{ "statistics": { "processing": [ { "name": "CAPE", "time": 19.537 }, { "name": "AnalysisInfo", "time": 0.075 }, { "name": "BehaviorAnalysis", "time": 0.097 }, { "name": "Debug", "time": 0.001 }, { "name": "NetworkAnalysis", "time": 4.038 }, { "name": "Suricata", "time": 5.496 }, { "name": "UrlAnalysis", "time": 0.0 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "dotnet_code_compile", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "decoy_document", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "guloader_apis", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "encrypted_ioc", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "koadic_apis", "time": 0.0 }, { "name": "koadic_network_activity", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "cryptbot_network", "time": 0.0 }, { "name": "masslogger_artifacts", "time": 0.0 }, { "name": "purplewave_network_activity", "time": 0.0 }, { "name": "quilclipper_behavior", "time": 0.0 }, { "name": "raccoon_behavior", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "vidar_behavior", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "injection_rwx", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "loader_alien", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "encrypt_pcinfo", "time": 0.0 }, { "name": "encrypt_data_agenttesla_http", "time": 0.0 }, { "name": "encrypt_data_agentteslat2_http", "time": 0.0 }, { "name": "encrypt_data_nanocore", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "network_document_http", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "office_write_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_network_connection", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "nemty_network_activity", "time": 0.0 }, { "name": "nemty_note", "time": 0.0 }, { "name": "sodinokibi_behavior", "time": 0.0 }, { "name": "stop_ransomware_registry", "time": 0.0 }, { "name": "blackrat_apis", "time": 0.0 }, { "name": "blackrat_network_activity", "time": 0.0 }, { "name": "blackrat_registry_keys", "time": 0.0 }, { "name": "dcrat_behavior", "time": 0.0 }, { "name": "karagany_system_event_objects", "time": 0.0 }, { "name": "rat_luminosity", "time": 0.0 }, { "name": "rat_nanocore", "time": 0.0 }, { "name": "netwire_behavior", "time": 0.0 }, { "name": "obliquerat_network_activity", "time": 0.0 }, { "name": "orcusrat_behavior", "time": 0.0 }, { "name": "trochilusrat_apis", "time": 0.0 }, { "name": "reads_self", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "remcos_shell_code_dynamic_wrapper_x", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_file", "time": 0.0 }, { "name": "stealth_system_procname", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "neshta_files", "time": 0.0 }, { "name": "neshta_regkeys", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.001 }, { "name": "binary_yara", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "phishing_kit_detected", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_country_distribution", "time": 0.0 }, { "name": "network_cnc_http", "time": 0.019 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.0 }, { "name": "network_excessive_udp", "time": 0.0 }, { "name": "network_http", "time": 0.007 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_questionable_http_path", "time": 0.0 }, { "name": "network_questionable_https_path", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.0 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pdf_annot_urls_checker", "time": 0.0 }, { "name": "polymorphic", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.001 }, { "name": "recon_checkip", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "suspicious_html_body", "time": 0.0 }, { "name": "suspicious_html_name", "time": 0.0 }, { "name": "suspicious_html_title", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.0 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.002 }, { "name": "antianalysis_detectreg", "time": 0.009 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.004 }, { "name": "antiav_detectreg", "time": 0.041 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.001 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.001 }, { "name": "antivm_generic_bios", "time": 0.0 }, { "name": "antivm_generic_diskreg", "time": 0.002 }, { "name": "antivm_hyperv_keys", "time": 0.001 }, { "name": "antivm_parallels_keys", "time": 0.002 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.0 }, { "name": "antivm_vbox_files", "time": 0.002 }, { "name": "antivm_vbox_keys", "time": 0.005 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.001 }, { "name": "antivm_vmware_keys", "time": 0.003 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.002 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.002 }, { "name": "asyncrat_mutex", "time": 0.0 }, { "name": "gulpix_behavior", "time": 0.0 }, { "name": "ketrican_regkeys", "time": 0.001 }, { "name": "okrum_mutexes", "time": 0.0 }, { "name": "banker_cridex", "time": 0.0 }, { "name": "geodo_banking_trojan", "time": 0.002 }, { "name": "banker_spyeye_mutexes", "time": 0.0 }, { "name": "banker_zeus_mutex", "time": 0.0 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.001 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.0 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.001 }, { "name": "checks_uac_status", "time": 0.0 }, { "name": "uac_bypass_cmstpcom", "time": 0.0 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "carberp_mutex", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_credential_store_access", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.0 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "cypherit_mutexes", "time": 0.0 }, { "name": "darkcomet_regkeys", "time": 0.001 }, { "name": "datop_loader", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.001 }, { "name": "disables_browser_warn", "time": 0.001 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.001 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.0 }, { "name": "removes_windows_defender_contextmenu", "time": 0.0 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.0 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "andromut_mutexes", "time": 0.0 }, { "name": "downloader_cabby", "time": 0.0 }, { "name": "phorpiex_mutexes", "time": 0.0 }, { "name": "protonbot_mutexes", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "apocalypse_stealer_file_behavior", "time": 0.0 }, { "name": "arkei_files", "time": 0.0 }, { "name": "azorult_mutexes", "time": 0.001 }, { "name": "infostealer_bitcoin", "time": 0.003 }, { "name": "cryptbot_files", "time": 0.0 }, { "name": "echelon_files", "time": 0.001 }, { "name": "infostealer_ftp", "time": 0.015 }, { "name": "infostealer_im", "time": 0.009 }, { "name": "infostealer_mail", "time": 0.004 }, { "name": "masslogger_files", "time": 0.0 }, { "name": "poullight_files", "time": 0.001 }, { "name": "purplewave_mutexes", "time": 0.0 }, { "name": "quilclipper_mutexes", "time": 0.0 }, { "name": "qulab_files", "time": 0.0 }, { "name": "qulab_mutexes", "time": 0.0 }, { "name": "asyncrat_mutex", "time": 0.0 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.002 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "modify_certs", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.0 }, { "name": "modify_uac_prompt", "time": 0.0 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.0 }, { "name": "network_dns_paste_site", "time": 0.0 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.0 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.0 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.0 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.0 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.0 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powerpool_mutexes", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "cryptomix_mutexes", "time": 0.0 }, { "name": "dharma_mutexes", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.004 }, { "name": "ransomware_files", "time": 0.006 }, { "name": "fonix_mutexes", "time": 0.0 }, { "name": "gandcrab_mutexes", "time": 0.0 }, { "name": "germanwiper_mutexes", "time": 0.0 }, { "name": "medusalocker_mutexes", "time": 0.0 }, { "name": "medusalocker_regkeys", "time": 0.0 }, { "name": "nemty_mutexes", "time": 0.0 }, { "name": "nemty_regkeys", "time": 0.0 }, { "name": "pysa_mutexes", "time": 0.0 }, { "name": "ransomware_radamant", "time": 0.0 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "revil_mutexes", "time": 0.001 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "satan_mutexes", "time": 0.0 }, { "name": "snake_ransom_mutexes", "time": 0.0 }, { "name": "stop_ransom_mutexes", "time": 0.0 }, { "name": "stop_ransomware_cmd", "time": 0.0 }, { "name": "ransomware_stopdjvu", "time": 0.0 }, { "name": "rat_beebus_mutexes", "time": 0.0 }, { "name": "blacknet_mutexes", "time": 0.0 }, { "name": "blackrat_mutexes", "time": 0.0 }, { "name": "crat_mutexes", "time": 0.0 }, { "name": "dcrat_files", "time": 0.0 }, { "name": "dcrat_mutexes", "time": 0.0 }, { "name": "rat_fynloski_mutexes", "time": 0.0 }, { "name": "limerat_mutexes", "time": 0.0 }, { "name": "limerat_regkeys", "time": 0.001 }, { "name": "lodarat_file_behavior", "time": 0.0 }, { "name": "modirat_behavior", "time": 0.0 }, { "name": "njrat_regkeys", "time": 0.0 }, { "name": "obliquerat_files", "time": 0.0 }, { "name": "obliquerat_mutexes", "time": 0.0 }, { "name": "parallax_mutexes", "time": 0.0 }, { "name": "rat_pcclient", "time": 0.0 }, { "name": "rat_plugx_mutexes", "time": 0.0 }, { "name": "rat_poisonivy_mutexes", "time": 0.0 }, { "name": "rat_quasar_mutexes", "time": 0.0 }, { "name": "ratsnif_mutexes", "time": 0.0 }, { "name": "rat_spynet", "time": 0.0 }, { "name": "venomrat_mutexes", "time": 0.0 }, { "name": "warzonerat_files", "time": 0.0 }, { "name": "warzonerat_regkeys", "time": 0.001 }, { "name": "xpertrat_files", "time": 0.0 }, { "name": "xpertrat_mutexes", "time": 0.0 }, { "name": "rat_xtreme_mutexes", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.001 }, { "name": "remcos_files", "time": 0.0 }, { "name": "remcos_mutexes", "time": 0.0 }, { "name": "remcos_regkeys", "time": 0.0 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.0 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "spicyhotpot_behavior", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.0 }, { "name": "tampers_etw", "time": 0.0 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "targeted_flame", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.014 }, { "name": "trickbot_mutex", "time": 0.0 }, { "name": "fleercivet_mutex", "time": 0.0 }, { "name": "lokibot_mutexes", "time": 0.001 }, { "name": "ursnif_behavior", "time": 0.001 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "neshta_mutexes", "time": 0.0 }, { "name": "renamer_mutexes", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.003 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.004 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 }, { "name": "allaple_mutexes", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "target": { "category": "file", "file": { "name": "test_dropped.zip", "path": "/opt/CAPEv2/storage/binaries/982178c48c36cf2b1704821a8b571b805496591faab8297925e037a5f9c5ff2c", "guest_paths": "", "size": 1947, "crc32": "7064E098", "md5": "67081efeedaf200e61d336c9f814a5ca", "sha1": "c238617c204ec4d885e80699a2eefd232d0c758f", "sha256": "982178c48c36cf2b1704821a8b571b805496591faab8297925e037a5f9c5ff2c", "sha512": "c28ed767b0ec117cfabd67e11ed7051db43265699e2125b49ae951e7b2f3717d43ef02c3d852c6272072a6fe8d8590d1fcb0cb64c3fb9c384e26e58deb000a8d", "rh_hash": null, "ssdeep": "48:9RC8l68YPtxR+q2gFakFDZ4C2fkqe/Drkb4KP1q/LNT9KechUil6Cch4:a8axFn5vnkb4KszHHcFbci", "type": "Zip archive data, at least v2.0 to extract, compression method=deflate", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T1C9411B40F2B3D0E1E75FA03125BDA71BF433679B8A8C25C94926C4D9E105E92C5549AE", "sha3_384": "1e2fddeb752d351aa822e05d776a3e8f72ffe8a90b09224372656d9ab11c7c693ecbd3af4e677d26f26e63adce204462", "yara_hash": "3b285f9d3c197e5b63f2245e549b04ead2ddc38f69551ea601ce08d250fcd6a2", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "c=I=N=", "connection reset", "!616A6R6V6\\6`6f6j6r6v6|6", "lstrcmpW", "3C3O3m3", "is a directory", "4*414?4F4T4[4", "_lock", "no message available", "FindFirstStreamWStub", " Operating System", "GetDriveTypeW", "calloc", "NtOpenThreadToken", ";';9;I;O;q;", "DelayedExpansion", "1#101O1\\1x1", ">Q>_>t>{>", "w>", "mgw`dgwP", "file too large", "4qaCCRCCCB", ">1>>>V>l>", "j\"Zf;", "connection aborted", "=8=X=t=x=", "NtSetInformationProcess", "0!1q1", "7D7U7[7a7|7", " name=\"Microsoft.Windows.FileSystem.CMD\"", "permission_denied", "D$hP3", "GetNumaHighestNodeNumber", "GetModuleFileNameW", "read only file system", "4`5d5h5l5p5t5", "PQQQV", "operation not permitted", "8\"8'8<8H8O8Z8a8l8s8~8", "D$$Ph", "SetThreadUILanguage", "3H4`4o4", "4$4.464B4J4X4`4", ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.PYW", "0Ph4:", "mkdir ", "?Q?V?m?", "too many links", "_vsnwprintf", "swscanf", ".data$pr00", "T$ WP", "tJSh$$", ".data$00", "f;D$$u", "WaitForSingleObjectEx", "u%6RRRRRPp", ".rdata$sxdata", "string too long", "D$4Pj", ".text$mn", "broken pipe", "6)60676V6}6", "tokens=", "VVVVR", "090C0", "3/363G3", "QQVWj", "6?6I6Y6e6", "DeleteProcThreadAttributeList", "j\"[f;", ")030`0", "f;T$8u", "SSSSP", "BrandingFormatString", "SetConsoleTextAttribute", "wcsspn", "t;f9;t6", "CreateMutexExW", "=0=]=h=", "j\\Xf9", "RegQueryValueExW", "PPPQPPVV", "0>0r0", "SHIFT", "api-ms-win-core-timezone-l1-1-0.dll", "dw06dwPLew`adwpLew", "_CxxThrowException", " &()[]{}^=;!%'+,`~", "QQh|4", "RtlFindLeastSignificantBit", ".idata$5", ".idata$3", "_initterm", "SVWj/X", ".idata$2", "%s %s%s ", "api-ms-win-core-errorhandling-l1-1-0.dll", "E$uwM", "vDhd:", "GetStartupInfoW", "MKLINK", ".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC", "SetErrorMode", "I8SV3", "t$5R5", "__set_app_type", "L$ h(#", "7<7^7", "_wcsnicmp", "CreateSemaphoreExW", "Vj/Xf", "RWhl;", "5;5B5j5", "GetDiskFreeSpaceExW", "2/2f2o2y2", "6!6'6-636=6L6R6Z6y6~6", "=q?{?", "_onexit", "lstrcmpiW", "x4j/Z", "=-=?=b=", "no link", "RtlDisownModuleHeapAllocation", "__CxxFrameHandler3", "FindClose", "L$xQQ3", "invalid_argument", "REM/?", "4'5A5", "D$pPS", "address in use", "state not recoverable", "KERNEL32.DLL", "<5<=", "%hs(%u)\\%hs!%p: ", "3_3s3", "1#1*1", "((((&&(&&&(&(&&&&&&(((#&&###", "L$0Qh", "bad_file_descriptor", "@_^[]", "BELOWNORMAL", ".data$r$brc", ":':::p:v:~:", ".text$zy", "3-3;3I3", "QueryPerformanceCounter", "5?5g5n5", "MKDIR", "9*:P:}:", "4_5p5~5", ": :&:N:m:", "@8f90", ">C>Z>o>", "u\"j:Xf9F", "wcstol", "RRRRP%", "(%s) %s ", "operation_in_progress", "<%", "_open_osfhandle", "<,<4", "AutoRun", "@$9Q w", "0123456789", ".didat$6", "APerformUnaryOperation: '%c'", "0+1b1", "BREAK", "ReleaseSRWLockExclusive", "onecore\\base\\cmd\\maxpathawarestring.cpp", "0B0\\0", "4sf9>", ".data$zz", "HIGHESTNUMANODENUMBER", "Copyright (c) Microsoft Corporation. All rights reserved.", ".bss$zz", "api-ms-win-core-heap-l2-1-0.dll", "j\\Xf9B", "0A0\\0e0k0p0y0", "GetCommandLineW", "u4h4'", "SetLocalTime", "8S8Y8", "D$,SVW", "959U9", "memcpy_s", "<>+-*/%()|^&=,", "D$,SPQ", "Ungetting: '%s'", "FreeEnvironmentStringsW", "Yj Zf;", "SetFileAttributesW", "6-7@7T7", "no stream resources", "L$8Q3", "destination_address_required", "T$ PQS", "??0exception@@QAE@ABQBDH@Z", "465Y5s5", ".didat$5", "too many files open", "j:Zf;", "no child process", "VPh@:", "O8j*Z", "jDXP3", "10.0.19041.746", "ShellExecuteExW", "REALTIME", ".text", ">:>h>", "message size", "tDSSSS", ";O;^;v;};", "8/8Q8", "3%4}4", ".CRT$XIA", "LeaveCriticalSection", "io error", "GetExitCodeProcess", ";-A>", "RemoveDirectoryW", "operation in progress", "PSh[#", "9):B:Q:", "Sleep", "%04X-%04X", ":):R:", "7I7h7", "RWRVh", "PShT>", "_wcslwr", ".didat", "<<=F=Y=c=", "<3=i=v=", "NtQueryInformationProcess", "9+9[9", "tEht&", "RtlReleaseRelativeName", ">2>X>e>t>", "HeapAlloc", "bad_address", "CompareFileTime", "memset", "7!8,8L8q8{8", "Software\\Policies\\Microsoft\\Windows\\System", "NtClose", "t%j\\Xf;", "no space on device", "FormatMessageW", "1B1N1i1t1", ".?AVlogic_error@std@@", "GetFileAttributesW", ";D;H;d;h;x;", "DIRCMD", "FindNextFileW", "7Y7k7v7", "C:\\Users\\cape\\AppData\\Local\\Temp", "0_0h0", "1%1+1P1l1}1", "System", ";\\$(r", "api-ms-win-core-winrt-l1-1-0.dll", "??0exception@@QAE@ABV0@@Z", "GetLastError", "\\XCOPY.EXE", "api-ms-win-core-processenvironment-l1-2-0.dll", "no such process", "t$O>\\>", "RegDeleteKeyExW", "10.0.19041.746 (WinBuild.160101.0800)", " processorArchitecture=\"x86\"", "VShb#", "HeapSetInformation", "", "GetModuleFileNameA", "t+Vh5#", "L$xQ3", "Args: `%s' ", "connection_aborted", ":%:,:::C:z:", "printf", "LocalFree", "7$7*767=7I7Q7^7z7", ">F>^>s>", ">*?H?N?i?n?s?", "onecore\\internal\\sdk\\inc\\wil\\opensource\\wil\\resource.h", "SVWj/Xf", "939A9H9{9", "D$ PV", "='=5=C=T=\\=r=z=", "t5j Y", "5dwPlhw", "CreateHardLinkW", "979V9]9r9y9", "DISABLEEXTENSIONS", "91:K:\\:", "9L:~;", "5G5U5b5", "directory not empty", "3D3X3l3", "MoveFileWithProgressW", " }0j@", "3(343@3L3", "EnableExtensions", "PathCompletionChar", "%6Ru'", "cCBR_p", "connection_already_in_progress", "VPh]#", "SetLastError", "2:3H3|3", "1i1r1|1", "api-ms-win-core-console-l2-2-0.dll", ".CRT$XCZ", "<$_^[]", "5Y5z5", "8 8(8=8R8g8|8", "%02d%s%02d%s%02d", "iostream", "QRRRP", "D$8f90", ";2;I;R;];d;v;|;", "SetThreadLocale", "true", "FlushConsoleInputBuffer", "t$Sh4&", "towlower", "3$3,343<3D3L3T3\\3d3l3t3|3", "L$8RQRP", "8<8b8l8q8", "PPWWWQ", "T$$;T$", "=L>h>", "kernelbase.dll", "Application", "2 2&2-222=2m2s2", "no buffer space", "f;D$8u", "344D4P4Y4a4", "2$2+272<2E2J2P2X2^2f2n2", "5%6+616K6U6a6l6~6", "8,8>8R8X8^8p8", "tSj/Z", "api-ms-win-core-debug-l1-1-0.dll", "f91t.", "iswalpha", "80848H8L8`8d8x8|8", " !>D>L>", "ERASE", "%s %s ", "4$4,444<4D4L4T4\\4d4l4t4|4", "5&5a5", "not supported", "3!3H3O3Z3b3n3", "%d.%d.%05d.%d", "Local\\SM0:%d:%d:%hs", "cG?CCRRRRP`R", " ", "L$DQP", "_pclose", "", "31383", "address_in_use", "VtPh(#", "_callnewh", "ReadConsoleW", "|$,+T$d", ">x?}?", "connection_reset", "1j1o1", "2)202T2e2k2", "%2d%s%02d%s%02d%s%02d", "1W1^1", ":(:D:H:d:h:", "778I8", " \"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"", "GlobalFree", "RoUninitialize", "usebackq", "ctff;", "CCCC@40`P@ ", "6@6`6", "9/:z:", "not enough memory", "6 686@6", "?Rich", "connection refused", "device or resource busy", ":f;w;", "_setjmp3", "4<4l4t4z4", "towupper", "j:Xf9A", "bad address", "-dw0cfw", "GetConsoleOutputCP", "0$0,040<0D0L0T0X0\\0`0d0h0l0p0t0x0|0", "LoadLibraryExW", "protocol error", "u3SSh,<", "0P133b3x3", "(0E0k0w0", "RevertToSelf", ".?AVout_of_range@std@@", "6!7k7", "GetFileInformationByHandleEx", "message_size", "8?8`8", "operation would block", "?what@exception@@UBEPBDXZ", "bad file descriptor", "wwwwwwwwwwwwwww", "CMD Internal Error %s", "696^6", "AcquireSRWLockShared", "Msg:[%ws] ", ": :.:G:M:S:Z:`:k:r:", "040904B0", "OpenSemaphoreW", ".?AVbad_alloc@std@@", "`.data", "?!?'?-?A?O?e?", ".?AVexception@@", "RANDOM", " Windows", "; ;%;9;>;X;", "invalid string position", "connection_refused", ".CRT$XCAA", "63696F6T6k6", "ENABLEEXTENSIONS", "PATHEXT", "60666:6G6U6k6u6", "=/=G=z=", "text file busy", "EnterCriticalSection", "j-Zj/Yf;", "9n9z9", "575>5F5N5", ">+>>>B>F>J>N>R>V>Z>^>b>u>", "j:Xf9F", "MM/dd/yy", "_setmode", "CmdBatNotificationStub", "t$,WQ", "j$Xf;", "b$j-0", "j\\Zj:Yf", "_controlfp", "ext-ms-win-branding-winbrand-l1-1-0.dll", "0B0i1", "8\"8<8h8", "j\"Yf;", "api-ms-win-core-systemtopology-l1-1-0.dll", "1.13191E1J1P1i1", ">3>C>X?u?", "u)Rh7#", "api-ms-win-core-heap-l1-1-0.dll", "j%Xf9", "ReleaseSemaphore", "131w1W3]3z3", "qsort", " level=\"asInvoker\"", "v)>4>H>", "ext-ms-win-branding-winbrand-l1-2-0", "`j/Yf;", ";0<7<", "4#4F4", "=-=c=", "3#4L4", "2$2,242<2D2L2T2\\2d2l2t2|2", "D$LPV", "LogHr", ";4;L;`;d;x;|;", "<;", "not a directory", "WShD#", "1$1,141<1D1L1T1\\1d1l1t1|1", "8B9_9z9", ";Q;p;x;", "D$(PV", "L$,RQh", "no such device or address", "QShc#", "DEFINED", "_unlock", " /D /c\"", "Yj f;", "FillConsoleOutputAttribute", "<$=,=<=R=Z=j=~=", " /wait \"\" \"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms", "__getmainargs", "j\"ZRV", "VirtualQuery", "cross device link", "889=9C9I9o9x9", "6T6r6", "SHARED", "949P9V9`9f9s9w9", ".00cfg", "DeviceIoControl", "tBj0Y", "", "6&616f6{6", "HeapFree", "COMSPEC", "6.6A6I6m6s6y6", "1N1p1u1", "api-ms-win-core-apiquery-l1-1-0.dll", "8\"8*82878>8F8U8a8l8", "iH4-N", "1>2Z2v2", "4h4t4", "wcschr", "7c7u7", "wrong protocol type", "9 979F9", "D$`PV", "#D$Lt", "setlocale", "L$(t:", "Windows Command Processor", "5.5=5J5V5", "NeedCurrentDirectoryForExePathW", "9*989]9l9", "NtOpenProcessToken", "SEPARATE", "system", "RMDIR", "DisableUNCCheck", "??3@YAXPAX@Z", "4R5]5c5", "toWhp8", "", "!This program cannot be run in DOS mode.", "=9=@=U=\\=l=v=", "LegalCopyright", "?Y?s?", "'j:Xj.f", "727Y7", "cmd.exe", " v,PW", "7 7*7;7E7S7]7j7r7", "ProductName", ";2true", "9Q9y9", "1'141>1L1a1", ".text$lp00cmd.exe!20_pri7", "t$0j ", "address not available", "D$ Ph", "ScrollConsoleScreenBufferW", "PROMPT", ">(>P>f>s>", "=c>p>", ".gfids", "msvcrt.dll", "D$xPh", "AFFINITY", ".bss$dk00", "1G1^1", "D$D;D$,", "GetWindowsDirectoryW", "979C9S9l9", "+C F;C w", "api-ms-win-core-string-obsolete-l1-1-0.dll", "t\\SWj", "8&888", "6,7E7M7", ".rdata$zz$brc", "en-US", "__dllonexit", "797Y7", "|$B:tQ", "j-[f;", "8#828A8F8Z8i8", "9t$$~n", ">3>P>b>", "N8WQj", "848B8b8g8", "<'9?R?d?", "Vj ^S", "jdXf;", "dd/MM/yy", "result out of range", ">8>E>", "VQh(=", "CreateSymbolicLinkW", "memcpy", ":=:C:M:S:\\:a:", "api-ms-win-core-delayload-l1-1-1.dll", "RtlDllShutdownInProgress", "0<1R1g1v1|1", "D$dPS", ";P;V;", "generic", "api-ms-win-core-processenvironment-l1-1-0.dll", ";>Q>", "api-ms-win-core-processtopology-obsolete-l1-1-0.dll", "929O9U9f9{9F:", "__iob_func", "NtSetInformationFile", "filename too long", "0\"1R1", "?=?h?o?z?", "=ExitCodeAscii", " Microsoft Corporation. All rights reserved.", "?C?H?P?o?", "D$$9L$", "host_unreachable", "7,7H7", "|$$f9", "CallContext:[%hs] ", "=ExitCode", "Redir: ", "???l?y?", "8<8K8", "j\\^f92u", ".CRT$XIY", "_local_unwind4", "host unreachable", "8::@:T:Z:`:j:t:{:", "connection already in progress", "api-ms-win-core-memory-l1-1-0.dll", "60676C6Y6a6h6{6", "QPh,\"", "IDI_APPICON", "[%hs]", "_wcsupr", "2;2P2e2x2", " version=\"5.1.0.0\"", ">i?y?", "MessageBeepStub", "SaferWorker", "6h7l7p7t7x7", ".rsrc", "<\"<(<2<8<>Windows Command Processor", "Translation", "HeapSize", "SetProcessAffinityMask", ":-;<;K;", "798P8q8", "GetUserDefaultLCID", "longjmp", "ntdll.dll", "j\\Yf9", "UnhandledExceptionFilter", "eIDATx", "969E9", "SetEnvironmentStringsW", "ext-ms-win-shell-shell32-l1-2-0.dll", "3)515", " ", "SetFilePointer", "not_a_socket", "interrupted", "?$?+???I?{?", "?Q?X?", "CreateProcessAsUserW", "iswdigit", "ferror", "DebugBreak", "_ _^[", ":2:C:q:", "v", "v(h(4", "2V2]2", "D3blc", "onecore\\base\\cmd\\StartShellExecServiceProvider.h", "4]4e4", "j.Yf;", "RtlDosPathNameToRelativeNtPathName_U_WithStatus", "CHDIR", "api-ms-win-core-localization-l1-2-0.dll", "WSh!'", "j\"[umf9", "8#9(9U9p9|9", " [..]", ">&?.?D?L?i?s?", " />", "9E9S9", "_exit", "SetCurrentDirectoryW", "ProductVersion", "CompletionChar", "='>9>D>R>_>", "destination address required", "api-ms-win-core-sysinfo-l1-1-0.dll", "5u6~6", "tef93t`", "SetEnvironmentVariableW", "IF /?", "MultiByteToWideChar", "t$ t%S", "srand", "GetCurrentThreadId", "memmove", "%hs!%p: ", ":(:,:@:D:X:\\:", "j.Xf9", "3*313Z3w3", "api-ms-win-core-file-l1-1-0.dll", "Wj:Xf9F", ".idata", "445(6B6k6r6", "=W>]>", "_XcptFilter", "*** Unknown type: %x", "ext-ms-win-shell-shell32-l1-2-2", "GetFileSize", ".rdata", "GetStdHandle", "XXX8Pvh8v", "WNetGetConnectionWStub", ".data$dk00$brc", ";);B;^;", "ENDLOCAL", "api-ms-win-core-registry-l1-1-0.dll", "0 0$0(0,0004080@0", "", "7(7,7@7D7X7\\7p7t7", "ExpandEnvironmentStringsW", "D$(VW", "wcsrchr", "not a socket", "realloc", "N", "j/Yf;", "RegCloseKey", "network reset", "2Q2W2]2c2h2n2", "7]8i8v8", "@PVVWS", "SetConsoleCtrlHandler", "DisableCMD", "4C4H4", "DeleteFileW", "GetProcessHeap", "HH:mm:ss t", "*>t>{>", "GetConsoleWindow", "PUSHD", "no_buffer_space", "1Q2r2", "0 0B0b0", "D$`;D$d", "QQSVW", "6H7R7f7v7}7", "041=1O1X1", "FailFast", "757S7j7", "EXIST", "fflush", "ext-ms-win-cmd-util-l1-1-0.dll", "wwwwwwwwwwwwwwwwwwwww", "RoInitialize", "api-ms-win-core-delayload-l1-1-0.dll", "not connected", "3)4P4`4", "prRRRPa", "network unreachable", "ResumeThread", "n2", "6%6<6P6g6q6|6", "unknown error", "4W5d5s5", "chdir ", "=O={=", "uBSWR", "FillConsoleOutputCharacterW", ">+?9?