InitRoutine", "value": "0x7692dfc0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x760cd000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x760cd000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x760cd000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x760cd000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000298" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\2\\Windows\\ThemeSection" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000298" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083b0000" }, { "name": "SectionOffset", "value": "0x0944ea84" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Windows\\Theme4054054479" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\2\\Windows\\Theme738112361" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09450000" }, { "name": "SectionOffset", "value": "0x0944f110" }, { "name": "ViewSize", "value": "0x000e2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-06-28 21:56:14,668", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083b0000" }, { "name": "SectionOffset", "value": "0x0944f110" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f32430" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f74000" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f306b0" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f6c1e0" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f65220" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f5f4e0" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" }, { "name": "MutexName", "value": "Local\\SM0:3412:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e24000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x741c0000" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x741c0000" }, { "name": "FunctionName", "value": "RegisterClassNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74213530" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000268" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000268" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32" }, { "name": "BaseAddress", "value": "0x75d20000" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74370000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74370000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x741c0000" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x741c0000" }, { "name": "FunctionName", "value": "RegisterClassNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74213530" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 2, "id": 293 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09a21000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09a22000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09a24000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b4" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083c0000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e27000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x741c0000" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "ModuleHandle", "value": "0x741c0000" }, { "name": "FunctionName", "value": "RegisterClassNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74213530" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-06-28 21:56:14,683", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000042" }, { "name": "uiParam", "value": "0x0000000c" } ], "repeated": 5, "id": 305 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 311 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\vs_Community_1_.exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\vs_Community_1_.exe" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x760cd000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x760cd000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x0000001e" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002bc" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\kernel.appcore.dll" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74cf0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74cfc000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74cf9000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74cf9000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74cf9000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74cf9000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x74cf0000" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x12b4fa01", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x74cf0000" }, { "name": "InitRoutine", "value": "0x74cf47e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x759a8000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x759a8000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75442000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75442000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e28000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x759a8000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x759a8000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x760cd000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x760cd000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49245" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "ChangeWindowMessageFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "message", "value": "49246" }, { "name": "dwFlag", "value": "1" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 1, "id": 347 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e2c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtOpenMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "MutexName", "value": "Local\\MSCTF.Asm.MutexDefault2" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 351 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "Milliseconds", "value": "2000" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\CTF.AsmListCache.FMPDefault2" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002c8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083d0000" }, { "name": "SectionOffset", "value": "0x0944e5a4" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 1, "id": 357 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 358 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\vs_Community_1_.exe" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\vs_Community_1_.exe" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 1, "id": 360 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "8192" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtOpenMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "MutexName", "value": "CicLoadWinStaWinSta0" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtOpenMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "MutexName", "value": "Local\\MSCTF.CtfMonitorInstMutexDefault2" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-06-28 21:56:14,699", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 366 