~?", "DISABLEDELAYEDEXPANSION", "YY[_3", "=,;+/[] ", "%WINDOWS_COPYRIGHT%", "4N4m4}4", "_cexit", "j/Xf;", "j Yf9", "GetLocaleInfoW", "not a stream", "Y__^[", "VirtualAlloc", "708[8", "_wcsicmp", "@Qm6t", "RtlCreateUnicodeStringFromAsciiz", ":2;_;", " ", ".data", "VVVQV", "COLOR", "VarFileInfo", "GetVolumeInformationW", "NtCancelSynchronousIoFile", "delims=", "SearchPathW", "DPATH", ":X:l:", "operation_not_supported", "VPSRW", "4)4G4", "APerformArithmeticOperation: '%c'", "GetTimeFormatW", "4m4~4", "1 1&1C1~1", "4'40474>4Y4c4l4v4", "1e1j1", "CopyFileExW", "0f;2u", "Software\\Classes", "START", "skip=", "VirtualFree", "pqacG%%apppppppaB", "*taf;M", ";';-;V;g;m;", "__p__commode", "", "WWWSQ", "TerminateProcess", "Software\\Microsoft\\Command Processor", "iWWSQ", "ERRORLEVEL", "D$495", "value too large", "StringFileInfo", "owner dead", "GetEnvironmentVariableW", "network down", "CompanyName", "GetSecurityDescriptorOwner", "5?6X6", "FOR /?", "_dup2", "RtlFreeUnicodeString", ">1?9?", ": ;&;D;", "bad allocation", ".text$yd", "3$3)313;3E3M3X3`3j3t3", ".rdata$00$brc", "_close", "??_V@YAXPAX@Z", "FindNextStreamWStub", "_wtol", "SetConsoleCursorPosition", ".bss$pr00", "WaitForSingleObject", ":X:b:t:", "already connected", "171p1", "!wWt&H+", "tMj\\YQ", "", "QSVWj", ".giats", "5G5i5", "CMDCMDLINE", "_get_osfhandle", "9 9$989<9P9T9h9l9", "fprintf", "80J0f0u0", "8(8/8G8h8t8z8", "ext-ms-win-shell-shell32-l1-2-0", "?terminate@@YAXXZ", "848<8s8", "72898E8P8e8", "ext-ms-win-shell-shell32-l1-2-1", "filename_too_long", "__p__fmode", "invalid argument", "4P4V4n4v4", "3*353B3P3Z3d3n3x3", "??1exception@@UAE@XZ", "Microsoft", "tMj Y", ".CRT$XIAA", "@u-QQ" ], "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 1, "cape_type": "", "process_path": "C:\\Windows\\SysWOW64\\cmd.exe", "process_name": "cmd.exe", "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "pid": 6764 } ], "dropped": [ { "name": [ "f01b4d95cf55d32a.automaticDestinations-ms" ], "path": "/opt/CAPEv2/storage/analyses/10/files/b044f900caf7f7ed584fc54b10c2839616f27ba3e8230343e3727246e9620597", "guest_paths": [ "C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms" ], "size": 7168, "crc32": "2E7C851E", "md5": "f6315d12deb103f8cb25b962ff929a0c", "sha1": "eb8effdd815574fccf7044d6f1b2cc49db0fabdf", "sha256": "b044f900caf7f7ed584fc54b10c2839616f27ba3e8230343e3727246e9620597", "sha512": "9d4b2ef6205b3d9b2d2bd4c5c48924d06241f8e2d214b7ff62744371f92c1e19298a1eebbf1b40333f78794d2fad1144f15b48e177d7bc32f4cbee59ede98a6a", "rh_hash": null, "ssdeep": "48:rQlvy9XUUKKJ80QxUzJN1uz3QxUnJuuXS62JW4fuo2T+tbIadRLN4wAlr+eipJBm:MKuZ0FMGEcaTpgW48qdRB4BylbdrI", "type": "Composite Document File V2 Document, Cannot read section info", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T176E1EC127ED299BBE09C41728E1FE6518710BE935D47BB5FBCCA728E6D7108408CD52C", "sha3_384": "c514c123945dd5d2a78d5486d046a4b6ef95a5efda31068ff8f51cdce71ada7dd29dd0893958a2a060a0d8adaa7729e4", "yara_hash": "3b285f9d3c197e5b63f2245e549b04ead2ddc38f69551ea601ce08d250fcd6a2", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "2knownfolder:{374DE290-123F-4565-9164-39C4925E467B}", "C:\\Users\\cape\\Documents", "C:\\Users\\cape\\Videos", "C:\\Users\\cape\\Music", "DestList", "2knownfolder:{33E28130-4E1E-4676-835A-98395C3BC3BB}", "C:\\Users\\cape\\Desktop", "1SPSU(L", "C:\\Users\\cape\\Downloads", "2knownfolder:{754AC886-DF64-4CBA-86B5-F7FBF4FBCEF5}", "Windows", "C:\\Users\\cape\\Pictures", "33s@c", "2knownfolder:{4BD8D571-6D19-48D3-BE97-422220080E43}", "2knownfolder:{18989B1D-99B5-455B-841C-AB7C74E4DDFC}", "Root Entry", "desktop-pc01", "2knownfolder:{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" ], "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": "" }, { "name": [ "5f7b5f1e01b83767.automaticDestinations-ms" ], "path": "/opt/CAPEv2/storage/analyses/10/files/07aceb40c46fd8c7c36ff46f79c1063a632588fedc69bdc7e61994a91555eda7", "guest_paths": [ "C:\\Users\\cape\\AppData\\Local\\Temp\\5f7b5f1e01b83767.automaticDestinations-ms" ], "size": 1536, "crc32": "61B9F4E1", "md5": "d92650d094e34e7e4febcef3fb9d0f90", "sha1": "74fba3cd80d506d4b32e3c7d93498013ee8fcf85", "sha256": "07aceb40c46fd8c7c36ff46f79c1063a632588fedc69bdc7e61994a91555eda7", "sha512": "7e8b6e6d4f1e5c6db3cab2bb9f653e86a9966362b504b123185d93b71003ca0ec817230484efc5cb1b27a1a20ab0b35722685e046d244a047a14e7bfc765992b", "rh_hash": null, "ssdeep": "3:YmsalTlLPltl2N81HRQjlORGt7R1t//la1ul2oi5yP//W1XR9//3R9//:rl912N0xs+CFf/lOul15XCB9Xh9X", "type": "Composite Document File V2 Document, Cannot read section info", "yara": [], "cape_yara": [], "clamav": [], "tlsh": "T107319B417124E617C1582E778D01D5C4C7657D10DD14E10B31DA774F0A714E0D824651", "sha3_384": "98919eed19a02334aa8642458183ff779a923c7073b849afc7bd42cf60fef67c4ff6c47b38b9030aaefc28119e5613fb", "yara_hash": "3b285f9d3c197e5b63f2245e549b04ead2ddc38f69551ea601ce08d250fcd6a2", "options_hash": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "data": null, "strings": [ "Root Entry", "DestList" ], "executed_tools": [ "overlay", "msi_extract", "kixtart_extract", "vbe_extract", "batch_extract", "UnAutoIt_extract", "UPX_unpack", "RarSFX_extract", "Inno_extract", "SevenZip_unpack", "de4dot_deobfuscate", "eziriz_deobfuscate", "office_one" ], "cape_type_code": 0, "cape_type": "", "pid": "" } ], "CAPE": { "payloads": [], "configs": [] }, "info": { "version": "2.5", "started": "2026-03-05 19:13:38", "ended": "2026-03-05 19:15:13", "duration": 95, "id": 10, "category": "file", "custom": "", "machine": { "id": 14, "status": "stopping", "name": "win10x64", "label": "win10x64", "platform": "windows", "manager": "KVM", "started_on": "2026-03-05 19:13:38", "shutdown_on": "2026-03-05 19:15:12" }, "package": "", "timeout": false, "tlp": null, "parent_sample": null, "options": {}, "source_url": null, "route": "", "user_id": 0, "CAPE_current_commit": "a9a0887dab232f52c59e955b9984dd494c47ce6b" }, "behavior": { "processes": [ { "process_id": 6764, "process_name": "cmd.exe", "parent_id": 532, "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "first_seen": "2026-03-05 16:14:34,851", "calls": [ { "timestamp": "2026-03-05 16:14:35,851", "thread_id": "5996", "caller": "0x779964d6", "parentcaller": "0x779963e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 0 }, { "timestamp": "2026-03-05 16:14:35,851", "thread_id": "5996", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-03-05 16:14:35,851", "thread_id": "6072", "caller": "0x77981c0e", "parentcaller": "0x7797dbb1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000007c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 3, "id": 2 }, { "timestamp": "2026-03-05 16:14:35,851", "thread_id": "5404", "caller": "0x75c47322", "parentcaller": "0x75c47238", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xf6\\x15\\x06\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xf6\\x15\\x06\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-03-05 16:14:35,851", "thread_id": "5404", "caller": "0x779964d6", "parentcaller": "0x779963e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4 }, { "timestamp": "2026-03-05 16:14:35,851", "thread_id": "5404", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-03-05 16:14:35,867", "thread_id": "6072", "caller": "0x75c47322", "parentcaller": "0x75c47238", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\xae\\x9awH\\xf1\\x01\\x06\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xffP\\xf1\\x01\\x06\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-03-05 16:14:35,867", "thread_id": "6072", "caller": "0x779964d6", "parentcaller": "0x779963e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 7 }, { "timestamp": "2026-03-05 16:14:35,867", "thread_id": "6072", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-03-05 16:14:35,867", "thread_id": "5092", "caller": "0x75c47322", "parentcaller": "0x75c47238", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xf1\\xe1\\x05\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\xc0\\xf1\\xe1\\x05\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-03-05 16:14:35,867", "thread_id": "5092", "caller": "0x779964d6", "parentcaller": "0x779963e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 10 }, { "timestamp": "2026-03-05 16:14:35,867", "thread_id": "5092", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ec09de", "parentcaller": "0x00ec6a0a", "category": "threading", "api": "NtOpenThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x001fffff", "pretty_value": "THREAD_ALL_ACCESS" }, { "name": "ProcessId", "value": "6764" }, { "name": "ThreadId", "value": "18446744073646178303" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ebe2df", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x76070000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ebe2ff", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x76070000" }, { "name": "FunctionName", "value": "SetThreadUILanguage" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x760a4da0" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ebe2c8", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xdc\\xf8\\xaf\\x00\\xa8\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ec0a10", "parentcaller": "0x00ec6a0a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ec0a10", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xfa\\xaf\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\xf8\\xbd\\xb5s\\xc8M\\xbds\\xfc\\x91\\xc8\\x04xZ\\xb8s\\x84\\xfb\\xaf\\x00\\xcc\\xfc\\xaf\\x00\\xf4\\xfa\\xaf\\x00x-\r\\x03\\x9c\\xa8\\x10 x\\xf6\\xaf\\x00l\\x07\\x08S" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ec0a10", "parentcaller": "0x00ec6a0a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000248" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ec0a10", "parentcaller": "0x00ec6a0a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ec0a10", "parentcaller": "0x00ec6a0a", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000248" }, { "name": "ObjectAttributesName", "value": "Software\\Policies\\Microsoft\\Windows\\System" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ec1f20", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xfc\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xd0\\xf4\\xb5s(\\xfc\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00eb8836", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xc8\\xfa\\xaf\\x00\\xa8\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\xb0\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00eb884a", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xc8\\xfa\\xaf\\x00\\xa8\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfe\\xff\\xff\\xff\\xb0\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ebe328", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ebe33f", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xa8\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-03-05 16:14:35,992", "thread_id": "5996", "caller": "0x00ebe3d7", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ebe36e", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xa8\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ebe3a0", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb82d9", "parentcaller": "0x00eb886a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 29 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb82d9", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Command Processor" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb8319", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "DisableUNCCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb8353", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "EnableExtensions" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb83a3", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "DelayedExpansion" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb83dd", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "DefaultColor" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb842d", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "CompletionChar" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb849e", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "PathCompletionChar" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "9" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb852c", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "AutoRun" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb8540", "parentcaller": "0x00eb886a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb82d9", "parentcaller": "0x00eb886a", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 39 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb82d9", "parentcaller": "0x00eb886a", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000248" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Command Processor" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb855a", "parentcaller": "0x00eb886a", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 41 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb8561", "parentcaller": "0x00eb886a", "category": "misc", "api": "srand", "status": true, "return": "0x00000000", "arguments": [ { "name": "seed", "value": "0x69a9abec" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e73000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070a0000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070a0000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070b1000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070c1000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb8d99", "parentcaller": "0x00ec01ce", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e6720", "arguments": [ { "name": "FileName", "value": "C:\\Users" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e6560", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape" }, { "name": "FirstCreateTimeLow", "value": "0xb450bd8e" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcac11" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e62a0", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData" }, { "name": "FirstCreateTimeLow", "value": "0xb45caeb0" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcac11" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e6620", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local" }, { "name": "FirstCreateTimeLow", "value": "0xb45f137b" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcac11" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e6660", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xb45f137b" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcac11" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb8de6", "parentcaller": "0x00ec01ce", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ebaa00", "parentcaller": "0x00ec01ce", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030f9000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ebdcee", "parentcaller": "0x00eb8922", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030fa000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ebdcee", "parentcaller": "0x00eb8922", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030ff000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00ebdcee", "parentcaller": "0x00eb8922", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03104000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb89b1", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00D{\\x9bw\\xb0\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\xb8\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-03-05 16:14:36,007", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "G\\x14+\\x01\\x00\\x00\\x00\\x00Xk\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\xb3x(\\x01\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-03-05 16:14:36,023", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "5996" }, { "name": "Module", "value": "KERNELBASE.dll" }, { "name": "Return Address", "value": "0x75c633ec" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "ru-RU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\ru-RU" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "ru-RU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\ru-RU" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8797", "parentcaller": "0x00eb89c7", "category": "system", "api": "GetUserDefaultLCID", "status": true, "return": "0x00000419", "arguments": [ { "name": "SystemDefaultLangID", "value": "0x00000419" }, { "name": "LanguageName", "value": "Russian" } ], "repeated": 1, "id": 73 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8776", "parentcaller": "0x00eb89c7", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8776", "parentcaller": "0x00eb89c7", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000024c" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8776", "parentcaller": "0x00eb89c7", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8776", "parentcaller": "0x00eb89c7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e60000" }, { "name": "RegionSize", "value": "0x00008000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8776", "parentcaller": "0x00eb89c7", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e60000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8776", "parentcaller": "0x00eb89c7", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070b4000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb89ef", "parentcaller": "0x00ec0a55", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x06\\x00\\x00\\x00<\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00p\\xfa\\xaf\\x00D\\xfb\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\n\\x00\\x00\\x00\\xf0\\x82\\x0f\\x03\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8ac6", "parentcaller": "0x00ec0a55", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x76070000" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8ad7", "parentcaller": "0x00ec0a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x76070000" }, { "name": "FunctionName", "value": "CopyFileExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76089730" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8aed", "parentcaller": "0x00ec0a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x76070000" }, { "name": "FunctionName", "value": "IsDebuggerPresent" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x760920d0" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8afe", "parentcaller": "0x00ec0a55", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x76070000" }, { "name": "FunctionName", "value": "SetConsoleInputExeNameW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75cde190" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb8b1e", "parentcaller": "0x00ec0a55", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e73000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00ebe4f6", "parentcaller": "0x00ec6753", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "cd" }, { "name": "Arguments", "value": " \"C:\\Users\\cape\\AppData\\Local\\Temp\" " } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00ebadbc", "parentcaller": "0x00ebe4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x13\\x00\\x01\\x01\\x80\\xf6\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00*\\x00\\x00\\x00\\x88\\xf6\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00\\xa8\\x00\\x00\\x00`\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070b4000" }, { "name": "RegionSize", "value": "0x0001c000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070d1000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb7ff9", "parentcaller": "0x00ebb158", "category": "misc", "api": "RtlDosPathNameToNtPathName_U", "status": true, "return": "0x00000001", "arguments": [ { "name": "DosFileName", "value": "C:\\" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-03-05 16:14:36,585", "thread_id": "5996", "caller": "0x00eb7ff9", "parentcaller": "0x00ebb158", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "DesiredAccess", "value": "0x00100000", "pretty_value": "SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00eb7ff9", "parentcaller": "0x00ebb158", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000024c" }, { "name": "HandleName", "value": "C:\\" }, { "name": "FileInformationClass", "value": "9", "pretty_value": "FileNameInformation" }, { "name": "FileInformation", "value": "\\x02\\x00\\x00\\x00\\\\x00" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00eb7ff9", "parentcaller": "0x00ebb158", "category": "filesystem", "api": "GetVolumeInformationByHandleW", "status": true, "return": "0x00000001", "arguments": [ { "name": "Handle", "value": "0x0000024c" }, { "name": "VolumeName", "value": "Windows" }, { "name": "VolumeSerial", "value": "0x7c6d8d48" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00eb7ff9", "parentcaller": "0x00ebb158", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070e1000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00eb8d99", "parentcaller": "0x00ed8a0d", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e6320", "arguments": [ { "name": "FileName", "value": "C:\\Users" }, { "name": "FirstCreateTimeLow", "value": "0x3a6eea36" }, { "name": "FirstCreateTimeHigh", "value": "0x01d5acdd" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e6360", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape" }, { "name": "FirstCreateTimeLow", "value": "0xb450bd8e" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcac11" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e68e0", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData" }, { "name": "FirstCreateTimeLow", "value": "0xb45caeb0" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcac11" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e68e0", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local" }, { "name": "FirstCreateTimeLow", "value": "0xb45f137b" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcac11" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec029d", "parentcaller": "0x00eb8dc1", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e62a0", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp" }, { "name": "FirstCreateTimeLow", "value": "0xb45f137b" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcac11" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec02b6", "parentcaller": "0x00eb8dc1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00eb8de6", "parentcaller": "0x00ed8a0d", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00eba9c0", "parentcaller": "0x00ed8a0d", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03106000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00eba9c0", "parentcaller": "0x00ed8a0d", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030f9000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ebaa00", "parentcaller": "0x00ed8a0d", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030f9000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ebe4f6", "parentcaller": "0x00ec6774", "category": "system", "api": "FindFixAndRun", "status": true, "return": "0x00000000", "arguments": [ { "name": "Command", "value": "start" }, { "name": "Arguments", "value": " /wait \"\" \"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ebadbc", "parentcaller": "0x00ebe4f6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x02\\x90\\x04\\x80\\xf6\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00H\\xfb\\xaf\\x00\\x88\\xf6\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x02\\x00\\x00P\\xf6\\xaf\\x00`\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e73000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec744a", "parentcaller": "0x00ec6e48", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070f1000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ebdcee", "parentcaller": "0x00ec5d88", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03119000" }, { "name": "RegionSize", "value": "0x00020000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ebdcee", "parentcaller": "0x00ec5d88", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03106000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec1d40", "parentcaller": "0x00ebf680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec1d4a", "parentcaller": "0x00ebf680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec1d67", "parentcaller": "0x00ebf680", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "12" }, { "name": "ProcessInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ec58c1", "parentcaller": "0x00eb9c30", "category": "filesystem", "api": "FindFirstFileExW", "status": true, "return": "0x030e6920", "arguments": [ { "name": "FileName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "FirstCreateTimeLow", "value": "0x268adba8" }, { "name": "FirstCreateTimeHigh", "value": "0x01dcacbb" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00eb8b81", "parentcaller": "0x00ebf9d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-03-05 16:14:36,601", "thread_id": "5996", "caller": "0x00ebfa3e", "parentcaller": "0x00ec5d88", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070ec000" }, { "name": "RegionSize", "value": "0x00014000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-03-05 16:14:36,710", "thread_id": "5996", "caller": "0x00ec5f10", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtCreateUserProcess", "status": false, "return": "0xffffffffc000012f", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CommandLine", "value": "\"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms " }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-03-05 16:14:36,710", "thread_id": "5996", "caller": "0x00ec5f10", "parentcaller": "0x00ec5a80", "category": "process", "api": "CreateProcessW", "status": false, "return": "0x00000000", "arguments": [ { "name": "ApplicationName", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "CommandLine", "value": "\"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms " }, { "name": "CreationFlags", "value": "0x00080410" }, { "name": "ProcessId", "value": "0" }, { "name": "ThreadId", "value": "0" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-03-05 16:14:36,710", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x0000001e" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-03-05 16:14:36,710", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-03-05 16:14:36,710", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "42" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "5996" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-03-05 16:14:36,710", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-03-05 16:14:36,710", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000250" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000250" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\kernel.appcore.dll" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000254" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74d40000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0000f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74d4c000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74d49000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74d49000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a59000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a59000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74d49000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x74d49000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-03-05 16:14:36,726", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x74d40000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0xffffffffda7afc01", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x74d40000" }, { "name": "InitRoutine", "value": "0x74d447e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x768a7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x768a7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000254" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76c00000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0005f000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76c5a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76c5a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a59000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a59000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76c5a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76c5a000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-03-05 16:14:36,742", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x76c00000" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000025c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000025c" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000025c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000025c" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000230" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000025c" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000230" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "?\\xc7~@4\\xb1\\xdbM\\x15w\\x92\\x98\\xee\\xaca\\xda\\xad\\x7fp4\\xfcAMa\\x0e\\xb4\\x8a G\\x076mx\\xee\\x89\\xff\\xef\\x9d\\x11\\xc8F\\xc3\\xdc\\xfd\\x9c\\xda\\xba?" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x76c00000" }, { "name": "InitRoutine", "value": "0x76c336c0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76991000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76991000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x768a7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x768a7000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x740c0000" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x740c0000" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x740c0000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x740f4330" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 177 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe9\\xaf\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0>\\x0ft\\x95\\x9d-$\\xa8\\xe9\\xaf\\x00\\xe1>\\x0ft" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000264" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000268" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000264" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000268" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb71d", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00edb730", "parentcaller": "0x00ed1e67", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xf0\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xbc\\x12\\x01%\\x80\\xf0\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00eb825c", "parentcaller": "0x00ed1e67", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x98\\xae\r\\x03\\xb0\\xf0\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xb8\\xf0\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-03-05 16:14:36,757", "thread_id": "5996", "caller": "0x00eb8272", "parentcaller": "0x00ed1e67", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x98\\xae\r\\x03\\xb0\\xf0\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xb8\\xf0\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00edb78e", "parentcaller": "0x00ed1e67", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xf0\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\x80\\xf0\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "shell32.dll" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000022c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76c60000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x005b5000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x771b4000" }, { "name": "ModuleName", "value": "shell32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x771ab000" }, { "name": "ModuleName", "value": "shell32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x771ab000" }, { "name": "ModuleName", "value": "shell32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a59000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a59000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x771aa000" }, { "name": "ModuleName", "value": "shell32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x771aa000" }, { "name": "ModuleName", "value": "shell32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00c\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x00p\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x00\\\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-03-05 16:14:36,773", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shell32" }, { "name": "DllBase", "value": "0x76c60000" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0.dll" }, { "name": "ModuleHandle", "value": "0x75b30000" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x75b30000" }, { "name": "FunctionName", "value": "InitializeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77994e10" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x75b30000" }, { "name": "FunctionName", "value": "SleepConditionVariableCS" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x75ce8040" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x75b30000" }, { "name": "FunctionName", "value": "WakeAllConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7799a570" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "advapi32.dll" }, { "name": "ModuleHandle", "value": "0x75ab0000" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75ab0000" }, { "name": "FunctionName", "value": "EventWrite" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77991360" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75ab0000" }, { "name": "FunctionName", "value": "EventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7795e140" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x75ab0000" }, { "name": "FunctionName", "value": "EventUnregister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77989ac0" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x779624f0" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x779a40c0" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x77960780" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7799c2a0" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x779952e0" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "MutexName", "value": "Local\\SM0:6764:168:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 217 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 1, "id": 220 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\shell32" }, { "name": "BaseAddress", "value": "0x76c60000" }, { "name": "InitRoutine", "value": "0x76ddbf80" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00efd000" }, { "name": "ModuleName", "value": "cmd.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-03-05 16:14:36,820", "thread_id": "5996", "caller": "0x00ec67a3", "parentcaller": "0x00ec73e4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00efd000" }, { "name": "ModuleName", "value": "cmd.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-03-05 16:14:36,882", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "5996" }, { "name": "Module", "value": "KERNEL32.DLL" }, { "name": "Return Address", "value": "0x760924ac" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-03-05 16:14:37,398", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\\comctl32" }, { "name": "DllBase", "value": "0x73730000" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-03-05 16:14:37,414", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "__notification__", "api": "sysenter", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "5996" }, { "name": "Module", "value": "KERNEL32.DLL" }, { "name": "Return Address", "value": "0x760924ac" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-03-05 16:14:37,492", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "comctl32.dll" }, { "name": "BaseAddress", "value": "0x73730000" } ], "repeated": 1, "id": 227 }, { "timestamp": "2026-03-05 16:14:37,757", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SHCORE" }, { "name": "DllBase", "value": "0x76190000" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-03-05 16:14:37,820", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Wldp" }, { "name": "DllBase", "value": "0x751c0000" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-03-05 16:14:37,835", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x751f0000" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-03-05 16:14:37,898", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\PROPSYS" }, { "name": "DllBase", "value": "0x73660000" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-03-05 16:14:37,898", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x76070000" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-03-05 16:14:37,914", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77930000" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-03-05 16:14:37,914", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x759e0000" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-03-05 16:14:37,914", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x73660000" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-03-05 16:14:37,929", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-03-05 16:14:37,960", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 4, "id": 237 }, { "timestamp": "2026-03-05 16:14:37,976", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\profapi" }, { "name": "DllBase", "value": "0x74d50000" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-03-05 16:14:38,023", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 12, "id": 239 }, { "timestamp": "2026-03-05 16:14:38,195", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Storage.dll" }, { "name": "BaseAddress", "value": "0x751f0000" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-03-05 16:14:38,195", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0E5AAE11-A475-4C5B-AB00-C66DE400274E" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ADD8BA80-002B-11D0-8F0F-00C04FD7D062" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-03-05 16:14:38,195", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 242 }, { "timestamp": "2026-03-05 16:14:38,195", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-03-05 16:14:38,195", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-03-05 16:14:38,195", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" }, { "name": "BaseAddress", "value": "0x751f0000" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-03-05 16:14:38,210", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "4DF0C730-DF9D-4AE3-9153-AA6B82E9795A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8BE2D872-86AA-4D47-B776-32CCA40C7018" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 19, "id": 247 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c47322", "parentcaller": "0x75c47238", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xef}\\x07\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xef}\\x07\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x779964d6", "parentcaller": "0x779963e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 249 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x7798112f", "parentcaller": "0x7797f0c9", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000003e8" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CFGMGR32.dll" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x779812bc", "parentcaller": "0x77981427", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000003e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f30000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0003b000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x7798009f", "parentcaller": "0x77980824", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f67000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x77980147", "parentcaller": "0x77980824", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f65000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x77980175", "parentcaller": "0x77980824", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f65000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x77991ee8", "parentcaller": "0x77991e71", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a59000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x77991ee8", "parentcaller": "0x77991ea1", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x77a59000" }, { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x77969ddb", "parentcaller": "0x7797b530", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f65000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x7797f149", "parentcaller": "0x779823c8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x77980da0", "parentcaller": "0x7796e523", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75f65000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x77980da0", "parentcaller": "0x7796e523", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x75f30000" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75f3d193", "parentcaller": "0x75f41bb5", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003e8" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\DeviceApi\\CMApi" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x7796007d", "parentcaller": "0x75f38278", "category": "system", "api": "NtQueryLicenseValue", "status": true, "return": "0x00000000", "arguments": [ { "name": "Name", "value": "TerminalServices-RemoteConnectionManager-AllowAppServerMode" }, { "name": "Type", "value": "0x00000004" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x7796007d", "parentcaller": "0x75f38278", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume1\\Windows\\SysWOW64\\cfgmgr32" }, { "name": "BaseAddress", "value": "0x75f30000" }, { "name": "InitRoutine", "value": "0x75f3d450" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x7797ff5f", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75795000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x7797ff94", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75795000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75f3d6f5", "parentcaller": "0x75f3d654", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000003e8" }, { "name": "IoControlCode", "value": "0x00470807" }, { "name": "InBuffer", "value": "$\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xe6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75f3c2c6", "parentcaller": "0x75f3c173", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000003e8" }, { "name": "IoControlCode", "value": "0x00470807" }, { "name": "InBuffer", "value": "$\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x009\\x003\\x004\\x00d\\x008\\x00c\\x00f\\x006\\x00-\\x001\\x007\\x00e\\x00a\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00b\\x006\\x00c\\x008\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c51454", "parentcaller": "0x75335fd0", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000003ec" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000003f0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c427d9", "parentcaller": "0x75c42732", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 270 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c427d9", "parentcaller": "0x75c42732", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "4536", "caller": "0x75c47322", "parentcaller": "0x75c47238", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xf3\\x8d\\x07\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xf3\\x8d\\x07\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "4536", "caller": "0x779964d6", "parentcaller": "0x779963e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 273 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "4536", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "4536", "caller": "0x753910cb", "parentcaller": "0x77999570", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "\\\\?\\STORAGE#Volume#{934d8cf6-17ea-11f1-b6c8-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{c48439d1-0000-0000-0000-100000000000}\\" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c4269a", "parentcaller": "0x7533601c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c36ff1", "parentcaller": "0x75c36e4c", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 277 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003ec" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000248" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003ec" }, { "name": "ObjectAttributesName", "value": "{c48439d1-0000-0000-0000-100000000000}\\" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c37f8b", "parentcaller": "0x75334ebc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Data" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Data" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c36c2e", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "ValueName", "value": "Data" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00H\\x8dm|\\x1f\\x00\\x00\\x00\\x04@\\x00\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x009\\x003\\x004\\x00d\\x008\\x00c\\x00f\\x006\\x00-\\x001\\x007\\x00e\\x00a\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00b\\x006\\x00c\\x008\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Data" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c37f8b", "parentcaller": "0x75334ef4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c36ff1", "parentcaller": "0x75c36e4c", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 284 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000248" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003ec" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003f4" }, { "name": "ObjectAttributesName", "value": "{c48439d1-0000-0000-0000-100000000000}\\" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c37f8b", "parentcaller": "0x75334ebc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f4" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003ec" }, { "name": "ValueName", "value": "Generation" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Generation" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c37f8b", "parentcaller": "0x75334ef4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c41999", "parentcaller": "0x75c416ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003ec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c408e0", "parentcaller": "0x75c493b6", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x000003ec" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00c\\x004\\x008\\x004\\x003\\x009\\x00d\\x001\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c408e0", "parentcaller": "0x75c493b6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003ec" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00c\\x004\\x008\\x004\\x003\\x009\\x00d\\x001\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c4269a", "parentcaller": "0x75c4941a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c41999", "parentcaller": "0x75c416ce", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003ec" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c408e0", "parentcaller": "0x75c493b6", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "FileHandle", "value": "0x000003ec" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00c\\x004\\x008\\x004\\x003\\x009\\x00d\\x001\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c408e0", "parentcaller": "0x75c493b6", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000003ec" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00c\\x004\\x008\\x004\\x003\\x009\\x00d\\x001\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c4269a", "parentcaller": "0x75c4941a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c43cc4", "parentcaller": "0x75357f12", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000003ec" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c41446", "parentcaller": "0x75357fda", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "8,\\x13\\x03`\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "6996", "caller": "0x75c4269a", "parentcaller": "0x75357f2b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-03-05 16:14:38,273", "thread_id": "4536", "caller": "0x75c4269a", "parentcaller": "0x753564ad", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-03-05 16:14:38,335", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 3, "id": 302 }, { "timestamp": "2026-03-05 16:14:38,476", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\edputil" }, { "name": "DllBase", "value": "0x73cd0000" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-03-05 16:14:38,476", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-03-05 16:14:38,492", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000040c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7678d700" }, { "name": "Parameter", "value": "0x0312f350" }, { "name": "CreateFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "7144" }, { "name": "ProcessId", "value": "6764" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-03-05 16:14:38,492", "thread_id": "4536", "caller": "0x75c51454", "parentcaller": "0x7691b5fa", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000414" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-03-05 16:14:38,492", "thread_id": "6996", "caller": "0x75c51454", "parentcaller": "0x7691b5fa", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000420" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-03-05 16:14:38,492", "thread_id": "6996", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0313e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-03-05 16:14:38,492", "thread_id": "7144", "caller": "0x75c47322", "parentcaller": "0x75c47238", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf0\\x9d\\x07\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xf0\\x9d\\x07\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-03-05 