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c0" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c0" }, { "name": "ValueName", "value": "LaunchUserOOBE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a7000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a7000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002c4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 375 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002c8" }, { "name": "ValueName", "value": "LaunchUserOOBE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f32430" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f74000" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f306b0" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f6c1e0" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f65220" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f5f4e0" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "MutexName", "value": "Local\\SM0:3412:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 388 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 1, "id": 391 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754dd000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x754dd000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "Local\\2ImmersiveFocusTrackingActiveEvent" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083d0000" }, { "name": "RegionSize", "value": "0x00080000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x083d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e2d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "textinputframework.dll" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\textinputframework.dll" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-06-28 21:56:14,715", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d4" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\textinputframework.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d4" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\TextInputFramework.dll" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73cc0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000b9000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73d6e000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73d6c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73d6c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73d6c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e2e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CoreUIComponents.dll" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CoreMessaging.dll" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\CoreUIComponents.dll" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d4" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CoreUIComponents.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d4" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\CoreUIComponents.dll" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73a40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0027e000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73c5a000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73bad000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73bad000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73bad000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "ntmarta.dll" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CoreMessaging.dll" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "wintypes.dll" } ], "repeated": 2, "id": 427 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d4" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d4" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\CoreMessaging.dll" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x739a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0009b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73a24000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73a06000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73a06000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73a06000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d4" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ntmarta.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d4" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\ntmarta.dll" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73970000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00029000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73995000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73993000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73993000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73993000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\CoreMessaging.dll" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-06-28 21:56:14,730", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002d4" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002d4" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\WinTypes.dll" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73890000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x000db000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73952000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73950000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73950000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73950000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" } ], "repeated": 1, "id": 467 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73d6c000" }, { "name": "ModuleName", "value": "textinputframework.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73a06000" }, { "name": "ModuleName", "value": "CoreMessaging.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73993000" }, { "name": "ModuleName", "value": "ntmarta.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73950000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73bad000" }, { "name": "ModuleName", "value": "CoreUIComponents.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc4\\xecD\t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\xe9\\xe2\\x04\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x73970000" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreMessaging" }, { "name": "DllBase", "value": "0x739a0000" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x73890000" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreUIComponents" }, { "name": "DllBase", "value": "0x73a40000" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\textinputframework" }, { "name": "DllBase", "value": "0x73cc0000" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\ntmarta" }, { "name": "BaseAddress", "value": "0x73970000" }, { "name": "InitRoutine", "value": "0x73977e90" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreMessaging" }, { "name": "BaseAddress", "value": "0x739a0000" }, { "name": "InitRoutine", "value": "0x73a00f00" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WinTypes" }, { "name": "BaseAddress", "value": "0x73890000" }, { "name": "InitRoutine", "value": "0x73908590" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ab3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ab4000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06ab6000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000030c" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000030c" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08450000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x08450000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\CoreUIComponents" }, { "name": "BaseAddress", "value": "0x73a40000" }, { "name": "InitRoutine", "value": "0x73a9e960" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextInputFramework" }, { "name": "BaseAddress", "value": "0x73cc0000" }, { "name": "InitRoutine", "value": "0x73d00690" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a7000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x769a7000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 