16:14:38,492", "thread_id": "7144", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03140000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-03-05 16:14:38,492", "thread_id": "7144", "caller": "0x779964d6", "parentcaller": "0x779963e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 311 }, { "timestamp": "2026-03-05 16:14:38,492", "thread_id": "7144", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000043c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x761ac6e0" }, { "name": "Parameter", "value": "0x070ee558" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "612" }, { "name": "ProcessId", "value": "6764" }, { "name": "Module", "value": "SHCORE.dll" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c47322", "parentcaller": "0x75c47238", "category": "device", "api": "NtDeviceIoControlFile", "status": false, "return": "0xffffffffc00700bb", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf4\\xad\\x07\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xf4\\xad\\x07\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x779964d6", "parentcaller": "0x779963e1", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 315 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x00000000" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c565db", "parentcaller": "0x761de575", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x80\\x80\\x00l\\x1a\\x00\\x00d\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "612" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7797ff5f", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73714000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7797ff94", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73714000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7797ff5f", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73714000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7797ff94", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x73714000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03141000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7678795a", "parentcaller": "0x76785198", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7678795a", "parentcaller": "0x767333c9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000044c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "ActivatableClassId" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7677f5a0", "parentcaller": "0x76733409", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000044c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.FileTypeAssociation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7677f650", "parentcaller": "0x7677f5fb", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00h\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00F\\x00i\\x00l\\x00e\\x00T\\x00y\\x00p\\x00e\\x00A\\x00s\\x00s\\x00o\\x00c\\x00i\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x01\\x00\\x00\\x00\\xffae^\\xff97w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x7f\\x10\\x03\\xff80\\x7f\\x10\\x03\\xff90\\xfff4\\x12\\x03\\xff80\\x7f\\x10\\x03\\xffb8\\xfff2\\xffad\\x07\\xffe4\\xffc1\\xff96s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\xffa1\\x12'Zyxv\\x00\\x00\\x00\\x00\\xff98Qxv;\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\x00\\x00\\xffae\\x07\\x00\\x00\\x00\\x00\\xffe8\\xfff2\\xffad\\x07\\xffe4\\xffc1\\xff96s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00L\\xffa1\\x12'Zyxv\\x00\\x00\\x00\\x00\\xffc93sv=\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\x00\\x00\\xffae\\x07\\x00\\x00\\x00\\x00\\xffb0\\xfff2\\xffad\\x07\\xffbf\\xffa0\\xff96s\\xff8c\\xfffd\\xffad\\x07Zyxv8,\\xffb8s\\xffc93sv(\\xfff3\\xffad\\x076\\xffa7\\xff96s$\\xff99\\xffb5s\\xffb4\\xffa0\\x12'P\\xffee\\xffad\\x078,\\xffb8s\\xff8c\\xfffd\\xffad\\x07\\xffd0\\xffa9\\xffabs\\x1c\\x05\\x08S\\xfffe\\xffff\\xffff\\xfffft\\xfff3\\xffad\\x07\\xffdf)\\xff98s\\x1e\\x00\\x00\\x00X\\x1e\\xffb6sP$\\xffb6s\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00I$\\xffb6sl#\\xffb6s\\x18\\xffa7\\x12\\x03\\xffc8\\xffda\\xffb5s\\x19\\x01\\x02\\x00\\x14$\\xffb6sH\\x04\\x00\\x00\\xfffc#\\xffb6s\\xffc4\\xfff3\\xffad\\x07\\xfff4\\xff83P#\\xffa0r\\x13\\x03H\\x04\\x00\\x00\\x18\\xffa7\\x12\\x03\\x18\\xffa7\\x00\\x00P\\xfff3\\xffad\\x07\\xffa0r\\x13\\x03\\xff8c\\xfffd\\xffad\\x07\\x00\\xffae\\xff9aw\\xff80\\xffba^S\\xfffe\\xffff\\xffff\\xffff\\xffa8\\xfff3\\xffad\\x07ayxv\\x00\\x00\\x00\\x00H\\x04\\x00\\x000\\xfff5\\x12\\x03\\x18\\x00\\x00\\x00H\\x04\\x00\\x00\\xffc4\\xfff3\\xffad\\x07@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffdc\\xfff3\\xffad\\x07\\xffc93sv\\x19\\x01\\x02\\x00\\x18\\xffa7\\x12\\x03\\xffe0Pxv\\x10\\xffa7\\x12\\x03\\xff98\\xfff4\\x12\\x03\\xffd8\\xfff3\\xffad\\x07\\x0f\\xfff3yv0\\xfff5\\x12\\x03\\xfff0\\xfff3\\xffad\\x07\\x10\\xffa7\\x12\\x03\\xfff4\\xfff3\\xffad\\x07-QxvL\\x04\\x00\\x00\\x00\\xffa7\\x12\\x03" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "Server" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000450" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36ff1", "parentcaller": "0x75c36e4c", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 339 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000118" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7678795a", "parentcaller": "0x767333c9", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000454" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "Server" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7677f5a0", "parentcaller": "0x76733409", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7677f650", "parentcaller": "0x7677f5fb", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x11\\x03\\xffb8\\xfff1\\x12\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00}\\x00\\xffcc\\x01}\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x0c\n}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x08\n}\\x00\\x00\\x00\\xffae\\x07L\\xffef\\xffad\\x07\\xffae^\\xff97w\\x01\\x00\\x00\\x00\\xffae^\\xff97w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`y\\x13\\x03`y\\x13\\x03\\xffc8\\xfff3\\x12\\x03`y\\x13\\x03\\xffedB\\xff81v\\xffe4\\xfff0\\xffad\\x07\\x10-sv\\xffa0\\xffa7\\x12\\x03\\xffe0 sv\\xffb8]\\x11\\x03\\xff851sv\\xffd0\\xffef\\xffad\\x07\\x7f/\\xff98s\\xffb8]\\x11\\x03\\x01\\x00\\x00\\x00i\\xffa7\\xff94s\\xffc8\\xffef\\xffad\\x07\\xffe4\\xffc1\\xff96s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\xffbc\\x12'Zyxv\\x00\\x00\\x00\\x00\\xffc93sv8\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\x00\\x00\\xffae\\x07\\x00\\x00\\x00\\x00\\xff90\\xffef\\xffad\\x07\\xffbf\\xffa0\\xff96s\\xff8c\\xfffd\\xffad\\x07Zyxv8,\\xffb8s\\xffc93sv\\x08\\xfff0\\xffad\\x076\\xffa7\\xff96s$\\xff99\\xffb5sT\\xffbc\\x12'0\\xffeb\\xffad\\x078,\\xffb8s\\xff8c\\xfffd\\xffad\\x07\\xffd0\\xffa9\\xffabs\\x1c\\x05\\x08S\\xfffe\\xffff\\xffff\\xffffT\\xfff0\\xffad\\x07\\xffdf)\\xff98s\\x1e\\x00\\x00\\x00X\\x1e\\xffb6sP$\\xffb6s\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00I$\\xffb6sl#\\xffb6s\\xffa8\\xffa7\\x12\\x03\\xffc8\\xffda\\xffb5s\\x19\\x01\\x02\\x00\\x14$\\xffb6sH\\x04\\x00\\x00\\xfffc#\\xffb6s\\xffa8\\xfff0\\xffad\\x07\\xffd4\\xff80P#P\\xffa6\\x12\\x03H\\x04\\x00\\x00\\xffa8\\xffa7\\x12\\x03\\xffa8\\xffa7\\x00\\x000\\xfff0\\xffad\\x07P\\xffa6\\x12\\x03\\xff8c\\xfffd\\xffad\\x07\\x00\\xffae\\xff9aw\\xff80\\xffba^S\\xfffe\\xffff\\xffff\\xffff\\xff8c\\xfff0\\xffad\\x07ayxv\\x00\\x00\\x00\\x00H\\x04\\x00\\x00\\x00\\x00}\\x00\\x18\\x00\\x00\\x00H\\x04\\x00\\x00\\xffa8\\xfff0\\xffad\\x07@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x0c}\\x00\\xffc0\\xfff0\\xffad\\x07\\xffc93sv\\x19\\x01\\x02\\x00\\xffa8\\xffa7\\x12\\x03\\xffe0Pxv\\xffa0\\xffa7\\x12\\x03\\xffd0\\xfff3\\x12\\x03\\xffbc\\xfff0\\xffad\\x07\\x0f\\xfff3yv\\xffec\\x07\\xff8av\\xffd4\\xfff0\\xffad\\x07\\xffa0\\xffa7\\x12\\x03\\xffd8\\xfff0\\xffad\\x07-QxvT\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 1, "id": 347 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36c2e", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Identity" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x7672d718", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x7672d718", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7677f5a0", "parentcaller": "0x76733409", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000044c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.FileTypeAssociation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7677f650", "parentcaller": "0x7677f5fb", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00h\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00F\\x00i\\x00l\\x00e\\x00T\\x00y\\x00p\\x00e\\x00A\\x00s\\x00s\\x00o\\x00c\\x00i\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x01\\x00\\x00\\x00\\xffae^\\xff97w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xff80\\x10\\x03\\xffa0\\xff80\\x10\\x03\\xfff0\r{v\\x10\\xfff3\\xffad\\x07\\xffb1,sv\\x02\\x00\\x00\\x00\\x10-svL\\x08\\xff8av\\xffe0 sv\\xffb8]\\x11\\x03\\xff851sv\\x01\\x00\\x00\\x00\r\\x00\\x00\\x00\\xffb8]\\x11\\x03\\x01\\x00\\x00\\x00`M\\x0f\\x03\\x04Q\\x0f\\x03L\\x08\\xff8avbWrv\\x00s\\x13\\x03\\x1e\\x00\\xff8av\\xffcc]\\x11\\x03\\xffa0D\\x13\\x03\\xffa0S\\x11\\x03\\xffc0TrvD\\x00\\xff8avAYrv\\x00\\x00\\x00\\x00\\xffa0\\xff80\\x10\\x03\\x08\\xffeb\\xff89v\\xffe0 svD\\x00\\xff8av\\x00\\x00\\x00\\x00\\xfffc\\xffc9hv\\x00s\\x13\\x03 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc3m\\xff81\\x00\\x1e\\x00\\xff8av\r\\xffc1\\xff95\\x12\\x00\\x00\\x00\\x00D{\\xff9bw@\\xffa7\\x12\\x03 \\x00\\x00\\x00%\\x00$\\x00 \\x00\\x00\\x00\\x15\\x00\\x02\\x00\\xffc8\\xfff2\\xffad\\x07\\xffac\\\\x11\\x03\\xff88\\xfff2\\x12\\x03Oc\\xff97w\r\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00/\\x00\\x0e\\x00@\\x00\\x00\\x00\\xffd0\\x07}\\x00P\\x00\\x00\\x00\\xffd0\\x07}\\x00d\\x00\\x00\\x00 \\x00\\x00\\x00P\\x00\\x00\\x00pJ\\x11\\x03\\xffa8\r\r\\x03\\xffa0S\\x11\\x03\\xffa0S\\x11\\x03\\x00\\x00\\x00\\x00\\xffa0\\xff80\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00}\\x00\\xffe0\\x01}\\x00\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\x14\\x0c}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x10\\x0c}\\x00\\xffae^\\xff97w\\xffe4\\xfff2\\xffad\\x07\\xffae^\\xff97w\\xffa0S\\x11\\x03\\xffae^\\xff97w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xff80\\x10\\x03\\xffa0S\\x11\\x03H\\xfff3\\xffad\\x07\\xffb8]\\x11\\x03\\xffa0\\xff80\\x10\\x03\\x18\\xfff3\\xffad\\x070\\xffc3rv\\xffd0]\\x11\\x03" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "Server" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000450" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000450" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7677f5a0", "parentcaller": "0x76733409", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x7677f650", "parentcaller": "0x7677f5fb", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x11\\x03\\xffb8\\xfff1\\x12\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00}\\x00\\xffcc\\x01}\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x0c\n}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x08\n}\\x00\\x00\\x00\\xffae\\x07\\\\xffee\\xffad\\x07\\xffae^\\xff97w\\x01\\x00\\x00\\x00\\xffae^\\xff97w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08t\\x13\\x03\\x08t\\x13\\x03\\x14\\xfff1\\xffcb\\x04\\xfff4\\xffef\\xffad\\x07\\xffb1,sv\\x02\\x00\\x00\\x00\\x10-svL\\x07\\xff8av\\xffe0 svh]\\x11\\x03\\xff851sv\\xffe0\\xffee\\xffad\\x07\\x7f/\\xff98sh]\\x11\\x03\\x01\\x00\\x00\\x00L%\\xffb6s\\x00\\x00\\x00\\x00L\\x07\\xff8av_%\\xffb6s\\xffe4\\xffee\\xffad\\x07\\xffe4\\xffc1\\xff96s|]\\x11\\x03\\x00\\x00\\x00\\x00\\xffa0X\\x11\\x03cj\\xffc3u\\x00\\x00\\x00\\x00Sh\\xffc3u \\x00\\x00\\x00\\x08t\\x13\\x03\\x08\\xffeb\\xff89v\\xffe0 svX\\xffef\\xffad\\x07Oc\\xff97wO\\x00\\x00\\x00 \\x00\\x00\\x00<\\xfff0\\xffad\\x07\\x00\\x00\r\\x03$\\xffef\\xffad\\x07\\x14\\xfff1\\xffcb\\x04\\xffa0\\xffef\\xffad\\x07\\xffa8\\xffbc\\x12' \\x00\\x00\\x00\\x02\\x00\\x00\\x00@\\x00\\x00\\x00\\xffd0\\x07}\\x00 \\x00\\x00\\x00\\x14\\x00\\x03\\x00\\xffa8\\xffef\\xffad\\x07\\xffac\\\\x11\\x03\\xff80\\xfff5\\x12\\x03Oc\\xff97w\\x1d\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00}\\x00\\xffd8\\x01}\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00P\\x00\\x00\\x00\\xffd0\\x07}\\x00d\\x00\\x00\\x00ht\\x13\\x03P\\x00\\x00\\x00t\\xffef\\xffad\\x07\\xffa8\r\r\\x03\\xffa0X\\x11\\x03\\xffa0X\\x11\\x03\\x00\\x00\\x00\\x00\\x08t\\x13\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00}\\x00\\xffe0\\x01}\\x00\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\x14\\x0c}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x10\\x0c}\\x00\\xffb8X\\x11\\x03h]\\x11\\x03\\xffc0\\xffef\\xffad\\x07d\\xfffarv\\xff80]\\x11\\x03\\x00\\x00\\x00\\x00h]\\x11\\x03\\xffa0X\\x11\\x03h]\\x11\\x03\\xffe8\\xffef\\xffad\\x07+\\xv\\xffa0\\xff8f\\x12\\x03\\xffcc\\xffc2fv\\xffa0X\\x11\\x03\\xffe0[xv" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 1, "id": 377 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36c2e", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-03-05 16:14:38,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "Identity" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000458" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000458" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x7672d718", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000458" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x7672d718", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000450" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c51454", "parentcaller": "0x7691b5fa", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000458" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03142000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x7690c752", "parentcaller": "0x7690c6e6", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 390 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c4074f", "parentcaller": "0x7671cd1e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x7671cd30", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7671d500" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x7671cd41", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x767472f0" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x7671cd52", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76745d80" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x7671cd63", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7671db30" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03144000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c51454", "parentcaller": "0x76753f33", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000464" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c5c6fe", "parentcaller": "0x75c45f8b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x062c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c41137", "parentcaller": "0x75c5d521", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c457c5", "parentcaller": "0x75c45b43", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 400 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c427d9", "parentcaller": "0x75c45736", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c5c6fe", "parentcaller": "0x75c458a4", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x07ae0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c45900", "parentcaller": "0x75c458e0", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000468" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x767895e5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x767472f0" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x76789603", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76745d80" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x76789621", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x766cb480" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x7678963b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x76767f90" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x76789655", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x767683b0" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x7678966f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7673e550" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x76789689", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x76660000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7671db30" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x76789494", "parentcaller": "0x779610df", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x76746517", "parentcaller": "0x7674dbf3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000326" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000326" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000326" }, { "name": "ObjectAttributesName", "value": "Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe8\\xdc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00t\\xdd$\\xdd\\x18\\xddn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xc0\\xdf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xdc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00L\\xdd\\xfc\\xdc\\xf0\\xdcr\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x98\\xdf\\xad\\x07\\xdct\\xc3ur\\x04\\x00\\x00" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x76714ee5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x76714ef1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002fe" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xd1\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xec\\xd1\\x9c\\xd1\\x90\\xd1n\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x008\\xd4\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x766f4e60", "parentcaller": "0x766f4e10", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 1, "id": 438 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xd0\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd0\\x84\\xd0x\\xd0n\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02 \\xd3\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd0\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd0\\\\xd0P\\xd0n\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xd2\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xd0\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xd0\\\\xd0P\\xd0n\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xd2\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xd0\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00<\\xd1\\xec\\xd0\\xe0\\xd0n\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x88\\xd3\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc8\\xcf\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00T\\xd0\\x04\\xd0\\xf8\\xcfr\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa0\\xd2\\xad\\x07\\xdct\\xc3ur\\x04\\x00\\x00" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcf\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00|\\xd0,\\xd0 \\xd0r\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xc8\\xd2\\xad\\x07\\xdct\\xc3ur\\x04\\x00\\x00" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcf\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00|\\xd0,\\xd0 \\xd0r\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xc8\\xd2\\xad\\x07\\xdct\\xc3ur\\x04\\x00\\x00" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa8\\xcf\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xd0\\xe4\\xcf\\xd8\\xcfr\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x80\\xd2\\xad\\x07\\xdct\\xc3ur\\x04\\x00\\x00" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x766f2ce5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xd0\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd0\\x84\\xd0x\\xd0n\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\xd3\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "H\\xd0\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xd4\\xd0\\x84\\xd0x\\xd0n\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\xd3\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x766f4c0c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002fe" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-03-05 16:14:38,554", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xcd\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00<\\xce\\xec\\xcd\\xe0\\xcdn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x88\\xd0\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x766f4e60", "parentcaller": "0x766f4e10", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 1, "id": 499 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xcd\\xd4\\xcc\\xc8\\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xcf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xcc\\xac\\xcc\\xa0\\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xcf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xcc\\xac\\xcc\\xa0\\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xcf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xcd\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x8c\\xcd<\\xcd0\\xcdn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\xd8\\xcf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x18\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xa4\\xccT\\xccH\\xccv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf0\\xce\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xcc|\\xccp\\xccv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x18\\xcf\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xcc\\xcc|\\xccp\\xccv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x18\\xcf\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf8\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x84\\xcc4\\xcc(\\xccv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xd0\\xce\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x766f2ce5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000476" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xcd\\xd4\\xcc\\xc8\\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\xcf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xcd\\xd4\\xcc\\xc8\\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\xcf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x766f4c0c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002fe" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x08\\xcd\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x94\\xcdD\\xcd8\\xcdn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0\\xcf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x766f4e60", "parentcaller": "0x766f4e10", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 1, "id": 560 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00|\\xcc,\\xcc \\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xc8\\xce\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc8\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00T\\xcc\\x04\\xcc\\xf8\\xcbn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa0\\xce\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc8\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00T\\xcc\\x04\\xcc\\xf8\\xcbn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xa0\\xce\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xe4\\xcc\\x94\\xcc\\x88\\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x000\\xcf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xfc\\xcb\\xac\\xcb\\xa0\\xcbv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02H\\xce\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xcc\\xd4\\xcb\\xc8\\xcbv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xce\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x98\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00$\\xcc\\xd4\\xcb\\xc8\\xcbv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02p\\xce\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xdc\\xcb\\x8c\\xcb\\x80\\xcbv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02(\\xce\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x766f2ce5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000476" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00|\\xcc,\\xcc \\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xc8\\xce\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00|\\xcc,\\xcc \\xccn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xc8\\xce\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00,\\xcc\\xdc\\xcb\\xd0\\xcbn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00x\\xce\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xac\\xcb\\\\xcbP\\xcbn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xf8\\xcd\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xcb\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xe4\\xcb\\x94\\xcb\\x88\\xcbn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x000\\xce\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fe" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000002fe" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000474" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000476" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "X\\xcc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xe4\\xcc\\x94\\xcc\\x88\\xccv\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x000\\xcf\\xad\\x07\\xdct\\xc3uv\\x04\\x00\\x00" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000476" }, { "name": "ObjectAttributesName", "value": "Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x7677b464", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000476" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x766f4c0c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000326" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000326" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000326" }, { "name": "ObjectAttributesName", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x88\\xda\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x14\\xdb\\xc4\\xda\\xb8\\xdan\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00`\\xdd\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x76716c98", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c427d9", "parentcaller": "0x75c42732", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 647 }, { "timestamp": "2026-03-05 16:14:38,570", "thread_id": "612", "caller": "0x75c427d9", "parentcaller": "0x75c42732", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c41d96", "parentcaller": "0x76726166", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x735c0000" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c41d96", "parentcaller": "0x76726166", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\Windows.StateRepositoryPS.dll" }, { "name": "BaseAddress", "value": "0x735c0000" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x76726104", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x735c0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7363c840" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x76726116", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x735c0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c496ea", "parentcaller": "0x76726133", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x735c0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7363c820" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000326" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000326" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000326" }, { "name": "ObjectAttributesName", "value": "Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa8\\xdc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x004\\xdd\\xe4\\xdc\\xd8\\xdcn\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x80\\xdf\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000478" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047a" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xdc\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x0c\\xdd\\xbc\\xdc\\xb0\\xdcz\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02X\\xdf\\xad\\x07\\xdct\\xc3uz\\x04\\x00\\x00" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047a" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x76714ee5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047a" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x76714ef1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x76739f95", "parentcaller": "0x76739e12", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 670 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x779862aa", "parentcaller": "0x75c5ab19", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x779862d1", "parentcaller": "0x75c5ab19", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000478" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x7690c752", "parentcaller": "0x7690c6e6", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 673 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x7797ff5f", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76991000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x7797ff94", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x76991000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x7690cb9a", "parentcaller": "0x7690c722", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 676 }, { "timestamp": "2026-03-05 16:14:38,585", "thread_id": "612", "caller": "0x77997aa9", "parentcaller": "0x7690ea37", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000326" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000326" }, { "name": "KeyInformation", "value": "\\x01\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000326" }, { "name": "ObjectAttributesName", "value": "Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c2c23e", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000046e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "8\\xe4\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\xc4\\xe4t\\xe4h\\xe4n\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x19\\x00\\x02\\x00\\x10\\xe7\\xad\\x07\\xdct\\xc3un\\x04\\x00\\x00" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c37688", "parentcaller": "0x75c2c25b", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000046e" }, { "name": "ObjectAttributesName", "value": "ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c3785b", "parentcaller": "0x75c33823", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c374dc", "parentcaller": "0x75c33859", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "KeyInformation", "value": "\\x01\\x04\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x77983999", "parentcaller": "0x75c37724", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x10\\xe4\\xad\\x07\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xcc\\x04\\x82\\xdf\\xb2e\\xf3\\xf4\\xc8\\x97L\\xbe\\xe8\\x03\\x00\\x00\\x07\\x00\\x00\\x00\\x07\\x00\\x9c\\xe4L\\xe4@\\xe4~\\x04\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xe8\\xe6\\xad\\x07\\xdct\\xc3u~\\x04\\x00\\x00" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c37575", "parentcaller": "0x75c33859", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3749840076-4109591986-3192690632-1000_Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000047e" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x76714ee5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x76714ef1", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046e" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c427d9", "parentcaller": "0x75c42732", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 694 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c427d9", "parentcaller": "0x75c42732", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x75c565db", "parentcaller": "0x761ad09f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x80\\x80\\x00l\\x1a\\x00\\x00d\\x02\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "612" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x7797ff5f", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7620c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-03-05 16:14:38,601", "thread_id": "612", "caller": "0x7797ff94", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7620c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-03-05 16:14:38,617", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.UI.AppDefaults.dll" }, { "name": "BaseAddress", "value": "0x00000000" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-03-05 16:14:38,695", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\iertutil" }, { "name": "DllBase", "value": "0x731e0000" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-03-05 16:14:38,695", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\srvcli" }, { "name": "DllBase", "value": "0x73cb0000" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-03-05 16:14:38,695", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\netutils" }, { "name": "DllBase", "value": "0x74f30000" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-03-05 16:14:38,695", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\urlmon" }, { "name": "DllBase", "value": "0x73410000" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-03-05 16:14:38,710", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "user32.dll" }, { "name": "BaseAddress", "value": "0x769c0000" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-03-05 16:14:38,726", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\urlmon.dll" }, { "name": "BaseAddress", "value": "0x73410000" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-03-05 16:14:38,757", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-03-05 16:14:38,773", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "API-MS-WIN-CORE-URL-L1-1-0.DLL" }, { "name": "BaseAddress", "value": "0x75b30000" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-03-05 16:14:38,773", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 708 }, { "timestamp": "2026-03-05 16:14:38,804", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x76c60000" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-03-05 16:14:38,804", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\apphelp" }, { "name": "DllBase", "value": "0x74ba0000" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-03-05 16:14:38,804", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x77930000" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-03-05 16:14:38,804", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 712 }, { "timestamp": "2026-03-05 16:14:39,007", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-03-05 16:14:39,023", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x72e20000" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-03-05 16:14:39,039", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x72e20000" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-03-05 16:14:39,085", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "E44E9428-BDBC-4987-A099-40DC8FD255E7" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "7F9185B0-CB92-43C5-80A9-92277A4F7B54" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-03-05 16:14:39,085", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 717 }, { "timestamp": "2026-03-05 16:14:39,101", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wintypes" }, { "name": "DllBase", "value": "0x72d40000" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-03-05 16:14:39,101", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\WinTypes.dll" }, { "name": "BaseAddress", "value": "0x72d40000" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-03-05 16:14:39,101", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F1C46D71-B791-4110-8D5C-7108F22C1010" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "8A43ED9F-F4E6-4421-ACF9-1DAB2986820C" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-03-05 16:14:39,101", "thread_id": "5996", "caller": "0x00edbab1", "parentcaller": "0x00edb7b9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "BaseAddress", "value": "0x72d40000" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-03-05 16:14:39,117", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "CDC82860-468D-4D4E-B7E7-C298FF23AB2C" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "5632B1A4-E38A-400A-928A-D4CD63230295" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-03-05 16:14:39,117", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\oleaut32.dll" }, { "name": "BaseAddress", "value": "0x76b60000" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-03-05 16:14:39,382", "thread_id": "4536", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x0314f000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-03-05 16:14:39,382", "thread_id": "4536", "caller": "0x7676693d", "parentcaller": "0x767a08c6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000502ce" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 1, "id": 725 }, { "timestamp": "2026-03-05 16:14:39,992", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x73c70000" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-03-05 16:14:39,992", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\OneCoreCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x73c70000" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-03-05 16:14:40,007", "thread_id": "4536", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03151000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-03-05 16:14:40,007", "thread_id": "4536", "caller": "0x7676693d", "parentcaller": "0x767a08c6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000502ce" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-03-05 16:14:40,070", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ActXPrxy" }, { "name": "DllBase", "value": "0x72cf0000" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-03-05 16:14:40,085", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\actxprxy.dll" }, { "name": "BaseAddress", "value": "0x72cf0000" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-03-05 16:14:40,148", "thread_id": "4536", "caller": "0x7676693d", "parentcaller": "0x767a08c6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000502ce" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 17, "id": 732 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 733 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x7797ff5f", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7620c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x7797ff94", "parentcaller": "0x7797fe54", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7620c000" }, { "name": "ModuleName", "value": "SHCORE.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c565db", "parentcaller": "0x761de575", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x80\\x80\\x00l\\x1a\\x00\\x00d\\x02\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "612" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x7677f5a0", "parentcaller": "0x76733409", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x0000044c" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.FileTypeAssociation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x7677f650", "parentcaller": "0x7677f5fb", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "KeyInformation", "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00h\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00F\\x00i\\x00l\\x00e\\x00T\\x00y\\x00p\\x00e\\x00A\\x00s\\x00s\\x00o\\x00c\\x00i\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x01\\x00\\x00\\x00\\xffae^\\xff97w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff84\\x10\\x03\\xff90\\xff84\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\xfff4\\xffad\\x07\\xffb1,sv\\x02\\x00\\x00\\x00\\x10-svL\\x08\\xff8av\\xffe0 svX\\x17\\x15\\x03\\xff851sv\\x00\\x10\\x00\\x005\\x00\\x00\\x00X\\x17\\x15\\x03\\x01\\x00\\x00\\x00 \\x19\\xffb6sw\\x00s\\x00L\\x08\\xff8av\\x00\\x00\\x00\\x00d\\xfff7\\xffad\\x07W\\x006sl\\x17\\x15\\x03\\xff80\\xff84P#`P\\x11\\x03\\x00\\x00\r\\x03\nQ\\xff97w\\xff90\\xff84P#`4\\x14\\x03\\xff90\\xff84\\x10\\x03\\x08\\xffeb\\xff89v\\xffe0 sv\\xffbb6uv\\xff89\\x02\\x00\\xff8b \\x00\\x00\\x00\\x02\\x00\\x00\\x02\\xff88\\xfff3\\xffad\\x07\\xff89\\x02\\x00\\xff8b\\xff80\\xfff3\\xffad\\x07Oc\\xff97wL\\x00\\x00\\x00C\\x00\\x01B\\x02\\x00\\x00\\x00\\x00\\x00\\xff90\\x04 \\x00\\x00\\x00\\x07\\x00\\x02\\x00 \\x00\\x00\\x000\\x00\\x1e\\x00\\xffb8\\xfff3\\xffad\\x07\\xffcc\\x13\\x15\\x03H\\x0c\\x15\\x03Oc\\xff97w,\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x08\\x00!\\x00@\\x00\\x00\\x00\\xffd0\\x07}\\x00P\\x00\\x00\\x00\\xffd0\\x07}\\x00d\\x00\\x00\\x00 \\x00\\x00\\x00P\\x00\\x00\\x00pJ\\x11\\x03\\xffc0\\xffb2\\x13\\x03`P\\x11\\x03`P\\x11\\x03\\x00\\x00\\x00\\x00\\xff90\\xff84\\x10\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00}\\x00\\xffe0\\x01}\\x00\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\x14\\x0c}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x10\\x0c}\\x00\\xffae^\\xff97w\\xffd4\\xfff3\\xffad\\x07\\xffae^\\xff97w`P\\x11\\x03\\xffae^\\xff97w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff84\\x10\\x03`P\\x11\\x038\\xfff4\\xffad\\x07X\\x17\\x15\\x03\\xff90\\xff84\\x10\\x03\\x08\\xfff4\\xffad\\x070\\xffc3rvp\\x17\\x15\\x03" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "Server" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000530" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000530" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-03-05 16:14:40,523", "thread_id": "612", "caller": "0x7677f5a0", "parentcaller": "0x76733409", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000454" }, { "name": "ObjectAttributesName", "value": "StateRepository" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x7677f650", "parentcaller": "0x7677f5fb", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "KeyInformation", "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x11\\x03\\xffd8\\x05\\x15\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00}\\x00\\xffcc\\x01}\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x0c\n}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x08\n}\\x00\\xffb8\\xfff0\\x12\\x03L\\xffef\\xffad\\x07\\xffae^\\xff97w\\x01\\x00\\x00\\x00\\xffae^\\xff97w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x|\\x13\\x03x|\\x13\\x03\\xff89\\x02\\x00\\xff8b\\xffe4\\xfff0\\xffad\\x07\\xffb1,sv\\x02\\x00\\x00\\x00\\x10-svL\\x07\\xff8av\\xffe0 sv\\xffc8\\x1a\\x15\\x03\\xff851sv\\xffd0\\xffef\\xffad\\x07\\x7f/\\xff98s\\xffc8\\x1a\\x15\\x03\\x01\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\xff96\\xfffd\\xffff\\xffffL\\x07\\xff8av_%\\xffb6s\\xffd4\\xffef\\xffad\\x07\\xffe4\\xffc1\\xff96s\\xffdc\\x1a\\x15\\x03\\x00\\x00\\x00\\x00\\xffa0P\\x11\\x03\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00 \\x00\\x00\\x00x|\\x13\\x03\\x08\\xffeb\\xff89v\\xffe0 svH\\xfff0\\xffad\\x07Oc\\xff97w\\x0b\\x00\\x00\\x00 \\x00\\x00\\x00,\\xfff1\\xffad\\x07\\x00\\x00\r\\x03\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff90\\xfff0\\xffad\\x07\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x02\\x00\\x00\\x00@\\x00\\x00\\x00\\xffd0\\x07}\\x00 \\x00\\x00\\x00/\\x00\\x0b\\x00\\xff98\\xfff0\\xffad\\x07\\xffcc\\x13\\x15\\x03X\\x0b\\x15\\x03Oc\\xff97wZ\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00}\\x00\\xffd8\\x01}\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00P\\x00\\x00\\x00\\xffd0\\x07}\\x00d\\x00\\x00\\x00p{\\x13\\x03P\\x00\\x00\\x00d\\xfff0\\xffad\\x07\\xffc0\\xffb2\\x13\\x03\\xffa0P\\x11\\x03\\xffa0P\\x11\\x03\\x00\\x00\\x00\\x00x|\\x13\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00}\\x00\\xffe0\\x01}\\x00\\x00\\x00\\x00\\x00D\\x00\\x00\\x00\\x14\\x0c}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x03\\x10\\x0c}\\x00\\xffb8P\\x11\\x03\\xffc8\\x1a\\x15\\x03\\xffb0\\xfff0\\xffad\\x07d\\xfffarv\\xffe0\\x1a\\x15\\x03\\x00\\x00\\x00\\x00\\xffc8\\x1a\\x15\\x03\\xffa0P\\x11\\x03\\xffc8\\x1a\\x15\\x03\\xffd8\\xfff0\\xffad\\x07+\\xv\\xfff0p\\x14\\x03\\xffcc\\xffc2fv\\xffa0P\\x11\\x03\\xffe0[xv" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 1, "id": 757 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36c2e", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "3", "pretty_value": "REG_BINARY" }, { "name": "Information", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "Identity" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c36a63", "parentcaller": "0x75c36853", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000534" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c37324", "parentcaller": "0x75c36e95", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000534" }, { "name": "ObjectAttributesName", "value": "CustomAttributes" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x7672d718", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000534" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x75c37f8b", "parentcaller": "0x7672d718", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000530" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03155000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x77970857", "parentcaller": "0x7797055f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x03157000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x76746517", "parentcaller": "0x7674dbf3", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 770 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x76739f95", "parentcaller": "0x76739e12", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 771 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x779862aa", "parentcaller": "0x75c5ab19", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-03-05 16:14:40,539", "thread_id": "612", "caller": "0x779862d1", "parentcaller": "0x75c5ab19", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000530" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-03-05 16:14:40,554", "thread_id": "612", "caller": "0x75c565db", "parentcaller": "0x761ad09f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x80\\x80\\x00l\\x1a\\x00\\x00d\\x02\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "612" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-03-05 16:14:40,585", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x76c60000" } ], "repeated": 1, "id": 775 }, { "timestamp": "2026-03-05 16:14:40,695", "thread_id": "4536", "caller": "0x7676693d", "parentcaller": "0x767a08c6", "category": "windows", "api": "PostMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "WindowHandle", "value": "0x000502ce" }, { "name": "Message", "value": "0x00000400" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-03-05 16:14:40,742", "thread_id": "5996", "caller": "0x00edb7b9", "parentcaller": "0x00ed1e67", "category": "process", "api": "ShellExecuteExW", "status": true, "return": "0x00000001", "arguments": [ { "name": "FilePath", "value": "C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms" }, { "name": "Parameters", "value": "" }, { "name": "Show", "value": "1", "pretty_value": "SW_SHOWNORMAL" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-03-05 16:14:40,742", "thread_id": "5996", "caller": "0x00edb802", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-03-05 16:14:40,742", "thread_id": "5996", "caller": "0x00edb802", "parentcaller": "0x00ed1e67", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 779 }, { "timestamp": "2026-03-05 16:14:40,742", "thread_id": "5996", "caller": "0x00edb802", "parentcaller": "0x00ed1e67", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-03-05 16:14:40,742", "thread_id": "5996", "caller": "0x00edb802", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ce" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-03-05 16:14:40,742", "thread_id": "5996", "caller": "0x00edb802", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003d6" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-03-05 16:14:40,742", "thread_id": "5996", "caller": "0x00edb802", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000522" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-03-05 16:14:40,742", "thread_id": "5996", "caller": "0x00edb802", "parentcaller": "0x00ed1e67", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003da" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00edb802", "parentcaller": "0x00ed1e67", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x76b60000" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec5fbc", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070ef000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec5fbc", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070e4000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec5fcc", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070e4000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec5fd8", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070dc000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec5fe4", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070dc000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec5ff4", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070d4000" }, { "name": "RegionSize", "value": "0x00017000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec6004", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e73000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec6020", "parentcaller": "0x00ec5a80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070d4000" }, { "name": "RegionSize", "value": "0x00017000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ebe328", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00@\\xfb\\xaf\\x00\\x18\\xfc\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\xa8\\x10 \\xfc\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 794 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ebe33f", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\xfc\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xfc\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ebe3d7", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xfc\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xfc\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 796 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ebe36e", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x18\\xfc\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xfc\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ebe3a0", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xfc\\xaf\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xfc\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec0aa9", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xfc\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xd0\\xa9\\xabs0\\xfc\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ebe2c8", "parentcaller": "0x00ec6a0a", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000094" }, { "name": "HandleName", "value": "\\Device\\ConDrv" }, { "name": "IoControlCode", "value": "0x00500016" }, { "name": "InputBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xdc\\xf8\\xaf\\x00\\xa8\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf9\\xaf\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x00e71c30" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-03-05 16:14:40,757", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070ef000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070b4000" }, { "name": "RegionSize", "value": "0x00037000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070ef000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070a1000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070ef000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ec" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e8" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004dc" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f8" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000494" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e0" } ], "repeated": 0, "id": 818 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x062b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d8" } ], "repeated": 0, "id": 820 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 825 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004cc" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000046c" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000049c" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a0" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 832 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b0" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004bc" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 839 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e8" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x030c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "NtUpdateWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x779a4770" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004fc" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003e4" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06270000" }, { "name": "RegionSize", "value": "0x00017000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "NtUpdateWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x779a4770" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 869 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00e90000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x06290000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000424" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x070b4000" }, { "name": "RegionSize", "value": "0x00037000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x00ea0000" }, { "name": "RegionSize", "value": "0x00002000" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000224" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000270" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000274" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027c" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000290" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000026c" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 899 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001e8" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ec" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001dc" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001d8" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-03-05 16:14:40,929", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001bc" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b4" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000019c" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a0" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a4" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001a8" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ac" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b0" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75ef2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x75ef2000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000194" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000198" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000464" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000174" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000178" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000017c" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000180" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000184" } ], "repeated": 0, "id": 927 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000188" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000150" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000144" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000148" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000140" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000013c" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000138" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fe" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003f0" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000003ec" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000454" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044c" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000f4" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000f4" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e8" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e4" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e0" } ], "repeated": 0, "id": 961 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x77930000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7798f5a0" } ], "repeated": 0, "id": 963 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001f8" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000088" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a4" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b4" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000b8" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-03-05 16:14:40,945", "thread_id": "5996", "caller": "0x00ec0ae0", "parentcaller": "0x00ec6a0a", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 969 } ], "threads": [ "5996", "6072", "5404", "5092", "6996", "4536", "7144", "612" ], "environ": { "UserName": "cape", "ComputerName": "DESKTOP-PC01", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\cape\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Windows\\system32\\cmd.exe\" /c \"cd ^\"C:\\Users\\cape\\AppData\\Local\\Temp^\" && start /wait ^\"^\" ^\"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms^\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "7c6d-8d48", "SystemVolumeGUID": "c48439d1-0000-0000-0000-100000000000", "MachineGUID": "", "MainExeBase": "0x00eb0000", "MainExeSize": "0x0005a000", "Bitness": "32-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } } ], "anomaly": [], "processtree": [ { "name": "cmd.exe", "pid": 6764, "parent_id": 532, "module_path": "C:\\Windows\\SysWOW64\\cmd.exe", "children": [], "threads": [ "5996", "6072", "5404", "5092", "6996", "4536", "7144", "612" ], "environ": { "UserName": "cape", "ComputerName": "DESKTOP-PC01", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\cape\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Windows\\system32\\cmd.exe\" /c \"cd ^\"C:\\Users\\cape\\AppData\\Local\\Temp^\" && start /wait ^\"^\" ^\"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms^\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "7c6d-8d48", "SystemVolumeGUID": "c48439d1-0000-0000-0000-100000000000", "MachineGUID": "", "MainExeBase": "0x00eb0000", "MainExeSize": "0x0005a000", "Bitness": "32-bit" } } ], "summary": { "files": [ "C:\\Users\\cape\\AppData\\Local\\Temp", "C:\\Users", "C:\\Users\\cape", "C:\\Users\\cape\\AppData", "C:\\Users\\cape\\AppData\\Local", "C:\\", "C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms", "C:\\Windows\\System32\\kernel.appcore.dll", "\\Device\\CNG", "\\Device\\DeviceApi\\CMApi", "\\??\\MountPointManager" ], "read_files": [], "write_files": [], "delete_files": [], "keys": [ "HKEY_CURRENT_USER", "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun", "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\ru-RU", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\ru-RU", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Generation", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{89BC3F49-F8D9-5103-BA13-DE497E609167}", "HKEY_CURRENT_USER\\Software\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" ], "read_keys": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\ru-RU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\ru-RU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" ], "write_keys": [], "delete_keys": [], "executed_commands": [ "\"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms", "C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms " ], "resolved_apis": [], "mutexes": [ "Local\\SM0:6764:168:WilStaging_02" ], "created_services": [], "started_services": [] }, "enhanced": [ { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:35,992", "eid": 1, "data": { "file": "KERNEL32.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,007", "eid": 2, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DisableUNCCheck", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,007", "eid": 3, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\EnableExtensions", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,007", "eid": 4, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DelayedExpansion", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,007", "eid": 5, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\DefaultColor", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,007", "eid": 6, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\CompletionChar", "content": "9" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,007", "eid": 7, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\PathCompletionChar", "content": "9" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,007", "eid": 8, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Command Processor\\AutoRun", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,585", "eid": 9, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\ru-RU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,585", "eid": 10, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\ru-RU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,585", "eid": 11, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:36,585", "eid": 12, "data": { "file": "KERNEL32.DLL", "pathtofile": null, "moduleaddress": null } }, { "event": "execute", "object": "file", "timestamp": "2026-03-05 16:14:36,710", "eid": 13, "data": { "file": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:36,710", "eid": 14, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,757", "eid": 15, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,757", "eid": 16, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,757", "eid": 17, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,757", "eid": 18, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:36,757", "eid": 19, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x740c0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:36,757", "eid": 20, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:36,820", "eid": 21, "data": { "file": "api-ms-win-core-synch-l1-2-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:36,820", "eid": 22, "data": { "file": "advapi32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:36,820", "eid": 23, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:37,492", "eid": 24, "data": { "file": "comctl32.dll", "pathtofile": null, "moduleaddress": "0x73730000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:37,898", "eid": 25, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x76070000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:37,914", "eid": 26, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77930000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:37,914", "eid": 27, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x73660000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,195", "eid": 28, "data": { "file": "C:\\Windows\\System32\\Windows.Storage.dll", "pathtofile": null, "moduleaddress": "0x751f0000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,195", "eid": 29, "data": { "file": "C:\\Windows\\System32\\windows.storage.dll", "pathtofile": null, "moduleaddress": "0x751f0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,273", "eid": 30, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Data", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,273", "eid": 31, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00H\\x8dm|\\x1f\\x00\\x00\\x00\\x04@\\x00\\x10\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x009\\x003\\x004\\x00d\\x008\\x00c\\x00f\\x006\\x00-\\x001\\x007\\x00e\\x00a\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00b\\x006\\x00c\\x008\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,273", "eid": 32, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 33, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 34, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 35, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 36, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 37, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 38, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 39, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 40, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 41, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 42, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 43, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 44, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 45, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 46, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 47, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 48, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 49, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 50, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 51, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 52, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 53, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 54, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 55, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 56, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 57, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 58, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 59, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 60, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 61, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 62, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 63, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 64, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 65, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 66, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 67, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 68, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 69, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 70, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 71, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 72, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,539", "eid": 73, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 74, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 75, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 76, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,554", "eid": 77, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 78, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 79, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 80, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 81, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 82, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 83, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 84, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,554", "eid": 85, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 86, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 87, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 88, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 89, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 90, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 91, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 92, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 93, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 94, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 95, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 96, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 97, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 98, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\SysWOW64\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 99, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,570", "eid": 100, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,585", "eid": 101, "data": { "file": "C:\\Windows\\SysWOW64\\Windows.StateRepositoryPS.dll", "pathtofile": null, "moduleaddress": "0x735c0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,585", "eid": 102, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:38,601", "eid": 103, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\Interface\\{89bc3f49-f8d9-5103-ba13-de497e609167}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,617", "eid": 104, "data": { "file": "C:\\Windows\\System32\\Windows.UI.AppDefaults.dll", "pathtofile": null, "moduleaddress": "0x00000000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,710", "eid": 105, "data": { "file": "user32.dll", "pathtofile": null, "moduleaddress": "0x769c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,726", "eid": 106, "data": { "file": "C:\\Windows\\SysWOW64\\urlmon.dll", "pathtofile": null, "moduleaddress": "0x73410000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,773", "eid": 107, "data": { "file": "API-MS-WIN-CORE-URL-L1-1-0.DLL", "pathtofile": null, "moduleaddress": "0x75b30000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,804", "eid": 108, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x76c60000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:38,804", "eid": 109, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x77930000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:39,039", "eid": 110, "data": { "file": "C:\\Windows\\SysWOW64\\OneCoreUAPCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x72e20000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:39,101", "eid": 111, "data": { "file": "C:\\Windows\\SysWOW64\\WinTypes.dll", "pathtofile": null, "moduleaddress": "0x72d40000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:39,101", "eid": 112, "data": { "file": "C:\\Windows\\System32\\WinTypes.dll", "pathtofile": null, "moduleaddress": "0x72d40000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:39,117", "eid": 113, "data": { "file": "C:\\Windows\\SysWOW64\\oleaut32.dll", "pathtofile": null, "moduleaddress": "0x76b60000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:39,992", "eid": 114, "data": { "file": "C:\\Windows\\SysWOW64\\OneCoreCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x73c70000" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,085", "eid": 115, "data": { "file": "C:\\Windows\\SysWOW64\\actxprxy.dll", "pathtofile": null, "moduleaddress": "0x72cf0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 116, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 117, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 118, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 119, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 120, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 121, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 122, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 123, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 124, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 125, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,523", "eid": 126, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.FileTypeAssociation\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 127, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 128, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 129, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 130, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 131, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 132, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 133, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 134, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 135, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 136, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,539", "eid": 137, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,585", "eid": 138, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x76c60000" } }, { "event": "execute", "object": "file", "timestamp": "2026-03-05 16:14:40,742", "eid": 139, "data": { "file": "C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms" } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,757", "eid": 140, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,757", "eid": 141, "data": { "file": "mscoree.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,929", "eid": 142, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,929", "eid": 143, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,929", "eid": 144, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,929", "eid": 145, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,929", "eid": 146, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,929", "eid": 147, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,945", "eid": 148, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,945", "eid": 149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-03-05 16:14:40,945", "eid": 150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,945", "eid": 151, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-03-05 16:14:40,945", "eid": 152, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } } ], "encryptedbuffers": [], "network_map": { "endpoint_map": {}, "http_host_map": {}, "dns_intents": {}, "http_requests": [], "winhttp_sessions": [] } }, "debug": { "log": "2026-03-05 02:28:18,028 [root] INFO: Date set to: 20260305T19:13:54, timeout set to: 60\n2026-03-05 19:13:54,196 [root] DEBUG: Starting analyzer from: C:\\mfwmi_bb\n2026-03-05 19:13:54,242 [root] DEBUG: Storing results at: C:\\sEPsNYXLz\n2026-03-05 19:13:54,242 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\DJcPtXF\n2026-03-05 19:13:54,242 [root] DEBUG: Python path: C:\\Python310\n2026-03-05 19:13:54,304 [root] INFO: analysis running as an admin\n2026-03-05 19:13:54,304 [root] DEBUG: no analysis package configured, picking one for you\n2026-03-05 19:13:54,304 [root] INFO: analysis package selected: \"zip\"\n2026-03-05 19:13:54,304 [root] DEBUG: importing analysis package module: \"modules.packages.zip\"...\n2026-03-05 19:13:54,445 [root] DEBUG: imported analysis package \"zip\"\n2026-03-05 19:13:54,461 [root] DEBUG: initializing analysis package \"zip\"...