494 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000318" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\CTF\\" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000318" }, { "name": "ValueName", "value": "EnableAnchorContext" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\CTF\\EnableAnchorContext" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-06-28 21:56:14,746", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "GetKeyboardLayout", "status": true, "return": "0x04090409", "arguments": [ { "name": "KeyboardLayout", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "USER32" }, { "name": "ModuleHandle", "value": "0x75d20000" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\SystemResources\\USER32.dll.mun" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 1, "id": 500 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e32000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-06-28 21:56:14,761", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-06-28 21:56:14,777", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-06-28 21:56:14,777", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-06-28 21:56:14,777", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000068" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-06-28 21:56:14,777", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000006c" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-06-28 21:56:14,777", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "GetSystemMetrics", "status": false, "return": "0x00000000", "arguments": [ { "name": "SystemMetricIndex", "value": "4096" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-06-28 21:56:14,777", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00000026" }, { "name": "uiParam", "value": "0x00000004" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-06-28 21:56:14,777", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000103e" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-06-28 21:56:14,777", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x00001042" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "SystemParametersInfoW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Action", "value": "0x0000001b" }, { "name": "uiParam", "value": "0x00000000" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74370000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74370000" }, { "name": "ModuleName", "value": "COMCTL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f32430" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f74000" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f306b0" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f6c1e0" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f65220" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x76f00000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76f5f4e0" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "MutexName", "value": "Local\\SM0:3412:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 529 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 1, "id": 532 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" }, { "name": "MutexName", "value": "Local\\SM0:3412:64:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000324" }, { "name": "DesiredAccess", "value": "0x00000006" }, { "name": "ObjectAttributes", "value": "windows_shell_global_counters" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000324" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x098e0000" }, { "name": "SectionOffset", "value": "0x0944f1b4" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 538 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002d8" }, { "name": "ValueName", "value": "TurnOffSPIAnimations" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "L\\xeeD\t\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\x93\\x84x\\xc2/\\x8a\\x97\tv\\xbf\\xb4\\x82\\xea\\x03\\x00\\x00@K_t\\xac\\xdfgt4\\xb9\\xf8\\x06\\x18\\xebat\\xf0\\xeeD\t\\x00\\x00\\x00\\x00`\\xeeD\t\\x00\\x00\\x00\\x00\\x1c@\\xe5\\\\xe4\\xe9D\tT\\xefD\t" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002d8" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3262678163-160926255-2192883574-1002" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002d8" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "ValueName", "value": "TurnOffSPIAnimations" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09a26000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e33000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 551 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "KeyInformation", "value": "x\\x7f,\\xffc9}\\x07\\xffdd\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00\\x00\\x006\\x00\\x00\\x00\\xff84\\x03\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e35000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "0" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "1" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "2" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "3" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "4" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "5" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "6" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "7" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "8" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "9" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "10" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "11" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "12" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "13" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "14" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "15" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "15" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "16" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "16" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "17" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "17" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "18" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "18" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "19" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "19" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "20" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "20" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "21" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "21" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "22" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "22" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "23" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "23" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "24" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "24" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "25" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "25" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "26" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "26" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "27" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "27" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "28" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "28" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "29" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "29" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "30" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "30" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "31" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "31" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "32" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "32" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "33" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "33" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "34" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "34" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "35" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "35" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "36" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "36" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "37" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "37" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "38" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "38" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "39" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "39" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "40" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "40" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "41" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "41" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "42" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "42" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "43" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "43" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "44" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "44" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "45" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "45" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "46" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "46" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "47" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "47" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "48" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "48" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "49" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "49" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "50" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "50" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "51" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "51" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "52" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "52" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "53" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "53" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "54" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "54" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "55" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "55" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "56" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "56" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "57" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "57" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "58" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "58" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "59" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "59" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "60" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "60" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "61" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "61" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "62" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "62" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "63" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "63" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "64" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "64" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "65" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "65" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "66" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "66" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateValueKey", "status": false, "return": "0xffffffff8000001a", "pretty_return": "NO_MORE_ENTRIES", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "Index", "value": "67" }, { "name": "KeyValueInformationClass", "value": "1" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e38000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 693 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "ValueName", "value": "Disable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002dc" }, { "name": "ValueName", "value": "DataFilePath" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\Fonts\\staticcache.dat" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-06-28 21:56:14,793", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Fonts\\staticcache.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002dc" }, { "name": "HandleName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" }, { "name": "Buffer", "value": "\\x1a\\x83W\\xa5\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00$\\x01\\x00\\x00$)\\x00\\x00\\x00\\x00\\x02\\x00\\xbe\\x02\\x00\\x00<\\x00\\x00\\x00$!