\n2026-03-05 19:13:54,461 [lib.common.common] INFO: wrapping\n2026-03-05 19:13:54,508 [lib.core.compound] INFO: C:\\Users\\cape\\AppData\\Local\\Temp already exists, skipping creation\n2026-03-05 19:13:54,523 [root] DEBUG: New location of moved file: C:\\Users\\cape\\AppData\\Local\\Temp\\test_dropped.zip\n2026-03-05 19:13:54,523 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL option\n2026-03-05 19:13:54,523 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL_64 option\n2026-03-05 19:13:54,523 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader option\n2026-03-05 19:13:54,523 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader_64 option\n2026-03-05 19:13:54,586 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-03-05 19:13:54,742 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-03-05 19:13:54,883 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-03-05 19:13:55,164 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-03-05 19:13:55,445 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-03-05 19:13:55,492 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'\n2026-03-05 19:13:55,492 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'\n2026-03-05 19:13:55,523 [lib.api.screenshot] INFO: Please upgrade Pillow to >= 5.4.1 for best performance\n2026-03-05 19:13:55,523 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-03-05 19:13:55,523 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-03-05 19:13:55,539 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-03-05 19:13:55,539 [root] DEBUG: attempting to configure 'Browser' from data\n2026-03-05 19:13:55,726 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-03-05 19:13:55,726 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-03-05 19:13:55,742 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-03-05 19:13:55,742 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-03-05 19:13:55,742 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-03-05 19:13:55,742 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-03-05 19:13:55,742 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-03-05 19:13:55,742 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature\n2026-03-05 19:13:56,320 [modules.auxiliary.digisig] DEBUG: File format not recognized\n2026-03-05 19:13:56,320 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json\n2026-03-05 19:13:56,351 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-03-05 19:13:56,351 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-03-05 19:13:56,351 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-03-05 19:13:56,351 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-03-05 19:13:56,351 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-03-05 19:13:56,367 [modules.auxiliary.disguise] INFO: Disguising GUID to 69fdafb0-d621-439e-ac3a-9a05966fc0ad\n2026-03-05 19:13:56,367 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-03-05 19:13:56,367 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-03-05 19:13:56,367 [root] DEBUG: attempting to configure 'Human' from data\n2026-03-05 19:13:56,367 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-03-05 19:13:56,367 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-03-05 19:13:56,367 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-03-05 19:13:56,367 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-03-05 19:13:56,367 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-03-05 19:13:56,382 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-03-05 19:13:56,382 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-03-05 19:13:56,429 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-03-05 19:13:56,429 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-03-05 19:13:56,445 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-03-05 19:13:56,445 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-03-05 19:13:56,445 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-03-05 19:13:56,445 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 656\n2026-03-05 19:13:56,601 [lib.api.process] INFO: Monitor config for : C:\\mfwmi_bb\\dll\\656.ini\n2026-03-05 19:13:56,664 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor\n2026-03-05 19:13:56,820 [lib.api.process] INFO: 64-bit DLL to inject is C:\\mfwmi_bb\\dll\\zznBZPYx.dll, loader C:\\mfwmi_bb\\bin\\maGfHEfW.exe\n2026-03-05 19:13:56,976 [root] DEBUG: Loader: Injecting process 656 with C:\\mfwmi_bb\\dll\\zznBZPYx.dll.\n2026-03-05 19:13:57,054 [root] DEBUG: 656: Python path set to 'C:\\Python310'.\n2026-03-05 19:13:57,054 [root] DEBUG: 656: Disabling sleep skipping.\n2026-03-05 19:13:57,070 [root] DEBUG: 656: TLS secret dump mode enabled.\n2026-03-05 19:13:57,242 [root] DEBUG: 656: RtlInsertInvertedFunctionTable 0x00007FF97FCC090E, LdrpInvertedFunctionTableSRWLock 0x00007FF97FE1D500\n2026-03-05 19:13:57,242 [root] DEBUG: 656: Monitor initialised: 64-bit capemon loaded in process 656 at 0x00007FF95D840000, thread 5216, image base 0x00007FF794EB0000, stack from 0x000000A2778F1000-0x000000A277900000\n2026-03-05 19:13:57,257 [root] DEBUG: 656: Commandline: C:\\Windows\\system32\\lsass.exe\n2026-03-05 19:13:57,304 [root] DEBUG: 656: Hooked 5 out of 5 functions\n2026-03-05 19:13:57,304 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-03-05 19:13:57,351 [root] DEBUG: Successfully injected DLL C:\\mfwmi_bb\\dll\\zznBZPYx.dll.\n2026-03-05 19:13:57,351 [lib.api.process] INFO: Injected into 64-bit \n2026-03-05 19:13:57,351 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-03-05 19:13:57,945 [root] DEBUG: 656: TLS 1.2 secrets logged to: C:\\sEPsNYXLz\\tlsdump\\tlsdump.log\n2026-03-05 19:14:31,679 [root] INFO: Restarting WMI Service\n2026-03-05 19:14:31,898 [root] DEBUG: package modules.packages.zip does not support configure, ignoring\n2026-03-05 19:14:31,898 [root] WARNING: configuration error for package modules.packages.zip: error importing data.packages.zip: No module named 'data.packages'\n2026-03-05 19:14:31,992 [lib.common.zip_utils] INFO: Uploading C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms to host\n2026-03-05 19:14:32,054 [lib.common.results] INFO: Uploading file C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms to files/b044f900caf7f7ed584fc54b10c2839616f27ba3e8230343e3727246e9620597; Size is 7168; Max size: 100000000\n2026-03-05 19:14:32,070 [lib.common.zip_utils] INFO: Uploading C:\\Users\\cape\\AppData\\Local\\Temp\\5f7b5f1e01b83767.automaticDestinations-ms to host\n2026-03-05 19:14:32,070 [lib.common.results] INFO: Uploading file C:\\Users\\cape\\AppData\\Local\\Temp\\5f7b5f1e01b83767.automaticDestinations-ms to files/07aceb40c46fd8c7c36ff46f79c1063a632588fedc69bdc7e61994a91555eda7; Size is 1536; Max size: 100000000\n2026-03-05 19:14:32,070 [modules.packages.zip] DEBUG: No interesting files found, auto executing the first file: f01b4d95cf55d32a.automaticDestinations-ms\n2026-03-05 19:14:32,070 [modules.packages.zip] DEBUG: Missing file option, auto executing: ['f01b4d95cf55d32a.automaticDestinations-ms']\n2026-03-05 19:14:32,070 [lib.core.compound] INFO: C:\\Users\\cape\\AppData\\Local\\Temp already exists, skipping creation\n2026-03-05 19:14:32,086 [lib.api.process] INFO: Successfully executed process from path \"C:\\Windows\\system32\\cmd.exe\" with arguments \"/c \"cd ^\"C:\\Users\\cape\\AppData\\Local\\Temp^\" && start /wait ^\"^\" ^\"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms^\"\" with pid 6764\n2026-03-05 19:14:32,086 [lib.api.process] INFO: Monitor config for : C:\\mfwmi_bb\\dll\\6764.ini\n2026-03-05 19:14:32,133 [lib.api.process] INFO: 32-bit DLL to inject is C:\\mfwmi_bb\\dll\\FjWOdNQ.dll, loader C:\\mfwmi_bb\\bin\\KjEYIVM.exe\n2026-03-05 19:14:32,289 [root] DEBUG: Loader: Injecting process 6764 (thread 5996) with C:\\mfwmi_bb\\dll\\FjWOdNQ.dll.\n2026-03-05 19:14:32,382 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-03-05 19:14:32,429 [root] DEBUG: Successfully injected DLL C:\\mfwmi_bb\\dll\\FjWOdNQ.dll.\n2026-03-05 19:14:32,429 [lib.api.process] INFO: Injected into 32-bit \n2026-03-05 19:14:34,445 [lib.api.process] INFO: Successfully resumed \n2026-03-05 19:14:34,773 [root] DEBUG: 6764: Python path set to 'C:\\Python310'.\n2026-03-05 19:14:34,836 [root] DEBUG: 6764: Disabling sleep skipping.\n2026-03-05 19:14:34,836 [root] DEBUG: 6764: Dropped file limit defaulting to 100.\n2026-03-05 19:14:34,883 [root] DEBUG: 6764: YaraInit: Compiled 44 rule files\n2026-03-05 19:14:34,883 [root] DEBUG: 6764: YaraInit: Compiled rules saved to file C:\\mfwmi_bb\\data\\yara\\capemon.yac\n2026-03-05 19:14:34,883 [root] DEBUG: 6764: YaraScan: Scanning 0x00EB0000, size 0x595ee\n2026-03-05 19:14:34,898 [root] DEBUG: 6764: YaraScan hit: FindFixAndRun\n2026-03-05 19:14:34,898 [root] DEBUG: 6764: Monitor initialised: 32-bit capemon loaded in process 6764 at 0x73940000, thread 5996, image base 0xeb0000, stack from 0xa03000-0xb00000\n2026-03-05 19:14:34,898 [root] DEBUG: 6764: Commandline: \"C:\\Windows\\system32\\cmd.exe\" /c \"cd ^\"C:\\Users\\cape\\AppData\\Local\\Temp^\" && start /wait ^\"^\" ^\"C:\\Users\\cape\\AppData\\Local\\Temp\\f01b4d95cf55d32a.automaticDestinations-ms^\"\n2026-03-05 19:14:35,523 [root] DEBUG: 6764: hook_api: LdrpCallInitRoutine export address 0x779A2A40 obtained via GetFunctionAddress\n2026-03-05 19:14:35,633 [root] WARNING: b'Unable to place hook on GetCommandLineA'\n2026-03-05 19:14:35,664 [root] DEBUG: 6764: set_hooks: Unable to hook GetCommandLineA\n2026-03-05 19:14:35,664 [root] WARNING: b'Unable to place hook on GetCommandLineW'\n2026-03-05 19:14:35,695 [root] DEBUG: 6764: set_hooks: Unable to hook GetCommandLineW\n2026-03-05 19:14:35,726 [root] DEBUG: 6764: Hooked 630 out of 632 functions\n2026-03-05 19:14:35,757 [root] DEBUG: 6764: set_hooks_exe: Hooked FindFixAndRun at 0x00EBAD60\n2026-03-05 19:14:35,773 [root] DEBUG: 6764: Syscall hook installed, syscall logging level 1\n2026-03-05 19:14:35,804 [root] DEBUG: 6764: RestoreHeaders: Restored original import table.\n2026-03-05 19:14:35,820 [root] INFO: Loaded monitor into process with pid 6764\n2026-03-05 19:14:35,914 [root] DEBUG: 6764: caller_dispatch: Added region at 0x00EB0000 to tracked regions list (ntdll::NtOpenThread returns to 0x00EC09DE, thread 5996).\n2026-03-05 19:14:35,945 [root] DEBUG: 6764: YaraScan: Scanning 0x00EB0000, size 0x595ee\n2026-03-05 19:14:35,976 [root] DEBUG: 6764: ProcessImageBase: Main module image at 0x00EB0000 unmodified (entropy change 0.000000e+00)\n2026-03-05 19:14:36,383 [root] DEBUG: 6764: InstrumentationCallback: Added region at 0x75C633EC (base 0x75B30000) to tracked regions list (thread 5996).\n2026-03-05 19:14:36,570 [root] DEBUG: 6764: ProcessTrackedRegion: Region at 0x75B30000 mapped as \\Device\\HarddiskVolume1\\Windows\\SysWOW64\\KernelBase.dll is in known range, skipping\n2026-03-05 19:14:36,742 [root] DEBUG: 6764: set_hooks_by_export_directory: Hooked 0 out of 632 functions\n2026-03-05 19:14:36,742 [root] DEBUG: 6764: DLL loaded at 0x74D40000: C:\\Windows\\SYSTEM32\\kernel.appcore (0xf000 bytes).\n2026-03-05 19:14:36,757 [root] DEBUG: 6764: DLL loaded at 0x76C00000: C:\\Windows\\System32\\bcryptPrimitives (0x5f000 bytes).\n2026-03-05 19:14:36,757 [root] DEBUG: 6764: DLL loaded at 0x740C0000: C:\\Windows\\system32\\uxtheme (0x74000 bytes).\n2026-03-05 19:14:36,773 [root] DEBUG: 6764: DLL loaded at 0x76C60000: C:\\Windows\\System32\\shell32 (0x5b5000 bytes).\n2026-03-05 19:14:37,070 [root] DEBUG: 6764: InstrumentationCallback: Added region at 0x760924AC (base 0x76070000) to tracked regions list (thread 5996).\n2026-03-05 19:14:37,382 [root] DEBUG: 6764: ProcessTrackedRegion: Region at 0x76070000 mapped as \\Device\\HarddiskVolume1\\Windows\\SysWOW64\\kernel32.dll is in known range, skipping\n2026-03-05 19:14:37,398 [root] DEBUG: 6764: DLL loaded at 0x73730000: C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\\comctl32 (0x210000 bytes).\n2026-03-05 19:14:37,476 [root] DEBUG: 6764: ProcessTrackedRegion: Region at 0x76070000 mapped as \\Device\\HarddiskVolume1\\Windows\\SysWOW64\\kernel32.dll is in known range, skipping\n2026-03-05 19:14:37,773 [root] DEBUG: 6764: DLL loaded at 0x76190000: C:\\Windows\\System32\\SHCORE (0x87000 bytes).\n2026-03-05 19:14:37,836 [root] DEBUG: 6764: DLL loaded at 0x751C0000: C:\\Windows\\System32\\Wldp (0x27000 bytes).\n2026-03-05 19:14:37,836 [root] DEBUG: 6764: DLL loaded at 0x751F0000: C:\\Windows\\SYSTEM32\\windows.storage (0x60d000 bytes).\n2026-03-05 19:14:37,898 [root] DEBUG: 6764: DLL loaded at 0x73660000: C:\\Windows\\System32\\PROPSYS (0xc2000 bytes).\n2026-03-05 19:14:37,914 [root] DEBUG: 6764: DLL loaded at 0x759E0000: C:\\Windows\\System32\\clbcatq (0x7e000 bytes).\n2026-03-05 19:14:37,914 [root] DEBUG: 6764: DEBUG:Initialized 9 com hooks\n2026-03-05 19:14:37,976 [root] DEBUG: 6764: DLL loaded at 0x74D50000: C:\\Windows\\System32\\profapi (0x18000 bytes).\n2026-03-05 19:14:38,273 [root] DEBUG: 6764: DLL loaded at 0x75F30000: C:\\Windows\\System32\\CFGMGR32 (0x3b000 bytes).\n2026-03-05 19:14:38,476 [root] DEBUG: 6764: DLL loaded at 0x73CD0000: C:\\Windows\\System32\\edputil (0x1b000 bytes).\n2026-03-05 19:14:38,586 [root] DEBUG: 6764: DLL loaded at 0x735C0000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x93000 bytes).\n2026-03-05 19:14:38,695 [root] DEBUG: 6764: DLL loaded at 0x731E0000: C:\\Windows\\System32\\iertutil (0x22d000 bytes).\n2026-03-05 19:14:38,695 [root] DEBUG: 6764: DLL loaded at 0x73CB0000: C:\\Windows\\System32\\srvcli (0x1d000 bytes).\n2026-03-05 19:14:38,695 [root] DEBUG: 6764: DLL loaded at 0x74F30000: C:\\Windows\\System32\\netutils (0xb000 bytes).\n2026-03-05 19:14:38,711 [root] DEBUG: 6764: DLL loaded at 0x73410000: C:\\Windows\\System32\\urlmon (0x1a8000 bytes).\n2026-03-05 19:14:38,804 [root] DEBUG: 6764: DLL loaded at 0x74BA0000: C:\\Windows\\SYSTEM32\\apphelp (0x9f000 bytes).\n2026-03-05 19:14:39,023 [root] DEBUG: 6764: DLL loaded at 0x72E20000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x3b9000 bytes).\n2026-03-05 19:14:39,102 [root] DEBUG: 6764: DLL loaded at 0x72D40000: C:\\Windows\\System32\\wintypes (0xdb000 bytes).\n2026-03-05 19:14:39,992 [root] DEBUG: 6764: DLL loaded at 0x73C70000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x3d000 bytes).\n2026-03-05 19:14:40,086 [root] DEBUG: 6764: set_hooks_by_export_directory: Hooked 0 out of 632 functions\n2026-03-05 19:14:40,086 [root] DEBUG: 6764: DLL loaded at 0x72CF0000: C:\\Windows\\System32\\ActXPrxy (0x4a000 bytes).\n2026-03-05 19:14:40,774 [root] DEBUG: 6764: NtTerminateProcess hook: Attempting to dump process 6764\n2026-03-05 19:14:40,774 [root] DEBUG: 6764: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching\n2026-03-05 19:14:40,774 [root] DEBUG: 6764: DoProcessDump: Code modification detected, dumping Imagebase at 0x00EB0000.\n2026-03-05 19:14:40,789 [root] DEBUG: 6764: DumpImageInCurrentProcess: Attempting to dump virtual PE image.\n2026-03-05 19:14:40,789 [root] DEBUG: 6764: DumpProcess: Instantiating PeParser with address: 0x00EB0000.\n2026-03-05 19:14:40,789 [root] DEBUG: 6764: DumpProcess: Module entry point VA is 0x00EC6B20.\n2026-03-05 19:14:40,883 [lib.common.results] INFO: Uploading file C:\\sEPsNYXLz\\CAPE\\6764_276156844014165432026 to procdump\\afec4dc28b2da14794c3fefeb74e219702a3c885e80bc5e3182c8c42fbeab84d; Size is 346624; Max size: 100000000\n2026-03-05 19:14:40,914 [root] DEBUG: 6764: DumpProcess: Module image dump success - dump size 0x54a00.\n2026-03-05 19:14:40,976 [root] INFO: Process with pid 6764 has terminated\n2026-03-05 19:14:46,851 [root] INFO: Process list is empty, terminating analysis\n2026-03-05 19:14:47,867 [root] INFO: Created shutdown mutex\n2026-03-05 19:14:48,882 [root] INFO: Shutting down package\n2026-03-05 19:14:48,882 [root] INFO: Stopping auxiliary modules\n2026-03-05 19:14:48,882 [root] INFO: Stopping auxiliary module: Browser\n2026-03-05 19:14:48,882 [root] INFO: Stopping auxiliary module: Human\n2026-03-05 19:14:49,570 [root] INFO: Stopping auxiliary module: Screenshots\n2026-03-05 19:14:50,304 [root] INFO: Finishing auxiliary modules\n2026-03-05 19:14:50,320 [root] INFO: Shutting down pipe server and dumping dropped files\n2026-03-05 19:14:50,320 [root] WARNING: Folder at path \"C:\\sEPsNYXLz\\debugger\" does not exist, skipping\n2026-03-05 19:14:50,320 [root] INFO: Uploading files at path \"C:\\sEPsNYXLz\\tlsdump\"\n2026-03-05 19:14:50,336 [lib.common.results] INFO: Uploading file C:\\sEPsNYXLz\\tlsdump\\tlsdump.log to tlsdump\\tlsdump.log; Size is 11234; Max size: 100000000\n2026-03-05 19:14:50,336 [root] INFO: Analysis completed\n", "errors": [] }, "network": { "pcap_sha256": "c498246667892474bbceb98a5bb85f7d9a585289c0b0f0fd8edcf52ef8e921c6", "hosts": [ { "ip": "72.154.7.109", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "72.154.7.16", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "4.207.247.138", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "135.232.92.97", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "176.99.136.153", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 80 ] } ], "domains": [], "tcp": [ { "src": "192.168.1.100", "sport": 50625, "dst": "176.99.136.153", "dport": 80, "offset": 12242, "time": 4.2542829513549805 }, { "src": "192.168.1.100", "sport": 50615, "dst": "176.99.136.153", "dport": 80, "offset": 13847, "time": 4.342756986618042 }, { "src": "192.168.1.100", "sport": 50629, "dst": "176.99.136.153", "dport": 80, "offset": 14934, "time": 4.380812883377075 }, { "src": "192.168.1.100", "sport": 50630, "dst": "72.154.7.108", "dport": 443, "offset": 132951, "time": 4.551486968994141 }, { "src": "192.168.1.100", "sport": 50632, "dst": "109.61.38.38", "dport": 80, "offset": 1014993, "time": 17.669086933135986 }, { "src": "192.168.1.100", "sport": 50633, "dst": "135.232.92.97", "dport": 443, "offset": 1016338, "time": 18.385533094406128 }, { "src": "192.168.1.100", "sport": 50635, "dst": "52.123.240.85", "dport": 443, "offset": 1031935, "time": 20.239279985427856 }, { "src": "192.168.1.100", "sport": 50637, "dst": "23.46.116.231", "dport": 80, "offset": 1050154, "time": 21.195883989334106 }, { "src": "192.168.1.100", "sport": 50642, "dst": "40.126.53.7", "dport": 443, "offset": 1078529, "time": 23.994800090789795 }, { "src": "192.168.1.100", "sport": 50644, "dst": "40.126.53.7", "dport": 443, "offset": 1079594, "time": 23.996021032333374 }, { "src": "192.168.1.100", "sport": 50646, "dst": "40.126.53.7", "dport": 443, "offset": 1158152, "time": 24.421240091323853 }, { "src": "192.168.1.100", "sport": 50648, "dst": "52.183.220.149", "dport": 443, "offset": 1219238, "time": 24.90889286994934 }, { "src": "192.168.1.100", "sport": 50650, "dst": "52.183.220.149", "dport": 443, "offset": 1235997, "time": 25.16281294822693 }, { "src": "192.168.1.100", "sport": 50654, "dst": "52.137.106.217", "dport": 443, "offset": 1260886, "time": 50.19156002998352 }, { "src": "192.168.1.100", "sport": 50657, "dst": "135.232.92.97", "dport": 443, "offset": 1307444, "time": 51.44070386886597 }, { "src": "192.168.1.100", "sport": 50659, "dst": "135.232.92.137", "dport": 443, "offset": 1321099, "time": 52.16072988510132 }, { "src": "192.168.1.100", "sport": 50662, "dst": "176.99.136.153", "dport": 80, "offset": 1327608, "time": 52.479389905929565 }, { "src": "192.168.1.100", "sport": 50663, "dst": "176.99.136.153", "dport": 80, "offset": 1334572, "time": 52.57917594909668 }, { "src": "192.168.1.100", "sport": 50665, "dst": "135.232.92.97", "dport": 443, "offset": 1452759, "time": 52.888731956481934 }, { "src": "192.168.1.100", "sport": 50667, "dst": "72.154.7.16", "dport": 443, "offset": 2474774, "time": 53.14044690132141 }, { "src": "192.168.1.100", "sport": 50668, "dst": "72.154.7.109", "dport": 443, "offset": 2483388, "time": 53.16669297218323 }, { "src": "192.168.1.100", "sport": 50671, "dst": "212.229.88.20", "dport": 80, "offset": 2540823, "time": 53.60242199897766 }, { "src": "192.168.1.100", "sport": 50672, "dst": "176.99.136.153", "dport": 80, "offset": 2541862, "time": 53.63874292373657 }, { "src": "192.168.1.100", "sport": 50675, "dst": "4.207.247.138", "dport": 443, "offset": 2758589, "time": 55.504721879959106 }, { "src": "192.168.1.100", "sport": 50677, "dst": "52.191.219.104", "dport": 443, "offset": 2785886, "time": 56.80879998207092 }, { "src": "192.168.1.100", "sport": 50684, "dst": "2.23.89.205", "dport": 443, "offset": 2804506, "time": 59.359858989715576 }, { "src": "192.168.1.100", "sport": 50686, "dst": "2.23.88.9", "dport": 443, "offset": 2822812, "time": 60.20692586898804 }, { "src": "192.168.1.100", "sport": 50688, "dst": "104.81.99.218", "dport": 80, "offset": 2831049, "time": 60.50433588027954 }, { "src": "192.168.1.100", "sport": 50690, "dst": "204.79.197.203", "dport": 80, "offset": 2833198, "time": 60.65526103973389 }, { "src": "192.168.1.100", "sport": 50692, "dst": "176.99.136.153", "dport": 80, "offset": 2838031, "time": 60.94324088096619 }, { "src": "192.168.1.100", "sport": 50698, "dst": "40.126.53.7", "dport": 443, "offset": 4660078, "time": 66.12878203392029 }, { "src": "192.168.1.100", "sport": 50704, "dst": "176.99.136.153", "dport": 80, "offset": 4695940, "time": 72.28099489212036 }, { "src": "192.168.1.100", "sport": 50706, "dst": "176.99.136.153", "dport": 80, "offset": 4696633, "time": 72.287024974823 }, { "src": "192.168.1.100", "sport": 50709, "dst": "72.154.7.107", "dport": 443, "offset": 21603563, "time": 74.80106687545776 }, { "src": "192.168.1.100", "sport": 50714, "dst": "176.99.136.153", "dport": 80, "offset": 29488732, "time": 76.87179398536682 }, { "src": "192.168.1.100", "sport": 50715, "dst": "176.99.136.153", "dport": 80, "offset": 29489414, "time": 76.89646792411804 } ], "udp": [ { "src": "192.168.1.100", "sport": 56963, "dst": "8.8.8.8", "dport": 53, "offset": 12783, "time": 4.276057004928589 }, { "src": "192.168.1.100", "sport": 51194, "dst": "8.8.4.4", "dport": 53, "offset": 13390, "time": 4.333981990814209 }, { "src": "192.168.1.100", "sport": 63806, "dst": "8.8.8.8", "dport": 53, "offset": 1030095, "time": 20.08226203918457 }, { "src": "192.168.1.100", "sport": 50924, "dst": "8.8.8.8", "dport": 53, "offset": 1049099, "time": 21.01829195022583 }, { "src": "192.168.1.100", "sport": 49905, "dst": "8.8.8.8", "dport": 53, "offset": 1059195, "time": 23.51538395881653 }, { "src": "192.168.1.100", "sport": 64736, "dst": "8.8.8.8", "dport": 53, "offset": 1072929, "time": 23.913459062576294 }, { "src": "192.168.1.100", "sport": 53672, "dst": "8.8.8.8", "dport": 53, "offset": 1104711, "time": 24.126523971557617 }, { "src": "192.168.1.100", "sport": 56839, "dst": "8.8.4.4", "dport": 53, "offset": 1204691, "time": 24.62982487678528 }, { "src": "192.168.1.100", "sport": 65198, "dst": "8.8.4.4", "dport": 53, "offset": 1205917, "time": 24.708100080490112 }, { "src": "192.168.1.100", "sport": 65252, "dst": "8.8.4.4", "dport": 53, "offset": 1259546, "time": 48.36246609687805 }, { "src": "192.168.1.100", "sport": 53238, "dst": "8.8.8.8", "dport": 53, "offset": 1265438, "time": 50.41292905807495 }, { "src": "192.168.1.100", "sport": 55180, "dst": "8.8.8.8", "dport": 53, "offset": 1311669, "time": 51.86932587623596 }, { "src": "192.168.1.100", "sport": 56773, "dst": "8.8.8.8", "dport": 53, "offset": 1321380, "time": 52.167766094207764 }, { "src": "192.168.1.100", "sport": 60561, "dst": "8.8.4.4", "dport": 53, "offset": 1326411, "time": 52.429178953170776 }, { "src": "192.168.1.100", "sport": 52145, "dst": "8.8.8.8", "dport": 53, "offset": 2473896, "time": 53.109513998031616 }, { "src": "192.168.1.100", "sport": 58502, "dst": "8.8.4.4", "dport": 53, "offset": 2530521, "time": 53.470829010009766 }, { "src": "192.168.1.100", "sport": 56617, "dst": "8.8.4.4", "dport": 53, "offset": 2539743, "time": 53.580662965774536 }, { "src": "192.168.1.100", "sport": 60475, "dst": "8.8.8.8", "dport": 53, "offset": 2769622, "time": 55.966755867004395 }, { "src": "192.168.1.100", "sport": 58611, "dst": "8.8.8.8", "dport": 53, "offset": 2785169, "time": 56.6223828792572 }, { "src": "192.168.1.100", "sport": 57934, "dst": "8.8.8.8", "dport": 53, "offset": 2803356, "time": 59.30434799194336 }, { "src": "192.168.1.100", "sport": 53473, "dst": "8.8.8.8", "dport": 53, "offset": 2815231, "time": 60.03470492362976 }, { "src": "192.168.1.100", "sport": 65478, "dst": "8.8.4.4", "dport": 53, "offset": 2821952, "time": 60.17910194396973 }, { "src": "192.168.1.100", "sport": 51837, "dst": "8.8.4.4", "dport": 53, "offset": 2829028, "time": 60.26102089881897 }, { "src": "192.168.1.100", "sport": 51426, "dst": "8.8.8.8", "dport": 53, "offset": 4652302, "time": 64.27708196640015 }, { "src": "192.168.1.100", "sport": 64017, "dst": "8.8.8.8", "dport": 53, "offset": 4686186, "time": 69.81321287155151 } ], "icmp": [ { "src": "192.168.1.100", "dst": "8.8.4.4", "type": 3, "data": "" }, { "src": "192.168.1.100", "dst": "8.8.4.4", "type": 3, "data": "" }, { "src": "192.168.1.100", "dst": "8.8.4.4", "type": 3, "data": "" }, { "src": "192.168.1.100", "dst": "8.8.4.4", "type": 3, "data": "" }, { "src": "192.168.1.100", "dst": "8.8.4.4", "type": 3, "data": "" } ], "http": [ { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=288358400-289406975\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.2.1.126\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738039.129015 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=289406976-290455551\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.2.1.127\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738039.217489 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=0-1\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.1.1.1\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738039.255545 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=25165824-26079085\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.1.1.2\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738039.296115 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746780&P2=404&P3=2&P4=ZfzZ%2b1ruqpsnBJiQzps0e9arQyf48A6ngtoSfW9CefKMiFSNeMwFpGUuT8Rh74NC3bhTVZU%2bsT%2bnRljvdrOs3Q%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=0-1\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.5.1.1\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746780&P2=404&P3=2&P4=ZfzZ%2b1ruqpsnBJiQzps0e9arQyf48A6ngtoSfW9CefKMiFSNeMwFpGUuT8Rh74NC3bhTVZU%2bsT%2bnRljvdrOs3Q%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746780&P2=404&P3=2&P4=ZfzZ%2b1ruqpsnBJiQzps0e9arQyf48A6ngtoSfW9CefKMiFSNeMwFpGUuT8Rh74NC3bhTVZU%2bsT%2bnRljvdrOs3Q%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738087.354122 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=0-1\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.2.1.1\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738087.453908 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=17825792-18874367\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.2.1.2\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738087.637391 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=0-1\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.1\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738088.513475 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=0-1\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.3.1.1\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738095.817973 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=8388608-9437183\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.3.1.2\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738098.237524 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=288358400-289406975\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.2\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738107.155727 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=289406976-290455551\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.3\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738107.161757 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=290455552-291504127\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.4\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738107.873412 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=291504128-292552703\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.5\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738107.894491 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=292552704-293601279\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.6\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738108.170517 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=293601280-294649855\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.7\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738108.189145 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=294649856-295698431\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.8\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738108.443244 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=295698432-296747007\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.9\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738108.464109 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=296747008-297795583\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.10\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738108.6928 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=297795584-298844159\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.11\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738108.826985 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=298844160-299892735\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.12\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738108.954078 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=299892736-300941311\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.13\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738109.082344 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=300941312-301989887\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.14\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738109.212087 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=301989888-303038463\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.15\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738109.332435 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=303038464-304087039\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.16\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738109.448036 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=304087040-305135615\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.17\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738109.832998 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=305135616-306184191\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.18\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738109.867495 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=306184192-307232767\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.19\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738110.085186 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=307232768-308281343\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.20\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738110.154646 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=308281344-309329919\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.21\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738110.400924 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=309329920-310378495\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.22\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738110.422232 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=310378496-311427071\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.39.3.1.0.0.14.2.7.6.1.23\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738110.638084 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=9437184-10485759\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.3.1.3\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738111.746526 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=10485760-11534335\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.3.1.4\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738111.7712 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=11534336-12582911\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.3.1.5\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738112.079645 }, { "count": 1, "host": "176.99.136.153", "port": 80, "data": "GET /filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nRange: bytes=12582912-13631487\r\nUser-Agent: Microsoft-Delivery-Optimization/10.0\r\nMS-CV: Fz7HHVkVlkqDLOn2.11.3.1.0.0.13.2.7.3.1.6\r\nContent-Length: 0\r\nHost: 176.99.136.153\r\n\r\n", "uri": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "body": "", "path": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "user-agent": "Microsoft-Delivery-Optimization/10.0", "version": "1.1", "method": "GET", "first_seen": 1772738112.092627 } ], "dns": [], "smtp": [], "irc": [], "dead_hosts": [] }, "suricata": { "alerts": [], "tls": [], "perf": [], "files": [], "http": [ { "srcport": 50715, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:13:54.874732+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 339222, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50714, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:13:54.874732+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 984542, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50629, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:13:59.296115+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 2, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50629, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:13:59.662089+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 913262, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50662, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:14:47.439242+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746780&P2=404&P3=2&P4=ZfzZ%2b1ruqpsnBJiQzps0e9arQyf48A6ngtoSfW9CefKMiFSNeMwFpGUuT8Rh74NC3bhTVZU%2bsT%2bnRljvdrOs3Q%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 2, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50663, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:14:47.533117+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 2, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50663, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:14:47.943878+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50672, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:14:48.595317+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 2, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50692, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:14:55.907772+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 2, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50692, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:14:58.586837+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:07.873412+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:07.894491+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:08.170517+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:08.189145+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:08.443244+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:08.464109+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:08.692800+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:08.750067+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:08.954078+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:09.070804+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:09.212087+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:09.332435+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:09.448036+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:09.624952+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:09.718702+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:10.085186+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:10.154646+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:10.374902+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:10.393062+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:10.638084+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50706, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:10.687415+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50704, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:10.906151+0000", "uri": "/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50714, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:12.057431+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null }, { "srcport": 50715, "srcip": "192.168.1.100", "dstport": 80, "dstip": "176.99.136.153", "timestamp": "2026-03-05 19:15:12.071419+0000", "uri": "/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com", "length": 1048576, "hostname": "176.99.136.153", "status": 206, "http_method": "GET", "contenttype": "application/octet-stream", "ua": "Microsoft-Delivery-Optimization/10.0", "referrer": null } ], "dns": [], "ssh": [], "fileinfo": [], "eve_log_full_path": "/opt/CAPEv2/storage/analyses/10/logs/eve.json", "alert_log_full_path": null, "tls_log_full_path": null, "http_log_full_path": null, "file_log_full_path": null, "ssh_log_full_path": null, "dns_log_full_path": null }, "url_analysis": {}, "procmemory": [], "signatures": [ { "name": "stealth_network", "description": "Network activity detected but not expressed in monitor API logs", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "ip": "72.154.7.109" }, { "ip": "72.154.7.16" }, { "ip": "4.207.247.138" }, { "ip": "135.232.92.97" }, { "ip": "176.99.136.153" } ], "new_data": [], "alert": false, "families": [] }, { "name": "queries_locale_api", "description": "Queries the computer locale (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 6764, "cid": 73 } ], "new_data": [], "alert": false, "families": [] }, { "name": "stealth_timeout", "description": "Possible date expiration check, exits too soon after checking local time", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "process": "cmd.exe, PID 6764" }, { "type": "call", "pid": 6764, "cid": 802 } ], "new_data": [], "alert": false, "families": [] }, { "name": "language_check_registry", "description": "Checks system language via registry key (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\ru-RU" }, { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\ru-RU" } ], "new_data": [], "alert": false, "families": [] }, { "name": "network_cnc_http", "description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic", "categories": [ "network", "c2" ], "severity": 2, "weight": 1, "confidence": 30, "references": [], "data": [ { "ip_hostname": "HTTP connection was made to an IP address rather than domain name" }, { "suspicious_request": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "suspicious_request": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "suspicious_request": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746780&P2=404&P3=2&P4=ZfzZ%2b1ruqpsnBJiQzps0e9arQyf48A6ngtoSfW9CefKMiFSNeMwFpGUuT8Rh74NC3bhTVZU%2bsT%2bnRljvdrOs3Q%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "suspicious_request": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" } ], "new_data": [], "alert": false, "families": [] }, { "name": "network_http", "description": "Performs some HTTP requests", "categories": [ "network" ], "severity": 2, "weight": 1, "confidence": 30, "references": [], "data": [ { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746780&P2=404&P3=2&P4=ZfzZ%2b1ruqpsnBJiQzps0e9arQyf48A6ngtoSfW9CefKMiFSNeMwFpGUuT8Rh74NC3bhTVZU%2bsT%2bnRljvdrOs3Q%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" } ], "new_data": [], "alert": false, "families": [] }, { "name": "discover_registry_mount_points", "description": "Queries registry mount points to identify historical or connected removable/network drives", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{c48439d1-0000-0000-0000-100000000000}\\Data" } ], "new_data": [], "alert": false, "families": [] }, { "name": "network_questionable_http_path", "description": "Makes a suspicious HTTP request to a commonly exploitable directory with questionable file ext", "categories": [ "network" ], "severity": 3, "weight": 1, "confidence": 100, "references": [], "data": [ { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772675240&P2=404&P3=2&P4=XulOwRGtMZzcNKQGALMkMyn4znaN%2bw51OI%2bu68BMlQC68jblctprOUDXdVXREvmHnKMSEyyKhlEqi0s4sVMbYw%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746780&P2=404&P3=2&P4=ZfzZ%2b1ruqpsnBJiQzps0e9arQyf48A6ngtoSfW9CefKMiFSNeMwFpGUuT8Rh74NC3bhTVZU%2bsT%2bnRljvdrOs3Q%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/080ef4a0-be38-451d-bc0c-6f002879786f?P1=1772746904&P2=404&P3=2&P4=AuiSrQX%2f2BJHKkfiY8NnmgZ2bD6HrYdml7aIisTaOeqqweF5kPjPXlCzG64%2fpiKBFSyFs6c%2f4YHZoQ4IKw8XZA%3d%3d&cacheHostOrigin=4.tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" }, { "url": "http://176.99.136.153/filestreamingservice/files/04321851-7dec-4cfd-8c57-da0b4ae64040?P1=1772667035&P2=404&P3=2&P4=Dxm0MQ0r8wJBywFPdaaix9tzgCbtb6TMyf15OeUQLxdKnb0skxr4k68jPjJjUkyljucNAWn7tAjopIgFHNemjA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com" } ], "new_data": [], "alert": false, "families": [] }, { "name": "procmem_yara", "description": "Yara detections observed in process dumps, payloads or dropped files", "categories": [ "malware" ], "severity": 3, "weight": 1, "confidence": 100, "references": [], "data": [ { "Hit": "PID 6764 triggered the Yara rule 'IsPE32' with data '[]'" }, { "Hit": "PID 6764 triggered the Yara rule 'IsConsole' with data '[]'" }, { "Hit": "PID 6764 triggered the Yara rule 'HasDebugData' with data '[]'" }, { "Hit": "PID 6764 triggered the Yara rule 'HasRichSignature' with data '['Rich']'" }, { "Hit": "PID 6764 triggered the Yara rule 'Visual_Cpp_2005_Release_Microsoft' with data '['{ E8 F8 4E 00 00 E9 E1 FD FF FF }', '{ E8 CB C9 FF FF E9 FB FD FF FF }', '{ E8 D0 05 00 00 E9 D9 FD FF FF }']'" }, { "Hit": "PID 6764 triggered the Yara rule 'VC8_Microsoft_Corporation' with data '['{ E8 F8 4E 00 00 E9 E1 FD FF FF }', '{ E8 23 ED FF FF E9 27 FF FF FF }', '{ E8 15 78 00 00 E9 99 FE FF FF }', '{ E8 0D 11 00 00 E9 5A FF FF FF }', '{ E8 84 1D 00 00 E9 62 FE FF FF }', '{ E8 A3 12 00 00 E9 27 FF FF FF }', '{ E8 19 14 00 00 E9 1D FF FF FF }', '{ E8 BA 01 00 00 E9 76 FE FF FF }', '{ E8 D4 A8 01 00 E9 53 FF FF FF }', '{ E8 03 1E 00 00 E9 64 FF FF FF }', '{ E8 A1 21 00 00 E9 52 FF FF FF }', '{ E8 6E 3A 00 00 E9 DE FE FF FF }', '{ E8 32 A1 FF FF E9 EA FE FF FF }', '{ E8 75 00 00 00 E9 5A FE FF FF }', '{ E8 00 00 8B FE E9 E8 FA FF FF }', '{ E8 63 01 00 00 E9 BD FC FF FF }', '{ E8 1E D4 FF FF E9 27 FF FF FF }', '{ E8 56 07 00 00 E9 36 FE FF FF }', '{ E8 CB C9 FF FF E9 FB FD FF FF }', '{ E8 7C A0 FF FF E9 83 FE FF FF }', '{ E8 E4 20 00 00 E9 2F FF FF FF }', '{ E8 C9 EB FF FF E9 66 FF FF FF }', '{ E8 96 B0 FF FF E9 6C FF FF FF }', '{ E8 D0 05 00 00 E9 D9 FD FF FF }', '{ E8 4E ED FF FF E9 06 F4 FF FF }', '{ E8 F9 9F 00 00 E9 E5 03 FF FF }', '{ E8 4A C0 FE FF E9 29 00 FF FF }', '{ E8 50 F2 FE FF E9 2D 04 FF FF }', '{ E8 C5 29 FF FF E9 B9 06 FF FF }', '{ E8 90 0D FF FF E9 6B 19 FF FF }', '{ E8 38 C3 FE FF E9 2D 1B FF FF }', '{ E8 27 C3 FE FF E9 30 1B FF FF }', '{ E8 16 C3 FE FF E9 33 1B FF FF }', '{ E8 67 C2 FE FF E9 96 1A FF FF }', '{ E8 58 A1 00 00 E9 5E 1C FF FF }', '{ E8 BB 54 00 00 E9 72 1E FF FF }', '{ E8 3F F7 FE FF E9 57 FF FF FF }', '{ E8 45 AC 00 00 E9 F2 21 FF FF }', '{ E8 19 AC 00 00 E9 69 22 FF FF }', '{ E8 7F 99 FE FF E9 D0 2E FF FF }', '{ E8 16 42 00 00 E9 BB 30 FF FF }', '{ E8 F6 41 00 00 E9 01 31 FF FF }', '{ E8 5E 94 00 00 E9 E4 35 FF FF }', '{ E8 54 94 00 00 E9 2A 36 FF FF }', '{ E8 4A 94 00 00 E9 78 36 FF FF }', '{ E8 6F 3C FF FF E9 5D 37 FF FF }', '{ E8 DE 91 00 00 E9 6B 3C FF FF }', '{ E8 D9 E4 FE FF E9 FE 3C FF FF }', '{ E8 68 FB FE FF E9 5C 40 FF FF }', '{ E8 61 AD FE FF E9 58 41 FF FF }', '{ E8 D2 FE FE FF E9 98 40 FF FF }', '{ E8 A0 F4 FE FF E9 B7 42 FF FF }', '{ E8 A4 A0 FE FF E9 41 44 FF FF }', '{ E8 F1 42 FF FF E9 FE 3B FF FF }', '{ E8 75 18 FF FF E9 66 3F FF FF }', '{ E8 9A 95 FE FF E9 8E 40 FF FF }', '{ E8 06 E7 FE FF E9 23 41 FF FF }', '{ E8 36 14 FF FF E9 7C FF FF FF }', '{ E8 F8 42 FF FF E9 EA 42 FF FF }', '{ E8 41 41 FF FF E9 95 41 FF FF }', '{ E8 E9 D8 FE FF E9 43 42 FF FF }', '{ E8 63 41 00 00 E9 A7 44 FF FF }', '{ E8 E3 0F 00 00 E9 65 FF FF FF }', '{ E8 EC AD FE FF E9 AE FC FF FF }']'" }, { "Hit": "PID 6764 triggered the Yara rule 'Microsoft_Visual_Cpp_8' with data '['\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 1E EB 00 02 00 00 00 E0 1E EB 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 80 0D E7 00 10 15 E7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 80 0D E7 00 10 15 E7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 80 0D E7 00 10 15 E7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C E0 ED 00 08 8E EF 00 10 28 ED 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 FC AF 00 00 00 00 00 01 00 00 00 00 00 00 00 04 00 00 00 }', '\\x00\\x00\\x00\\x00\\x00\\x00D\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00V\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 10 A0 00 00 00 B0 00 47 FC AF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 10 A0 00 00 00 B0 00 47 FC AF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 10 A0 00 00 00 B0 00 47 FC AF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04A\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x041\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x041\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x041\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x041\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x041\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x041\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x041\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x041\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x04@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x04@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x04@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x04@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x04@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x04@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x04@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x04@\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x04B\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04=\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04=\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04=\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04=\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04=\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04=\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04=\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x04=\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1F 04 3D 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1F 04 3D 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 1F 04 3D 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8C FC AF 00 00 }', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 E7 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D0 7C EC 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D4 72 EC 00 00 }', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00w\\x00\\x00', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00w\\x00\\x00', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '{ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }', '\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00', '{ E8 F8 4E 00 00 E9 E1 FD FF FF }', '{ E8 15 78 00 00 E9 99 FE FF FF }', '{ E8 0D 11 00 00 E9 5A FF FF FF }', '{ E8 84 1D 00 00 E9 62 FE FF FF }', '{ E8 A3 12 00 00 E9 27 FF FF FF }', '{ E8 19 14 00 00 E9 1D FF FF FF }', '{ E8 BA 01 00 00 E9 76 FE FF FF }', '{ E8 03 1E 00 00 E9 64 FF FF FF }', '{ E8 A1 21 00 00 E9 52 FF FF FF }', '{ E8 6E 3A 00 00 E9 DE FE FF FF }', '{ E8 75 00 00 00 E9 5A FE FF FF }', '{ E8 63 01 00 00 E9 BD FC FF FF }', '{ E8 56 07 00 00 E9 36 FE FF FF }', '{ E8 E4 20 00 00 E9 2F FF FF FF }', '{ E8 D0 05 00 00 E9 D9 FD FF FF }', '{ E8 F9 9F 00 00 E9 E5 03 FF FF }', '{ E8 58 A1 00 00 E9 5E 1C FF FF }', '{ E8 BB 54 00 00 E9 72 1E FF FF }', '{ E8 45 AC 00 00 E9 F2 21 FF FF }', '{ E8 19 AC 00 00 E9 69 22 FF FF }', '{ E8 16 42 00 00 E9 BB 30 FF FF }', '{ E8 F6 41 00 00 E9 01 31 FF FF }', '{ E8 5E 94 00 00 E9 E4 35 FF FF }', '{ E8 54 94 00 00 E9 2A 36 FF FF }', '{ E8 4A 94 00 00 E9 78 36 FF FF }', '{ E8 DE 91 00 00 E9 6B 3C FF FF }', '{ E8 63 41 00 00 E9 A7 44 FF FF }', '{ E8 E3 0F 00 00 E9 65 FF FF FF }']'" } ], "new_data": [], "alert": false, "families": [] } ], "malscore": 7.3, "ttps": [ { "signature": "network_cnc_http", "ttps": [ "T1071" ], "mbcs": [ "OB0004", "B0033", "OC0006", "C0002" ] }, { "signature": "network_http", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "network_questionable_http_path", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "procmem_yara", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002" ] }, { "signature": "discover_registry_mount_points", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002" ] } ], "malstatus": null }