\\x00\\x00L)\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00" }, { "name": "Length", "value": "60" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000328" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002dc" }, { "name": "FileName", "value": "C:\\Windows\\Fonts\\StaticCache.dat" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000328" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x09d30000" }, { "name": "SectionOffset", "value": "0x0944da30" }, { "name": "ViewSize", "value": "0x01260000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e3e000" }, { "name": "RegionSize", "value": "0x00015000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e53000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "TextShaping.dll" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\TextShaping.dll" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\TextShaping.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000330" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000032c" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\TextShaping.dll" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000330" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x737f0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00094000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73881000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73881000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77029000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73881000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73881000" }, { "name": "ModuleName", "value": "TextShaping.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-06-28 21:56:14,808", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\TextShaping" }, { "name": "DllBase", "value": "0x737f0000" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\TextShaping" }, { "name": "BaseAddress", "value": "0x737f0000" }, { "name": "InitRoutine", "value": "0x7387f2b0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74f43000" }, { "name": "ModuleName", "value": "gdi32full.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74f43000" }, { "name": "ModuleName", "value": "gdi32full.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e40000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e3b000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 724 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane2" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "SimSun-ExtB" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2" } ], "repeated": 1, "id": 727 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane5" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane7" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane10" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane11" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane12" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane13" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane14" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane15" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "ValueName", "value": "Plane16" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 743 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x00000109", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x000000fc" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "KeyInformation", "value": "\\xffb4\\xfff3\\xff9a~\\xffe3\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x18\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "4" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "Index", "value": "0" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "Index", "value": "1" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "Index", "value": "2" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtEnumerateKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000032c" }, { "name": "Index", "value": "3" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000101", "pretty_value": "KEY_QUERY_VALUE|KEY_WOW64_64KEY" }, { "name": "ObjectAttributesHandle", "value": "0x0000032c" }, { "name": "ObjectAttributesName", "value": "MS Shell Dlg 2" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg 2" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e3b000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "3636", "caller": "0x00c8db0c", "parentcaller": "0x00c8a0cb", "category": "system", "api": "GetLocalTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 753 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "3636", "caller": "0x00c8dd75", "parentcaller": "0x00c8daeb", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000238" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\dd_vs_Community_1__decompression_log.txt" }, { "name": "Buffer", "value": "[6/28/2026, 14:56:14] " }, { "name": "Length", "value": "22" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "3636", "caller": "0x00c8dd75", "parentcaller": "0x00c8db59", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000238" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\dd_vs_Community_1__decompression_log.txt" }, { "name": "Buffer", "value": "Extracting files to: C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\" }, { "name": "Length", "value": "85" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-06-28 21:56:14,824", "thread_id": "3636", "caller": "0x00c8dda2", "parentcaller": "0x00c8db59", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000238" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\dd_vs_Community_1__decompression_log.txt" }, { "name": "Buffer", "value": "\r\n" }, { "name": "Length", "value": "2" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-06-28 21:56:14,840", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-06-28 21:56:14,840", "thread_id": "3636", "caller": "0x00c913ee", "parentcaller": "0x00c90036", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 758 }, { "timestamp": "2026-06-28 21:56:14,840", "thread_id": "3636", "caller": "0x00c8d617", "parentcaller": "0x00c901c2", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-06-28 21:56:14,840", "thread_id": "3636", "caller": "0x00c8f374", "parentcaller": "0x00c8d667", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xa4\\x90\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 2, "id": 760 }, { "timestamp": "2026-06-28 21:56:14,840", "thread_id": "3636", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "7z\\xbc\\xaf'\\x1c\\x00\\x03\\xc3\\xef\\xefuk_=\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbf\\xdc\\xb4 " }, { "name": "Length", "value": "32" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-06-28 21:56:14,840", "thread_id": "3636", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x110\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "/\\xf0C\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "\\x17\\x06\\xe0.Z=\\x01\t\\x85=\\x00\\x07\\x0b\\x01\\x00\\x01#\\x03\\x01\\x01\\x05]\\x000\\x00\\x00\\x0c\\xa4\\x97\n\\x01M\\xa9\\xcfj\\x00\\x00" }, { "name": "Length", "value": "37" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e40000" }, { "name": "RegionSize", "value": "0x0001a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x098f0000" }, { "name": "RegionSize", "value": "0x0010b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x098f0000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x099fa000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xf2\\xeaC\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "\\x00\\x00\\x813\\x07\\xaem\\xc9t/\\xcfE\\xf7\\x1f\\x99\\xe4\\xea\\x1d\\xd4\\xc9\\xd3\\xeeO\\x01M\\x90X\\x05aqR'\\xeb\\x1b\\xb9N}\\xe1\\xa1\\xdb\\xed\\xb5\rS\\xe5Q\\xe4\\x1a\\xe0N\\xdb\\x19p\\xb0\\xdf\\x0f\\xdc\rs\\xd4\\xc3F\\x14\\xd6\\xacqfO4\\xe8\\xc9\\xc7Z2l\\x07\\x96[\\xfb\\x0c\\xb7>P]\\xaa\\x85\\x1df\\x87\\xffmah\\xaaRQ:\\x93\\x8b\\x14H\\xd3\\x10\\xffW\\x94W\\x03\\x18\\&\\x9c0O\\x19\\xb0Up_6\\xe5\\x87\\x15dPC\\x91\\xbc\\x93\\xf4F\\x97\\xe1\\x83\\xf2\\x8aT>\t\\x8f3\\xe0>\\xcd\\x1f\\xbar\\x96m#\\xd3\\xf9\\x92.\\x14\\x96\\x94\\xb2]\\xc7\\xdf\\x07\\x07\\xaa|]r\\x9d\\x9c\\xc1V\\x0f\t\n\\x14^\\x8e\\x84\\x95\\xf8Iz\\xf6\\xf6\\x18-8@\\xf3m\\xa6\\xb5n\\x9eM\\xc5\\x10p\\x08GJ\\x8b2\\xa4\\x95\\x83\\x1a\\xac\\xcb\\xfeW\\xda\\xd1=\\xe2\\x8a*\\x8d\\xddX\\xa3\\xf7\\xd5'_{k\\xe0',6\\xd8\\x9a\\x05\\xfe`bX\\x1e\\xcf\\xa4\\xc3\\xde\\x99\\xd0\\xc6\\xb5\\xc5\\xdbkT5%\\xe0\\xd8\\xcb" }, { "name": "Length", "value": "1341" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5d5", "parentcaller": "0x00c904fc", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e47000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5d5", "parentcaller": "0x00c904fc", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e40000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5d5", "parentcaller": "0x00c904fc", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x098f0000" }, { "name": "RegionSize", "value": "0x0010b000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00ca7d88", "parentcaller": "0x00cb3b50", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e40000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00ca7d32", "parentcaller": "0x00ca7863", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e47000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0af90000" }, { "name": "RegionSize", "value": "0x01002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bf91000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x098f0000" }, { "name": "RegionSize", "value": "0x00110000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x098f0000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x099ff000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bfa0000" }, { "name": "RegionSize", "value": "0x0100d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0bfa0000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cfac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cfb0000" }, { "name": "RegionSize", "value": "0x0010b000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0cfb0000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d0ba000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04e5b000" }, { "name": "RegionSize", "value": "0x00061000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d0c0000" }, { "name": "RegionSize", "value": "0x0100f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0d0c0000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e0ce000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e0d0000" }, { "name": "RegionSize", "value": "0x00102000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e1d1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00cb430b", "parentcaller": "0x00c9c998", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000035c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x00cb4160" }, { "name": "Parameter", "value": "0x04e14da8" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "4660" }, { "name": "ProcessId", "value": "3412" }, { "name": "Module", "value": "vs_Community_1_.exe" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00cb430b", "parentcaller": "0x00c9c998", "category": "threading", "api": "CreateThread", "status": true, "return": "0x0000035c", "arguments": [ { "name": "StartRoutine", "value": "0x00cb4160" }, { "name": "ModuleName", "value": "vs_Community_1_.exe" }, { "name": "Parameter", "value": "0x04e14da8" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "4660" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00cb430b", "parentcaller": "0x00c9c998", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000036c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x00cb4160" }, { "name": "Parameter", "value": "0x04e150e8" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "4948" }, { "name": "ProcessId", "value": "3412" }, { "name": "Module", "value": "vs_Community_1_.exe" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00cb430b", "parentcaller": "0x00c9c998", "category": "threading", "api": "CreateThread", "status": true, "return": "0x0000036c", "arguments": [ { "name": "StartRoutine", "value": "0x00cb4160" }, { "name": "ModuleName", "value": "vs_Community_1_.exe" }, { "name": "Parameter", "value": "0x04e150e8" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "4948" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00cb430b", "parentcaller": "0x00c9c998", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000037c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x00cb4160" }, { "name": "Parameter", "value": "0x04e150c8" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "2108" }, { "name": "ProcessId", "value": "3412" }, { "name": "Module", "value": "vs_Community_1_.exe" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00cb430b", "parentcaller": "0x00c9c998", "category": "threading", "api": "CreateThread", "status": true, "return": "0x0000037c", "arguments": [ { "name": "StartRoutine", "value": "0x00cb4160" }, { "name": "ModuleName", "value": "vs_Community_1_.exe" }, { "name": "Parameter", "value": "0x04e150c8" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "2108" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e5a0000" }, { "name": "RegionSize", "value": "0x0010d000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e5a0000" }, { "name": "RegionSize", "value": "0x0000b000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e6ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04ebc000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e6b0000" }, { "name": "RegionSize", "value": "0x0010f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e6b0000" }, { "name": "RegionSize", "value": "0x0000d000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0e7be000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d5b5", "parentcaller": "0x00c9049c", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04ecd000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "~:B\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x02\\x03\\x13j\\xcdw\\x0bIL\\x00\\x10\\x93\\x8d-\\xc7\\xccQ\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x008Cl\\xf4\\x00\\x00\\x00\\x00\\xc9}\\x86\\x1e\\x0f\\x9f\\xaefm\\xc9\\x18t\\x0b\\xc7\\xf5\\xf7L=\\xee\\x9c~\\xa24E\\xbd\\xa4\\xfd\\x96a\\xc4J\tN\\x99\\xfc\\x06\\x8e\\xe7r\\x8c\\x14\\x88\\xbe\\xbc\\xfd\\x15\\xe1\\x82B\\x96\\xe0'G\\xe4\\x92C\\xecE\\x9a\\xea\\x9a\\x9b\\x00\\xe9[L\\xb6\\xfc\\x14\\x0b\\x04l\\xde\\xa1\\xc7\\xee\\xceLg!\\xd7\t\\x17l\\xc4\\xf9\\x93=N\\xcc\\xfe\\xd3\\xc0\\x03F~\n\\xa0@5\\xfd\\x0c\\xef\\xc0)\\xed8,\\xab\\xe4\\x18(\\xd6\\xd1]\\xf9?\\xecl\\xdf\\xdd\\x07\\xb8\\x8b\\x17\\xd7\\xdcHh\\xbd\\xe6\n\\x10\\xc9\\x05H\\x01\\x00\rb#s\\xe2\\x81\\xe6\\x96\\xa9P\\x11?\\x85(\\xfd" }, { "name": "Length", "value": "5151" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "3636", "caller": "0x00c9d85e", "parentcaller": "0x00c943a9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "4660", "caller": "0x76f66416", "parentcaller": "0x76f66321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 810 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "4660", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "4660", "caller": "0x00ca9b2b", "parentcaller": "0x00ca9bf4", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "BaseAddress", "value": "0x74cf0000" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "4660", "caller": "0x00ca9b2b", "parentcaller": "0x00ca9bf4", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x74cf0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "4660", "caller": "0x00ca9c04", "parentcaller": "0x00ca9c91", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x74cf0000" }, { "name": "FunctionName", "value": "AppPolicyGetThreadInitializationType" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x74cf3a60" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-06-28 21:56:14,855", "thread_id": "4660", "caller": "0x00c9c902", "parentcaller": "0x00cb41b8", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-06-28 21:56:14,871", "thread_id": "4660", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\xedfC\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-06-28 21:56:14,871", "thread_id": "4660", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "\\x00\\x00\\x01\\xd5t\\x19\\xba\\xcf>\\xaey\\xe5\\xb7t\\x04k\\x9a\\xae\\x07\\xe8\\x02\"\\x0e\\xb2'\\x9d\\xc6\\xcbC\\xff\\x92\\xcc\\x93Ft\\xd2LR\\x8f\\xf7a\\xcf\\xb3\\xbcX\\x9a\\xbe\\xaa\\xdb\\xfaW\\xea\\xe7\\xf9\\x84dM\\xd7\\xcb}n|\\xc8sQ\\xf9=\\\\xef\\x87\\xda\\xac\\x9a\\xe8\\xd7NjF\\x82-1\\xcbp\\xd3\\xb3\\xdb=\\xe1\\x04\\xbf\\xf9\\x94\\x13P\\x012\\x92p\\x12\\xa8]o\\xcc\\x1c\\xf5\\xc1*\\xff\\xc9c\\x8b\\xd7\\xa3;\\xe2\\xb2\\x0c\\x1f\\xf3h\\xd1\\x1bZ3n\\xd5u\\xfe\\xff\\x8a\\x03\\x01\\x91\"\\x89\\xd6\\xa5r8\\x900\\xcc)\\x97h[p\n\\x16\\xcc\\x13/\\xcf\\xd4\\xaa'iP*04\\x82@t\\xc5\n\\xc0 \\x97\\xba&\\x175jh\\xabwe\\xec\\xfb\\x17)\\x1a\\xf3\\xccn\\x10\\x01\\xf8\\xc3k\\xa6:+\\x1dW4\\xad\\x18\\xacJ2\\xe1\\x87\\xff\\x8c\\xf5<\\xd5\\x16\\xb2[H\\x19\\xbe\\x03\\xbf\\xee*\\xd3\\x03M\\x04\\x89\\x82\\xde\\xed\\x87\\x9f\\xe75*\\x9d\\x01\\x12r?\\x07\\x1cq\\xe7\\xc1\\x93Y\\x12\\x88ZP\\xb1\\xb3\\xcb\\xfah}\\xe9\\xe0" }, { "name": "Length", "value": "33797" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-06-28 21:56:14,871", "thread_id": "4948", "caller": "0x76f66416", "parentcaller": "0x76f66321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 818 }, { "timestamp": "2026-06-28 21:56:14,871", "thread_id": "4948", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-06-28 21:56:14,871", "thread_id": "4948", "caller": "0x00c9c902", "parentcaller": "0x00cb41b8", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-06-28 21:56:14,871", "thread_id": "4948", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x9dNB\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-06-28 21:56:14,886", "thread_id": "4948", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "\\x00\\x00\\x02\\x9b\\x9a\\x19-\\x98\\x96R\\xc0\\xda5\\xdd\\xf9\\xcdP\\xac\\xcd\\xce\\xc7\\x8c\\xfa^Kh\\x06[[\\x1f\\xe7\\x1ej4hs\\xc2\\xdf\\xb1\\xcd;\\xbd\\xcf\\x0e\\x15\\x1b\\xf8\\\\xa0\\xaa\\x15\\x92]0z'&\\xa2\\xcd\\x04\\xd9S\\x1d\\x90nrQ\\x0b\\xbe\\xff\\xecZQ\\xc0\\x84S\\x1cN&|W\\xe7[M\r\\x13y\\xab{\\x893\\x0b\\xb4\\xbc\\xb4\\xeb?\\xe8:[\\x9f\\xd3'\\x1b\\x0c/vlL\\xea\\xcahR\\x01\\xd5\\xa5dU\\xf1\\xc7\\xd5\\x9e\\x9c\\xfe;m\\xaaE\\xf5\\xe7\\x11\\xd7X\\xe1d\\xe78\\xed~&K(\\xab\\xae\\xb0\\xa5JJ\\xf1\\xf1\\x94\\xb1\\x82\\xc6tq\\xd2P\\xa0y\\x84.\\x98\\x01\\x98\\xdb\\xf1Rr\\xf5K`\\xda\\xcc\\xb7\\xe7\\xfeoG\\x15;\\xec\\x15\\x84\\xbd1\\xb4\\x92z\\xb1O\\xda\\xa0\\xfc\\xa3\\xfa\\xe5'A\\xaf\\xd6q\\x1b\\x99X]\\x1c\\x0f6\\x91}\\xaa\\x17\\xdeY\\x04\\x1fH\\xf4A\\xc5\\x11\\xfb\\xa4\\xad\\\\xab\\xa44\\xee\\xffq\\xbfF\\xeb\\xbb\\xfa\\x92\\xa2\\xe4\\xd2\"x\\xf2\\x1aO14\\xd4j\\xaeJP\\xa4p\\xe4" }, { "name": "Length", "value": "71760" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-06-28 21:56:14,886", "thread_id": "2108", "caller": "0x76f66416", "parentcaller": "0x76f66321", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 823 }, { "timestamp": "2026-06-28 21:56:14,886", "thread_id": "2108", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-06-28 21:56:14,886", "thread_id": "2108", "caller": "0x00c9c902", "parentcaller": "0x00cb41b8", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-06-28 21:56:14,886", "thread_id": "2108", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x110\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-06-28 21:56:14,886", "thread_id": "2108", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "\\x00w\\xae\\xd4\\xa2\\xfe\\x1bJ\\xbfg|E\\xb0\\x81V\"`WQ\\xc61\\xa6\\xbe\\xbf\\xf3\\x88z\\x18\\x7fni\\xfc\\xf7\\xe6\\xd2\\xe9\\x12\\xf2\\x9d\\x02\\xb5H\\xd1\\xa2g\\x92\\xfb\\xec\\xe8\\x14\\xf1\\xc93\\xd6|t$x\\xf8$\\xaa\\xba\\x13\\xa6\\xbcch%\\xe0\\x8dc9\\x10=#9=T\\xd2\\xc6\\x93hbt\\x04\\xf01>\\xfb(\\x0c\\x1d\\x84g\\xdd.\\xfa\\x7f\\xf4\\x10\\xe68\\xc07\\xce:\\xfa]/\\x8d\\xb0\\x17\\x81e\\x90\\x90u \\x00\\xe0\\xf0\\xbb\\xc0\\x16\\xa8\\xcf\\xa0\\xd6\\xb1=\\xbd\\xc8I\\x8aC\\xe6\\xe0\\xfd\\xe7\\x8b\\xfb\\xac\\x06\\xb1=\\xf6\\x9e\\xe0}\\xfa'W\\xb0Z\\x1c\\xa9\\xed\\x8cM\\@\\xffo\\x8fQ-sg\\x13\\x12\\x0b\\x11\\x0ea\\x10\\x19!\\xd7\\xe1\\xc7\\xf8l#\\xc6\\xe1\tL\\xb2\\xd7(\\x179\\xfb@\\xbbq\\x99\\xa1PTA\\xef6u\\xf8g\\xc9\\xa9$\\xfe\\x07\\x07s\\xbfo\\xe7\\xe7\\xaa\\xde@\\x1a\\x87\\xb9z\\xff\\x816\\xc4M\\x90/\\xe5\\xa6\\xc7\\x9fjn\\xf3dv\\x10?g\\xfa\\xa0\\xab\\xd4\\xa7Ez\\xeaJ\\x07\\x84$\\xac" }, { "name": "Length", "value": "1048576" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-06-28 21:56:14,933", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-06-28 21:56:14,965", "thread_id": "2108", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x110\\x16\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-06-28 21:56:14,965", "thread_id": "2108", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "\\x87\\xa7\\x15\\xc0\\xe8.T\\xe2\\xf2\\xea?'\\xc3(8'T\\xfe\\xd2\\x02T\\xf7\\x13\\x8c\\xc0\\xe1\\x0e\\x90\\xe1\\x11\\xcf\\xc2\\xc2)\\x95\\x98\"\\x01\"]\\xfa\\xb1\\xb4\\xe8\\x82`\\xbe\\x04Lj4\\x92\\xe0\\x0fY.\\xf8\\xafpX\\xa0 \\x95h<\\xffB`a\\x16\\xb8\\xd4\\x85L\\xb0\n.s\\xd2\\xc2\t(\\xae5\\x1c}\\xef\\x9b\\x04\\xe8F\\xd4\\xf5\\x0e(qJ\\xb6\\xefH\\xbf- \\xf9(\\xc8\\x04M\\x88\\xc6\\xbcy\\x9b\\xfa\\xff\\xf6\r\\xd5\\xd3\\xe2\\xddso\\xe8>S\\x8fc\\x07T\\xd9\\xb0:I\\xf7\nL[\\x82\\x93vV.??\\xb6\\xb8\\xd8\\xc5\\x7f\\xafR\\x80\\xfcO\\xf2\\xb4,\\x91\\xa8H\\xde\\xbc\\x81\tiP\\xf0\\x02\\x83d\\xa4\\xc1\\xae\\x11\\xf3A\\x9fJ\\xa7(\\x0f\\x8b\\xa1\\xeb\\x06\\x9c\\xc6\\xff6\\x17`}?\\xa1\\xc0\\xd1\\xec\\xbe\\xf1\\xe6`\\xee\\xae\\xb4\\xa1\"\\xd3\\xbb)\\xf6.\\xef\\xb1T\\x0f\\xeb\\xae9\\xa2@j.\\xda\\x0fw\\xfd\\xb9\\xcc>\\xce\\xc7\\xc1\\x8c8\\x95\\xf9EK7X\\xa1!\\\\xed0\\xda\n[\\xb5\\xf6G7aZ\\xdd\\xb3\\x81\\x12\\x7f\\x80\\xf7d\\xaa\\xf34k@\\x88\\xa9\\xc3\\x1b\\x80\\xe5\\xf5\t\\x9d(\\xd4\\xcb\\x9d\\xb5\\xc6\\xa2\\xb5\\xcc\\xd7\\x99\\xf8g\\xb0Mg\\xc9\\xe8Z\\xb8\\xd4\\xa9\\xb6\\xc11~/\\x98F\\xfb\\xe5\\x10\\xcdPC_Z\\xdf\\x1e\\x94\\x05\\x11&\\x17\\x16\\xa6\\xb0\\xfd\\x7f" }, { "name": "Length", "value": "1048576" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-06-28 21:56:15,074", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 3, "id": 834 }, { "timestamp": "2026-06-28 21:56:15,168", "thread_id": "2108", "caller": "0x00c8d7d7", "parentcaller": "0x00c8f669", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x1106\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-06-28 21:56:15,168", "thread_id": "2108", "caller": "0x00c8d6b1", "parentcaller": "0x00c8f5c2", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000032c" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\vs_Community_1_.exe" }, { "name": "Buffer", "value": "\\x99!\\xaeS\\x94\r\\x96\\xa6\\x1f*\\xc3-\\x00;FU\"\\x1cf\\xcf\\xa5q\\xb5\\xb0\\x83\\xf0\\x8f\\xe2\\xf8\\x0b>D\td\\xb5\\xb7\\x12\\xb7sO\\x0e\\xd1\\x89\\xc0\\xaa\\x12\"Pk\\xba\\x8f\\xde\\xe2\\xa5\\x9f=C\\x154\\x90\\xa0/\\xa6\\xc2d\\xde\\xd0gG+Hy\\xa9L\\xb0\\xd6a\\x8c\\x8d\\xc0m\\x916\t\\x9a;JV\\x86\\x97\\xe5\\xd6\\x9e0\\xfb\\x92x2'\\x16<\\x19\\xab\\xb8\\xf2,-\\x02\\xd0\\xc4\\xf3\\xf48^\\x0e\\x02\\x1f\\xab\\xa8\\x83\\x1b\\xe6\\xad^A\\xdb\\x05\\xae\\xa8\\x8e\\x9a\\xb2\\xd8}\\x1dM\\xa6\\xbcvZ\\x01R\\x8bo\\x9b\\xeb\\x15U\\xb6v+\r;\\x90\\xf3\\xebT\\x83f\\xe5<\\x1ab\\xa0\\xfc\\xf0\\x88\\xc4\\xc7pGO\\x01\\x8e!!\\xb9\\xa1\\x06f\\xadB\\xbd\\xde\\xf0\\xce\\xcc\\xb1\\xc1\\xbb\\xf3\\x99'\\xe3)\\x13\\xf5\\x1f\\x9a&\\x82_\\xe2Wxk\r'\\xc6\\xb1@\\xccN\\xb6:\\x8e\\x01\\x06\\x04\\xfa)vR\\xb9\\xb1\\xb9\\x08 \\xe3K\\xc0\\xa7\\x7f%1\\x014\\x9f\\xe3\\xfd}\\x88\\x8e\\xea\\xbc\\x84\\xbc\\xcf\\xac\\xe2\\xbbJ\\xf5\\xc3\rC" }, { "name": "Length", "value": "764346" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-06-28 21:56:15,215", "thread_id": "5088", "caller": "0x00c8a80b", "parentcaller": "0x00000000", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000409", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000409" }, { "name": "LanguageName", "value": "English (United States)" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-06-28 21:56:15,230", "thread_id": "3636", "caller": "0x00c8e1a7", "parentcaller": "0x00c8a431", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x04ede000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-06-28 21:56:15,230", "thread_id": "5088", "caller": "0x00c8a997", "parentcaller": "0x00c8a80b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-06-28 21:56:15,230", "thread_id": "5088", "caller": "0x00c8a997", "parentcaller": "0x00c8a80b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75030000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-06-28 21:56:15,230", "thread_id": "3636", "caller": "0x00c8edd0", "parentcaller": "0x00c8d4ca", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-06-28 21:56:15,230", "thread_id": "3636", "caller": "0x00c8ede6", "parentcaller": "0x00c8d4ca", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-06-28 21:56:15,230", "thread_id": "3636", "caller": "0x00c8edd0", "parentcaller": "0x00c8ee3d", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-06-28 21:56:15,230", "thread_id": "3636", "caller": "0x00c8ede6", "parentcaller": "0x00c8ee3d", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8edd0", "parentcaller": "0x00c8ee3d", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8ede6", "parentcaller": "0x00c8ee3d", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8edd0", "parentcaller": "0x00c8ee3d", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8ede6", "parentcaller": "0x00c8ee3d", "category": "filesystem", "api": "CreateDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8ee52", "parentcaller": "0x00c8ee3d", "category": "filesystem", "api": "CreateDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8ee52", "parentcaller": "0x00c8ee3d", "category": "filesystem", "api": "CreateDirectoryW", "status": true, "return": "0x00000001", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8ee52", "parentcaller": "0x00c8d4ca", "category": "filesystem", "api": "CreateDirectoryW", "status": false, "return": "0x00000000", "arguments": [ { "name": "DirectoryName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8f459", "parentcaller": "0x00c8d4f2", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000384" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\help.html" }, { "name": "CreateDisposition", "value": "5", "pretty_value": "FILE_OVERWRITE_IF" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8f459", "parentcaller": "0x00c8d53e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000388" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\help.html" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8d570", "parentcaller": "0x00c8fc45", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000384" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\help.html" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "S]\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 1, "id": 854 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8d57f", "parentcaller": "0x00c8fc45", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000384" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\help.html" }, { "name": "FileInformationClass", "value": "20", "pretty_value": "FileEndOfFileInformation" }, { "name": "FileInformation", "value": "S]\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8d57f", "parentcaller": "0x00c8fc45", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000384" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\help.html" }, { "name": "FileInformationClass", "value": "19", "pretty_value": "FileAllocationInformation" }, { "name": "FileInformation", "value": "S]\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8d589", "parentcaller": "0x00c8fc45", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000384" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\help.html" }, { "name": "FileInformationClass", "value": "14", "pretty_value": "FilePositionInformation" }, { "name": "FileInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-06-28 21:56:15,246", "thread_id": "3636", "caller": "0x00c8d731", "parentcaller": "0x00c8f761", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000384" }, { "name": "HandleName", "value": "C:\\Users\\Rajesh\\AppData\\Local\\Temp\\051775d19defbd24b8dc82ad282a\\vs_bootstrapper_d15\\HelpFile\\1033\\help.html" }, { "name": "Buffer", "value": "\\xfeff\r\n\r\n\r\n \r\n